In 2026, hardware wallet vulnerabilities led to significant losses for users. According to Axis Intelligence, total losses from these devices exceeded $241 million. Forbes estimates that overall Bitcoin hack losses for the same year surpassed $500 million.
A firmware flaw in Coinkite Coldcard devices, affecting builds since March 2021, allowed attackers to compromise seed phrase generation. Between late July and early August 2026, over 1,800 BTC were stolen, with an estimated value between $100 million and $150 million.
A separate supply-chain attack involved Ledger Nano X and Nano S Plus units sold by the authorized reseller CryptoBilis. These devices contained hidden implants that compromised user keys, resulting in estimated losses of $90 million to $100 million by mid-October.
Neither Coinkite nor Ledger experienced a compromise of their core infrastructure, as issues were limited to specific firmware versions and hardware batches. Experts now advocate for multi-signature setups using devices from different manufacturers to mitigate single-vendor risks.
The incidents have prompted a shift in investor behavior, with some market participants reconsidering self-custody in favor of regulated custody services and exchange-traded funds. Analysts note increasing concern regarding the security of hardware-based storage solutions.
