Hardware wallets explained after Coldcard bug and tampered Ledger devices

Key points

• A five-year-old Coldcard firmware bug let attackers drain about 1,816 BTC, worth roughly $116m, from more than 5,200 addresses in July 2026.
• Ledger said an unauthorised chip in devices sold by reseller CryptoBilis read seed phrases during setup, after reports of about $86m drained from its users.
• Ledger paused its US IPO plans in May 2026 and launched the Android-powered Atom in October 2026, dropping the term hardware wallet for signer.

The devices generate keys with a random number generator and back them up with a 12 to 24 word seed phrase protected by a PIN. When sending crypto, the user builds a transaction in companion software, checks it on the device screen and confirms with a button or touchscreen, so only the signature leaves the device.

Decrypt reports that hardware wallets are not hack-proof. In July 2026, attackers exploited a five-year-old Coldcard firmware bug that weakened seed randomness, draining about 1,816 BTC, worth around $116m, from more than 5,200 addresses, according to TRM Labs. Updating firmware does not fix seeds already created, so affected users must move funds to a new wallet.

In October 2026, Ledger said an unauthorised chip implanted in devices sold by Southeast Asian reseller CryptoBilis could read seed phrases during setup and transmit them to an attacker, after reports that about $86m had been drained from Ledger wallet users. Ledger halted reseller distribution in seven Asian markets, MediaMarkt stopped sales and Trezor wound up its reseller programme. Ledger put a US IPO on hold in May 2026 and launched the Android-powered Atom in October 2026.

What to watch: Ledger's reseller programmes and the wider industry response remain in flux after the CryptoBilis tampering, with manufacturers expected to rethink how devices reach buyers.

Read the full story on Decrypt →