Can hardware wallets be hacked? The real ways people lose crypto from Ledger, Trezor and other devices

Yes, but rarely in the way people imagine. A genuine hardware wallet that you bought from the maker and set up yourself is very hard to break into over the internet; most real losses come from a tampered device, a scam that gets the owner to hand over the recovery phrase, or a transaction the owner approved without being able to read it. In short, people are tricked far more often than devices are hacked, although a 2026 Coldcard firmware bug was a rare exception.

How does a hardware wallet protect your crypto?

A hardware wallet keeps your private keys on a small dedicated device instead of on your phone or laptop. When you send crypto, the computer prepares the transaction, the device signs it inside, and you confirm it by pressing a button while reading the details on the device's own screen. Malware on your computer can see the transaction, but it cannot copy the keys.

That closes off the most common attack on software wallets, but not every attack. Most of those below go around the chip rather than through it. New to wallets? Start with crypto wallets explained.

Can a hardware wallet be tampered with before you get it?

Yes, and 2026 brought a clear example. In October, Ledger confirmed that devices sold through CryptoBilis, a Southeast Asian reseller that was then authorized to sell both Ledger and Trezor wallets, had been fitted with hidden parts. In its published response (opens in a new tab), Ledger says an organized criminal group spent months buying genuine devices, opening them, adding components designed to record the recovery phrase as the owner sets the device up, and feeding them back into sale through resellers in the region. Ledger says there was no flaw in its chip, operating system or servers, and calls it an attack on its distribution channel after the devices left its control.

A second brand followed. On October 29, Trezor reported (opens in a new tab) that a customer in Indonesia had reported finding an implant inside a Trezor Safe 5 bought from CryptoBilis in August. As of its post, Trezor said it had not yet received the device to confirm the report but was treating it as credible, and that no CryptoBilis buyer had reported losing funds to it. We cover the full timeline in our CryptoBilis post.

Why didn't the built-in authenticity check catch it? Ledger's own hardware integrity page (opens in a new tab) says its Genuine Check proves the secure element is real, but warns that a device can still pass while hiding extra parts, like a spy implant, as long as the original secure chip is untouched.

A related risk is a stolen authenticity key. Keystone, which makes air-gapped wallets, said in October 2026 that an attacker who broke into its website took customer records and the key it uses to confirm its devices are genuine, according to Blockhead (opens in a new tab). Keystone said that key could let someone build counterfeits that pass its check, and that it would destroy 18,835 devices in stock that carry it. Keystone added that no one's recovery phrase or private keys were taken. Details are in our Keystone post.

Can scammers steal your seed phrase without touching the device?

This is one of the most common ways people lose crypto. Your recovery phrase can rebuild your wallet on any device, so a thief who gets the words doesn't need your hardware at all. Scammers use every channel to get it:

• Fake apps and websites that look like the official companion app and ask you to "restore" or "verify" your wallet by typing your words.
• Fake support agents on social media or the phone who then ask for the phrase.
• Breach-themed emails, texts and letters that warn of a security problem and send you to a fake site.
• Mailed "replacement" devices. After Ledger's 2020 customer data breach, details of 272,853 buyers were published on a hacking forum in December 2020, BleepingComputer reported (opens in a new tab). In 2021, scammers mailed some of those customers modified devices that looked like a Ledger Nano X, along with a fake letter. The instructions told owners to run a program from the device and type in their existing recovery phrase, which was then sent to the attackers.

Our seed phrase guide covers storing it offline.

Can a wallet drainer empty a hardware wallet?

Yes, if you approve the transaction. A wallet drainer is a malicious site or contract that asks you to sign something that looks routine but actually hands over your tokens. The device signs what it is given; it cannot know your intent.

The danger grows when the device cannot show what you are signing. Ledger calls this blind signing: the screen displays only a raw code instead of readable details. In its explainer on clear signing (opens in a new tab), Ledger compares it to signing a blank check, says scammers have used it to take billions of dollars, and notes that blind signing is switched off by default on its devices.

• Leave blind signing off unless you understand exactly why a specific transaction needs it.
• Check the website address before you connect, and read the amount, recipient and action on the device screen, not just the computer.
• Keep long-term savings in a separate wallet from the one you use with apps.

Learn the warning signs in our guide to phishing and wallet drainers.

Can hackers break the chip or firmware?

Researchers do break hardware wallets in the lab, which is how makers find and fix flaws. These attacks usually need the device in hand and special equipment.

A well-known example came from Kraken Security Labs, the security team at the exchange Kraken. It published a method (opens in a new tab) for pulling the encrypted seed out of the Trezor One and Trezor Model T using voltage glitching, with about 15 minutes of physical access, then cracking the PIN that protects it. Kraken said the weakness sat in the microcontroller those models use, a type of chip it said was not designed to hold secrets, so it was hard to fix without a hardware redesign. It also said Ledger's security lab, the Ledger Donjon, had done similar work, and that it disclosed the details to Trezor on October 30, 2019 before going public. Kraken advised keeping the device out of other hands and turning on a BIP39 passphrase, which is not stored on the device and blocks this attack.

Can a firmware bug expose seeds without physical access?

Rarely, but it happened in 2026. Coinkite, maker of the Coldcard, warned owners in summer 2026 that a firmware bug had weakened how some devices created recovery phrases. In its security advisory (opens in a new tab), Coinkite says the devices themselves were not hacked or remotely accessed; attackers rebuilt the matching private keys offline from the weak seeds and took the funds. Coinkite says the problem began with Mk2 and Mk3 firmware released in March 2021, and that seeds created on the newer Mk4, Mk5 and Q models before the 2026 fixed firmware are also affected, though less severely. Galaxy Research, which tracked the thefts, later attributed about 1,789 BTC taken from 8,865 addresses to the Coldcard hack, worth about $115 million when stolen, according to a late-August 2026 tally reported by Cointelegraph (opens in a new tab). Earlier estimates, including one cited by TRM Labs (opens in a new tab), were preliminary.

This is the rare case where owners did nothing wrong. Coinkite says updating the firmware does not repair a seed that was already created; unless the owner added at least 50 private dice rolls when making it, affected owners need a new seed and must move their funds to it. It also says a strong, unique BIP39 passphrase added a separate barrier for wallets that used one.

What was the Ledger Recover controversy?

In 2023 Ledger announced Ledger Recover, a paid, opt-in service. As Ledger describes it (opens in a new tab), the device encrypts a copy of the seed, splits it into three fragments and sends them to three separate companies: Coincover, EscrowTech and Ledger itself. Some people questioned whether the service could open a path for hackers, and Polygon Labs' security chief Mudit Gupta warned it could be a "horrendous idea," Blockworks reported (opens in a new tab). After the backlash, CEO Pascal Gauthier blamed an "unintentional communication mistake," and Ledger said it would hold back the launch until the related code was open source. The service, provided by Coincover, eventually went live on October 24, 2023, Ledger announced (opens in a new tab). It wasn't a hack, but it showed that you also have to trust the maker's firmware.

How do you keep a hardware wallet safe?

1. Buy from the manufacturer's own store. Avoid marketplaces, secondhand devices and unusually cheap listings.
2. Set the device up as new and write the recovery phrase on paper or metal yourself. Reject any phrase that came in the box.
3. Never type the phrase into a computer, phone, website or app, and never share it with anyone.
4. Update firmware only through the maker's official app or the signed firmware files on its official website.
5. Read every transaction on the device's screen, and keep blind signing off.
6. Treat every unexpected email, call, letter or package about your wallet as a scam until you have checked it through the official website.

The bottom line

Apart from the rare firmware bug and lab attacks that need the device in hand, the incidents above share a pattern: the attacker went around the device, by tampering with it before delivery, by persuading the owner to reveal the phrase, or by getting the owner to sign something harmful. A genuine wallet bought direct, a phrase that has never touched a screen, and a habit of reading the device's screen will stop most of them. For more, browse our security and scams hub.

Updated November 9, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio