Ledger, Coldcard... Are hardware wallets still safe in 2026?

Illustration generated with OpenAI
Read in the app Share this article
Listen to the article Give my opinionReact Add us to your favoritesAdd us
October 11, 2026Mattis Meichler

Coldcard, Ledger: nearly $200 million in stolen crypto

Coldcard, Ledger, Trezor, SafePal... In 2026, hardware wallets, meant to protect cryptocurrencies, are facing a series of security incidents. Chain INK has recorded ten incidents, two of which are estimated to have cost users nearly $200 million.

🔍️ Crypto assaults and kidnappings: how to protect yourself?

On July 30, Coldcard was hit by a flaw in its firmware, which generated private keys from an insufficient random number generator. Hackers could thus retrieve them, even when users followed good security practices.

Chain INK estimates the losses at $111 million across more than 5,200 wallets. Another analysis mentions $38 million stolen from 500 wallets.

⚠️ Ledger just paused sales at a Southeast Asian reseller.

~$87M is gone from 98 wallets that bought through them.

10 incidents in 2026, and how each broke 👇

→ CryptoBilis: reseller, $87M drained

→ Newsletter wave: shared email provider

→ SafePal: tracking plug-in

→... https://t.co/edC2GjRZti pic.twitter.com/4RbwsXNM3D

--- Chain INK (@0xchainink) October 9, 2026

On October 9, Ledger opened an investigation into thefts affecting customers of CryptoBilis, an Asian reseller. The French manufacturer asked it to suspend its sales. A manipulation of the devices before their delivery, in other words, a supply chain attack, is notably being considered.

Chain INK estimates the losses at $87 million, compared to $92.9 million according to Bitquery.

Coinbase
★ Our choice
★ 4.3/5

• +300 cryptos available
• €15 offered after your first transaction

Take advantage of itAffiliate link -- Advertisement

Data leaks, phishing, and vulnerabilities

The other incidents recorded did not lead to confirmed financial losses but revealed several weaknesses.

In August, providers of Trezor and SafePal exposed the personal data of more than 120,000 customers in total. Ledger had experienced a similar leak with its partner Global-e in January.

🔍️ What are the best wallets to secure your bitcoins?

This information facilitates phishing campaigns. In September, Trezor, BitBox, and CoinTracking reported fake security emails sent via their providers. Emails containing fraudulent QR codes also targeted users of Ledger and Trezor.

Cybersecurity researchers also discovered vulnerabilities in the devices themselves. The Ledger Donjon team demonstrated that it was possible to bypass certain protections of the Tangem and Trezor Safe 7 wallets using a laser, a technique requiring physical access to the devices and specialized equipment.

However, no cryptocurrency thefts related to these vulnerabilities have been reported. For its part, BitBox fixed several vulnerabilities in the internal software of its wallets in August, before any malicious exploitation became known.

Are exchanges paradoxically becoming safer?

This succession of incidents reignites the debate on self-custody of cryptocurrencies. Long considered the safest solution, hardware wallets require users to take responsibility for protecting their private keys.

👉 On the same topic -- Ledger: Mark Karpelès claims to have found a spy SIM card in a Nano X

In the face of phishing risks, physical theft, or device compromise, keeping cryptocurrencies on an exchange may paradoxically seem more reassuring. Especially since some platforms authorized under the European MiCA regulation offer financial protections that go beyond the mandatory segregation of assets.

Bitvavo, OKX, and Crypto.com notably have compensation programs against certain fraudulent access, while Coinbase benefits from insurance covering part of the assets held against theft and cyberattacks.

|----------------|---------------------|-------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Exchange | Regulation MiCA | Additional Protection | Amount and Conditions | CTA | | Bitvavo | AFM (Netherlands) | Account guarantee against unauthorized withdrawals and depositor insurance | Up to €100,000 per eligible account. Depositor insurance up to €755 million, with no equivalent individual guarantee. | Bitvavo ★ Our Choice ★ 4.5/5 * +400 cryptos available * €25 bonus after trading €100 Take advantage of it Affiliate link -- Advertisement | | OKX | MFSA (Malta) | OKX Shield: possible reimbursement after account compromise | Up to €100,000 (standard), €250,000 or €500,000 depending on VIP status, under conditions | OKX ★ Our Choice ★ 4.7/5 * +270 cryptos available * 8% bonus on your deposits converted from USDT to USDC Up to €3,500 per person until October 8 Sign up Affiliate link -- Advertisement | | Crypto.com | MFSA (Malta) | Account protection program against certain unauthorized withdrawals | Up to $250,000, under eligibility conditions | Crypto.com ★ Our Choice ★ 4.4/5 * +400 cryptos available * Trade +400 cryptos on a regulated platform in France Used by over 150 million users worldwide Take advantage of it Affiliate link -- Advertisement | | Coinbase | CSSF (Luxembourg) | Insurance against certain thefts and cyberattacks targeting custody systems | Partial coverage, with no individual reimbursement guaranteed; scope for European clients to be confirmed | Coinbase ★ Our Choice ★ 4.3/5 * +300 cryptos available * €15 bonus after your first transaction Take advantage of it Affiliate link -- Advertisement |

These measures are subject to eligibility conditions and do not guarantee reimbursement for all losses. The amounts announced are not directly comparable and depositor insurances do not constitute individual guarantees.

However, entrusting your cryptocurrencies to an intermediary does not eliminate risks. Exchanges remain exposed to hacking, financial difficulties, and withdrawal suspensions. While their protective measures may provide an advantage over self-custody, no solution offers absolute security.
Coinbase
★ Our Choice
★ 4.3/5

• +300 cryptocurrencies available
• €15 bonus after your first transaction

Take advantage of itAffiliate link -- Advertisement

Sources: Chain Ink, @Darkfost_Coc on X
The #1 Crypto Newsletter

Receive a summary of crypto news every day by email 👌

Join over 50,000 subscribers
Your email addressSign up
Yes, I agree to receive your newsletter according to your privacy policy

Mattis Meichler429 articles
A journalist passionate about Blockchain, the Web3 ecosystem, and Digital Art, I chronicle the evolution of these emerging sectors.