Mentioned in This Article
1. What is a hardware wallet and why do self-custody users rely on it?
A hardware wallet is a small dedicated device, roughly the size of a USB stick or a credit card, that creates and stores the private keys controlling a person's crypto and keeps them offline. As of October 16, 2026, the category covers makers such as Ledger, Trezor, Keystone, Tangem and Block's Bitkey, and it has recently been tested by a firmware flaw and a supply-chain tampering case.
The device exists because of a simple problem. Coins left on an exchange are controlled by the exchange's own keys, so a hack, a collapse or a freeze on withdrawals can leave customers unable to reach their money. The long-standing saying among crypto users, "not your keys, not your coins," captures that risk.
Holding your own keys solves the custody question but raises a security one. Keys kept in a software wallet on a phone or laptop sit on a machine that is connected to the internet, which exposes them to malware, phishing and remote attackers. A hardware wallet is designed to close that gap by making sure the keys never touch an online device at the moment a transaction is authorized.
2. How does a hardware wallet work?
A hardware wallet works by generating keys inside the device, signing transactions internally and handing back only the finished signature, never the key itself. That design means a compromised computer can request a signature but cannot read the secret that produces it.
Setup begins with the device using a random number generator to create the keys. A backup in the form of a seed phrase, usually 12 to 24 words, lets the owner rebuild the wallet if the hardware is lost or broken, and a PIN protects the device itself. Anyone who holds the seed phrase can recreate the wallet, which is why it should never be photographed, typed into a website or saved in cloud storage.
Sending crypto follows a fixed routine. The user prepares a transaction in companion software, such as Ledger Wallet (formerly Ledger Live), Trezor Suite or Sparrow. The unsigned transaction goes to the device, the owner checks the details on the device's own screen, and a physical button or touchscreen confirms it. The device signs the transaction inside and returns only the signature to the computer, which broadcasts it to the network.
Devices connect in several ways, each with trade-offs. USB is the wired option, Bluetooth and NFC suit mobile use, and QR codes or microSD cards allow fully air-gapped operation with no direct electronic link to the computer. Many models also include a secure element, a tamper-resistant chip of the kind found in passports and bank cards. Some add a feature called clear signing, which displays what a transaction does in plain language so that scammers have a harder time tricking users into approving a malicious smart contract.
3. Hot wallets versus cold storage: what is the difference?
Crypto wallets are usually sorted by whether they are connected to the internet. Hot wallets, such as browser extensions and mobile apps, are convenient for frequent payments and trading but run on devices that are online all the time. Cold storage keeps the keys offline, and a hardware wallet is the most common form of it, which is why the devices are often described as cold wallets.
The trade-off is convenience. Moving funds from a hardware wallet takes a few deliberate steps and a physical confirmation, which suits long-term holdings but is slower than tapping a phone. Many owners therefore split their funds, keeping small spending balances in a hot wallet and the bulk of their holdings in cold storage.
Because the wallet only signs what the owner approves, the quality of that approval step decides how much protection the device offers. A user who confirms transactions without reading the screen gives up much of the benefit, which is why clear signing and readable prompts have become a selling point.
4. Do the coins live on the device?
No, the coins themselves are never stored on the device. They remain recorded on the blockchain, and the hardware wallet holds the keys that prove ownership and authorize transfers. If a device is lost, the funds are not lost with it, provided the seed phrase survives and can be restored to a new unit.
The idea is more than a decade old. Trezor, built by the Czech firm SatoshiLabs, says it invented the hardware wallet in 2013. Ledger, based in France, was founded in 2014 and reports having sold more than eight million devices. Early products had tiny screens and awkward interfaces, whereas current models offer Bluetooth, NFC, touchscreens and even cameras.
5. What makes hardware wallets different from software wallets?
The main advantage is isolation. Even if malware has taken over a user's computer, an attacker cannot pull the keys off the device or approve a transfer without physically confirming it on the hardware. That is a stronger guarantee than a browser extension or mobile app can offer, because those run on the same machine as everything else the user does online.
Wallets have also moved beyond plain storage. Ledger added stablecoin yield through Kiln in April 2025, Tangem added Aave later that year, and Trezor launched native stablecoin yield through Morpho vaults in May 2026. The devices increasingly serve as a gateway to financial services while the keys stay under the owner's control.
The market has several distinct approaches. Ledger relies on secure element chips, runs a white-hat hacking team called Donjon and emphasizes polished design. Trezor is the open-source pioneer behind the Safe 3, Safe 5 and Safe 7. Keystone specializes in air-gapped signing through QR codes. Tangem sells NFC cards that can do away with seed phrases, and Bitkey, from Jack Dorsey's Block, is built around a multisignature security model.
6. Are hardware wallets hack-proof?
Hardware wallets are not hack-proof, and 2026 has supplied several reminders. In July, attackers exploited a five-year-old firmware bug in Coldcard devices that weakened the randomness used to generate seeds. Citing figures from the analytics firm TRM Labs, the exploit drained about 1,816 BTC, worth roughly $116 million, from more than 5,200 addresses.
The nature of that flaw matters. A firmware update cannot repair a seed that was already generated with weak randomness, so affected owners have to move their funds to a newly created wallet. Fixing the software does not fix the secret that was produced under faulty conditions.
In October 2026, Ledger disclosed a different kind of problem. An unauthorized chip, implanted in devices sold by the Southeast Asian reseller CryptoBilis, could read seed phrases during setup and transmit them. The disclosure followed reports that about $86 million had been drained from Ledger users. Ledger stated that its own Secure Element was not compromised; the weak point was the reseller network, which gave attackers a way to tamper with devices before they reached customers.
The industry responded quickly. Ledger halted reseller distribution in seven Asian markets, the European retailer MediaMarkt stopped selling the devices, and Trezor ended its reseller program as a precautionary measure. Third-party vendors and shipping partners have also exposed customer data, including addresses. No funds were lost in those cases, but leaked details can feed phishing attempts and in-person coercion, sometimes called wrench attacks.
For most individuals, the larger danger is not a sophisticated attack on the device. Phishing and poorly stored seed phrases remain far more common ways to lose money than a hardware compromise.
7. Where should you buy a hardware wallet?
Buyers should purchase only from the manufacturer's official website and should avoid second-hand units and unofficial marketplace listings. A device that has passed through unknown hands cannot be trusted to have generated its keys honestly.
The CryptoBilis case shows that even authorized resellers can become a vulnerability, so manufacturers may revise how they sell their products. Buying direct removes one link in the chain between the factory and the user, which is the stretch where tampering is hardest to detect.
8. Where is the hardware wallet heading next?
Hardware wallets are turning into full self-custody platforms. Ledger launched its Android-powered Atom in October 2026, focused on messaging, apps and agentic finance, and the company now calls its products signers rather than hardware wallets. In June 2026 it released Agent Stack, an open-source toolkit under which AI agents can check balances and draft transactions but cannot move funds without human approval on a Ledger device. Ledger Enterprise extends comparable controls to institutional treasuries, with policy enforcement anchored in hardware security modules.
Quantum computing is a longer-term concern, since it could eventually break the cryptography that protects current wallets. Trezor's Safe 7, released in late 2025, uses a post-quantum signature scheme to verify its bootloader and supports quantum-resistant updates without requiring users to move their keys. In October 2026, Vitalik Buterin and Ethereum Foundation researcher Justin Drake warned that artificial intelligence could break crypto encryption before quantum computers do.
There have been business setbacks too. Ledger weighed a U.S. initial public offering at a valuation of about $4 billion but paused the plan in May 2026 because of weak market conditions.
9. What should owners take from the 2026 incidents?
The Coldcard and CryptoBilis episodes, along with the data leaks, show that a hardware wallet is not a complete answer to security. It remains one of the strongest tools available for keeping keys away from internet-connected machines, but it works best as one part of a wider self-custody routine.
That routine includes buying from official channels, storing the seed phrase offline and away from cameras and cloud services, confirming every transaction on the device screen, and staying alert to phishing. Owners of devices affected by a known flaw should follow the manufacturer's guidance and move funds to a fresh wallet when told to.