if hardware wallets aren't safe, where do i keep my crypto?

your eyes are barely open. the alarm went off four minutes ago, the phone is already in your hand, and you are doing the thing you swore you would stop doing before coffee. scrolling.

then a trezor post slides up the feed. security notice. and your stomach does the small drop it always does now, because you have been here before, and the first word out of your mouth today is not a polite one.

not again.

so before the panic sets in, read the notice properly, because what happened on august 13, 2026 is not what most people think happened.

what actually happened to trezor

a company called shipmonk handles some of trezor's order fulfilment. somebody got into shipmonk's systems and walked out with customer order data. trezor's first notice said eleven thousand seven hundred and forty two people had their full details exposed, names, emails, phone numbers, home addresses, with another one thousand nine hundred and forty seven partially exposed. roughly thirteen and a half thousand customers in total, covering orders received between may 10 and august 8, 2026. later disclosures pushed the affected total past eighty thousand.

trezor's own statement is blunt about the scope: its systems were not compromised, the devices are secure, and the risk to affected customers is more sophisticated phishing. no keys were touched. no seed phrases were exposed. no funds moved.

what leaked was where you live.

that is not nothing, and it is worth being honest about why. a database of names, phone numbers and home addresses belonging to confirmed crypto owners is precisely the shopping list for the fastest growing crime in this industry, and it is not a digital one. trezor has since announced an anonymous delivery option, locker pickup with neutral packaging, which tells you exactly which threat it thinks matters most.

the 2026 scoreboard

so run the year properly, because the panic and the record do not match.

january 5, 2026, ledger disclosed a breach at global-e, a payments partner, exposing customer names, emails, phone numbers and addresses. january 10, a single individual lost around two hundred and eighty two million dollars in litecoin and bitcoin after being talked into handing over a seed phrase by someone impersonating wallet support.

around april, researchers documented counterfeit ledger devices selling on aliexpress and taobao at full retail price, with hidden esp32 chips and a trojanised version of ledger live that stored pins and seed phrases in plain text. through february and may, physical letters started arriving at people's homes, hologram and qr code, impersonating trezor and ledger, demanding an urgent authentication check.

the second half kept the same shape. july 8, an npm maintainer hijack slipped a malicious injective sdk into around three hundred and ten installs. august 16, safepal disclosed that an order-tracking plug-in had exposed 39,798 customers. august 17, bitbox found and patched a firmware issue in the bitbox02 itself, fixed from version 9.26.5. september 9, a shared email provider leaked newsletter lists for three companies at once. none of them were tied to lost coins as of september 2026.

then the lab findings. june 3, ledger's donjon team disclosed a laser fault injection attack on the tropic01 chip inside the trezor safe 7. in july, tangem cards were shown vulnerable to similar physical attacks. both required the attacker to physically hold your device, decapsulate a chip, and point laboratory equipment at it. as of september 2026, neither had been used to take a single dollar from a real person.

look at that list and sort it. data breaches at logistics and payments vendors. a man tricked over a phone. fake devices bought from a marketplace. letters in the post. laser rigs in a research lab.

not one of those is a hardware wallet being hacked.

the devices kept working. everything around them leaked.

except once

on july 30, 2026, that changed, and it is worth understanding because it is the only real one.

coldcard wallets started getting swept. not phished, not tricked, swept, by attackers who never touched the devices. the cause was a firmware change made in march 2021 that quietly rerouted seed generation away from the hardware random number generator to a software fallback. the effective randomness collapsed from a designed one hundred and twenty eight bits to roughly forty on older models and seventy two on newer ones, which is low enough to reconstruct people's keys offline.

estimates of the damage vary by who is counting. galaxy research put it near eighty eight million dollars across around four and a half thousand addresses. trm labs went higher, roughly eighteen hundred bitcoin and close to one hundred and sixteen million, calling it the third largest crypto hack of 2026 at the time. by september 2026 the tally stood at more than fifty two hundred affected wallets and around a hundred and eleven million dollars. coinkite shipped fixed firmware, destroyed vulnerable stock, and made the crucial point that updating does not repair an existing seed. an affected user has to generate a new one and move everything.

now the detail that matters more than the number.

every single drained address was single signature. multisig setups were untouched. so were seeds generated with dice, and seeds protected by a passphrase.

the flaw was real, catastrophic, and entirely survivable by anyone who had done one of two boring things.

what zachxbt actually said

two weeks before coldcard, in mid july 2026, zachxbt wrote that all hardware wallets are complete garbage and that he does not advise using them for important tasks like signing transactions or storing funds. he called ledger the worst of them, mostly for shipping constant interface updates that break simple actions.

it landed like a grenade, and it got flattened in the retelling. he was not claiming a secure element had been broken, and he did not point at a new vulnerability. his argument was about reliability, software bloat, and the false confidence that comes from owning a device you assume is doing the work for you.

read what he recommended instead, because that is the actual content. a two-of-three safe multisig with separate signer devices. seed phrases stored offline. test transactions before moving anything large. spending wallets kept apart from savings.

tornado cash co-founder roman storm pushed back, pointing out that mobile wallets mostly lack passphrase support, which is the single strongest feature a hardware wallet gives you. both of them are right about something, and neither of them said the box on your desk is cryptographically broken.

what is actually taking the money

the numbers settle the argument.

certik counted around one point three billion dollars lost across three hundred and forty four incidents in the first half of 2026. the largest category was wallet compromise at four hundred and forty four million, driven by two north korea linked infrastructure hits in april.

phishing took three hundred and sixty six million across sixty three incidents, with the volume of attacks falling by half while the losses barely moved, which means the attacks got fewer and much better aimed.

trm labs, counting differently, logged nine hundred and seventy two million across two hundred and seven incidents, the highest incident count in any six month window it has tracked.

and the fastest growing category is not technical at all. chainalysis reported in august 2026 that violent physical attacks on crypto holders had taken more than thirty million dollars that year across forty six documented incidents, up from around one point nine attacks a month in 2025 to four point six a month. home invasions made up thirty seven percent of cases. france was the epicentre. relatives and acquaintances were targeted in roughly a quarter to a third of them.

set that against the coldcard number, which is the only 2026 loss attributable to a device failing at its job.

people are not losing coins because the chip broke. they are losing them to a phone call, a fake support page, a signature they did not read, and increasingly to somebody at the door.

so where tf do you keep it?

the answer is unglamorous and it barely changed.

1️⃣ a few thousand dollars. a reputable exchange or a good mobile wallet is fine. your own mistakes are a bigger threat to you than the exchange is, and adding hardware you do not understand adds a way to lose everything permanently. cz made a version of this argument in august 2026, citing data that more bitcoin has been lost to self custody mismanagement than to every exchange hack combined. treat the figure as contested, treat the direction as real.

2️⃣ tens of thousands. two routes, and the right one depends on which kind of person you are.

the hardware wallet, bought direct from the manufacturer, never a marketplace. verify it on arrival. a device that turns up with a seed already filled in or a scratch off card is not a shortcut, it is the entire scam. then do the two things almost nobody does. set a passphrase, the extra word that turns a stolen seed into a dead end. and back the seed up on metal, stored somewhere that is not your desk drawer.

or the one zachxbt actually recommended and nobody discusses. a cheap phone, bought from the manufacturer, used for nothing else. no email, no telegram, no browsing. there is no counterfeit iphone problem, apple's shipping database does not label you a crypto owner, which is exactly what leaked more than once in 2026, and the secure enclave gets more scrutiny in a month than a boutique vendor's firmware gets in a decade, which is the gap that produced coldcard.

what you give up is the passphrase, since most mobile wallets skip it, and the separate screen. when the phone is both host and signer, a serious exploit means approving a malicious transaction on a display the malware controls.

pick honestly. a clean phone used properly beats a hardware wallet used carelessly, and a hardware wallet exists because it enforces the separation instead of asking you to remember to. a clean device also starts clean and does not stay clean by itself, and the failure is never dramatic, it is one telegram install on a boring tuesday. and if you go this way, phone, not laptop.

3️⃣ serious money. multisig, two of three, signer devices from two different manufacturers. coldcard is the argument for this in full. a quorum from one brand inherits that brand's bugs, and a quorum with a second vendor would have survived july 30 without a scratch. this is also where the two routes stop competing, because a clean phone works fine as one signer among several. if managing it yourself sounds like a way to lose your keys, casa or unchained will hold one key and cannot move funds alone. above a million or so, qualified custody is a reasonable leg of the setup rather than a betrayal of principles.

4️⃣ everyone, regardless of size. verify every transaction on the device screen, because that is what defeats the clipboard malware that swaps addresses. never type your seed into anything, ever, including a support agent who knows your name and address. after 2026's leaks, plenty of them will.

and stop telling people what you hold. the wrench attack numbers are what they are because somebody knew where to go.

the part worth keeping

there is an uncomfortable symmetry in 2026's incidents. the brands that leaked customer addresses did not lose anyone's coins. the brand that lost coins never leaked an address. the attacks that made researchers famous required a laser and a decapsulated chip. the attack that took two hundred and eighty two million required a convincing voice.

the device on your desk is close to the only component of this system that has consistently done its job. what failed around it was shipping databases, marketplace listings, support impersonation, and human trust, which is what has always failed, in every financial system, in every era.

so the answer to where you should keep your crypto is not a brand.

it is a passphrase, a second manufacturer, and the discipline to never say the words out loud.

tanishq bodh

runs chain ink from a laptop with 40 tabs open. 39 are whitepapers, one is fpl.

+ add fren