Six hardware wallet brands have disclosed security problems in 2026, but users lost crypto in only two cases. The latest, at Ledger, involved a device tampered with before it reached its buyer.

A hardware wallet keeps the secret 24-word recovery phrase that controls a person’s crypto off the internet. This year, attackers went after almost every link around that phrase.

Weak Keys, Lasers, and Data Leaks Hit Wallet Makers in 2026

On July 30, thieves began draining Coldcard wallets whose keys were created with weak randomness. Galaxy Research later said Coldcard losses passed $115 million.

Ledger’s in-house security team used lasers to break chips in the Trezor Safe 7 in June and Tangem cards in July. Both attacks need the device in hand and specialist lab equipment.

Trezor said user funds stayed safe. Tangem said the risk to everyday users was “virtually non-existent” and noted the researchers work for a rival.

In August, BitBox fixed several firmware flaws its own engineers called severe. It reported no stolen funds.

Other incidents exposed customers, not keys. Trezor’s shipping partner leaked data on 13,689 buyers, and a SafePal data breach exposed nearly 40,000 home addresses.

“2026 might go down as one of the wildest years for hardware wallet security,” Wise Advice noted.

Ledger Tampered Wallets Reported Beyond Asia

Ledger confirmed Saturday that a victim’s device carried an unauthorized hardware implant. In a Sunday update, it said every confirmed case involves Malaysian reseller CryptoBilis.

72 hour update on reseller CryptoBilis incident 🔽 As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.… — Ledger (@Ledger) October 11, 2026

On-chain investigators estimate losses near $90 million. One buyer lost 80 Bitcoin days after setup.

CryptoBilis has stopped hardware wallet sales. Its former co-founders said on LinkedIn they handed the company to new owners in March.

Separately, some users say Ledger wallets they reportedly bought weeks ago from an official European store held wiring genuine units lack.

What Wallet Makers Tell Buyers to Do

Ledger tells buyers to purchase only from Ledger or authorized resellers. It told CryptoBilis buyers not to set up unused devices and to move funds to a new recovery phrase.

Ledger’s Genuine Check confirms a device’s security chip is authentic. However, it cannot catch every physical change around that chip.

BitBox urges users to install updates and type recovery words only on the device itself. Trezor says phishing remains the bigger everyday risk.

Ledger has also called on other wallet makers to build shared anti-tamper and chain-of-custody standards.

So, is any hardware wallet safe in 2026? Not fully, since no security chip was cracked outside a lab this year, but Coldcard and Ledger users still lost money to weak keys and tampered devices.