2026 Has Been the Worst Year on Record for Hardware Wallet Security
The device sitting in your drawer was supposed to be the answer. Not your keys, not your coins. Hardware wallets, the small physical devices used to store crypto private keys offline, were the clearest response the industry had to exchange hacks and hot wallet drains.
In 2026, that answer developed serious problems. Two more hardware wallet makers, Keystone and BitBox, disclosed security incidents this week, bringing the year’s confirmed total to six brands. Axis Intelligence estimates total hardware wallet losses for the year exceeded $240 million when major incidents and other reported attacks are combined.
What Happened with Keystone and BitBox?
Keystone confirmed on October 24 that its official website was accessed without authorization on October 20, exposing customer delivery and purchase data. The company stated publicly: “Devices delivered before October 20th can still be verified as genuine through the normal process.” Private keys were not reported as compromised.
BitBox was also named by Gizmodo as affected via the Brevo email and CRM platform incident. The full scope of the BitBox exposure had not been confirmed by the company directly at the time of publication. (Verify before publishing.)
The distinction matters: Keystone and BitBox reported data breaches, meaning customer information was exposed, not direct fund theft. That said, leaked shipping addresses carry a threat most industries don’t face. CertiK reported a 33 percent year-over-year increase in “wrench attacks” in the first half of 2026, the industry term for in-person, violent incidents where holders are forced to hand over assets. If an attacker knows you ordered a hardware wallet and has your home address, they have a starting point for a physical threat, not just a phishing email.
The Ledger CryptoBilis Attack: Hardware Implants, $90 to $102 Million Drained
The most severe incident of the year began on October 9, when Ledger started investigating reports of theft involving wallets purchased from CryptoBilis, an authorized reseller in Malaysia, Indonesia, and the Philippines. Blockchain intelligence firm Bitquery estimated approximately $102 million in losses across 324 wallets, with TRON, Bitcoin, and Ethereum accounting for most of the stolen funds. Ledger has not confirmed that figure.
The attack was a supply-chain compromise. Malicious hardware implants were inserted into devices before customers received them, capturing the 24-word seed phrase at the moment of setup and transmitting it to attackers who then reconstructed and drained the wallets remotely.
CryptoBilis had been sold in March 2026 to undisclosed new owners, with the sale agreement reportedly barring any public announcement until mid-October. That timeline points to an organized operation months in the planning. Security journalist Kim Zetter reported that Ledger was warned about hardware implants by hardware hacker Joe Grand as early as March, but took limited action because no implants had yet been used to steal funds. Ledger has not confirmed or denied that allegation. (Verify before publishing.)
The fallout spread beyond Southeast Asia. MediaMarktSaturn, the German retail group behind roughly 1,070 MediaMarkt and Saturn stores across Europe, pulled Ledger wallets from its shelves after implants were reported in devices purchased at European store locations.
The Coldcard Firmware Bug: A Five-Year-Old Flaw, $88 to $130 Million Gone
If Ledger was about what happened to the device on the way to the customer, Coldcard was about what was wrong inside it from the start.
Starting July 30, wallets began being drained after attackers exploited a bug in Coldcard’s key generation code introduced in firmware shipped in 2021. Hardware wallets generate a private key using randomness. Coldcard’s firmware was supposed to pull that randomness from a dedicated hardware chip. Due to a coding error, some versions silently fell back to a weaker software-based source instead, one seeded by the device’s own ID and timer at power-on, and not random enough to be secure.
For affected Mk2 and Mk3 devices, the total entropy was approximately 40 bits, roughly one trillion combinations, which an attacker could test in about 13 days at one million keys per second, without ever touching the physical device. The attack swept roughly 7,300 addresses, with confirmed losses exceeding $88 million and privately reported figures suggesting as much as $130 million. (Loss figures vary by source; use the conservative confirmed range.)
Trezor and SafePal: The Third-Party Problem
Trezor and SafePal did not suffer direct fund losses at scale, but both confirmed significant customer data exposures that extended the year’s damage.
Trezor reported on August 13 that 13,689 customers had data exposed after its logistics partner ShipMonk was compromised via a zero-day SQL injection vulnerability. SafePal disclosed shortly after that a flaw in an order-tracking plugin exposed the personal information of 39,798 customers, including names, physical addresses, and contact details, covering orders placed between March 2025 and April 2026. SafePal said private keys were not compromised and removed more than 30 fraudulent websites linked to the incident.
Is Cold Storage Still Safe? What to Actually Do
Hardware wallets still protect against remote attacks, exchange insolvency, and hot wallet drains. What 2026 has demonstrated is that they are not immune to supply-chain compromise, firmware bugs, or the physical risks that come with a breached database.
Multi-vendor multisig remains the strongest defense available: a properly configured setup requiring two of three devices from different manufacturers would not have been emptied by either the Coldcard flaw or the Ledger implants alone. For most holders, the more immediate steps are simpler:
- Buy directly from the manufacturer, not third-party resellers or marketplaces.
- Inspect packaging and the device itself for signs of tampering before first use.
- Coldcard users on affected firmware (Mk2/Mk3, versions 4.0.1 through 4.1.9): upgrade firmware and regenerate keys per Coinkite’s advisory.
- Anyone who bought a Ledger through CryptoBilis in the past 90 days: do not set up the device; contact Ledger support directly.
- Do not respond to any unsolicited contact referencing your hardware wallet purchase, whether by email, post, or phone.
Why It Matters
The self-custody model rests on trust in the tools. If a five-year-old firmware bug could sit undetected in a well-regarded device, some holders are now asking what basis there is for treating other hardware wallets as safe simply because they haven’t been caught yet. That question does not have a comfortable answer right now. “Not your keys, not your coins” remains sound advice. It just turns out the supply chain, the firmware, and the reseller network are all part of what “your keys” actually means.
This article is not financial advice. Do your own research before making any security or investment decisions.
