In 2026, six hardware wallet manufacturers reported security vulnerabilities. While most incidents involved data leaks or laboratory-based attacks, some users suffered financial losses due to compromised devices and weak key generation.
Coldcard experienced significant losses exceeding $115 million after attackers exploited weak randomness in key creation. Meanwhile, Ledger confirmed cases of tampered devices containing unauthorized hardware implants, specifically linked to the Malaysian reseller CryptoBilis. On-chain investigators estimate losses from these incidents at nearly $90 million.
Data security also proved problematic for the industry. A shipping partner for Trezor exposed the information of 13,689 customers, while a breach at SafePal compromised the home addresses of approximately 40,000 users. BitBox addressed several severe firmware flaws in August, though no funds were reported stolen in that instance.
Manufacturers are now emphasizing stricter supply chain security. Ledger advises customers to purchase devices exclusively from official channels and utilize the Genuine Check feature. Other companies, including BitBox and Trezor, continue to recommend regular firmware updates and caution against phishing attempts as primary security measures.
