Are Hardware Wallets Still Safe? Major Breaches & Better Options

0:00 If you've been in the crypto space for any amount of time, you've probably been told that you should keep your crypto assets on a hardware device or cold storage. This ensures that if you're self-custody, that's taking your assets off an exchange and holding them yourself in your own wallet, ensures that your seed phrase, your recovery phrase isn't exposed online.

0:18 And this has been the gold standard for everyone in the crypto space for a very long time, until recently. Now we've seen all of these hardware companies being compromised in so many different ways from data breaches, from customer details to the actual seed generation being compromised or having flaws and vulnerabilities in them all the way to the supply chain and ledger, for example, having extra hardware being implanted in them as listening devices. So we've seen so many different compromises all being exposed this year alone. And it's absolutely insane because we thought that this was the gold standard. This was the way to do things, but clearly it's not. And we need to review how we are going to store our assets. If you're self custodying,

1:05 let's go through some of these vulnerabilities and compromises. So you're aware of what's going on and I'll leave you with some options at the end here so that you can review what you're doing with your crypto assets. and do something about it. So first off, let's have a look at some of these compromises here. This is a nice graphic that was put up by this particular user here, Solana Sensei, and it goes through some of the very big compromises that have happened over this year alone from Ledger, Coldcard, Tracer, Safepower, Bitbox, and more recently, Keystone as well. Now, the Keystone one was quite significant. After they did the investigation, it wasn't just the customer data that was leaked. So that had 25,119

1:49 customers leaked in regards to their shipping details, their address details and all that stuff. But this one here was quite interesting. 18,835 hardware wallets had to be destroyed. And this was because their security key that they used to verify if a device was tampered with or not was also compromised. So hackers managed to get into the website find that secure key, and now they could do a supply chain attack because this key allowed users to verify if their device had been tampered with or not. And if you have that key, you can essentially tamper with all the devices, put in your own key there, and then pretend that your devices are legitimate. And it's really unfortunate to hear because Keystone is probably one of my

2:38 favorite hardware wallets out there being fully air-gapped using QR codes. It's a very good experience in using a hardware device. Now, this other one here, this is Coldcard. And this one happened earlier this year, 2026. And Coldcard had an issue with their way that the seed phrase is generated within the wallet itself. Now, normally you'd want a great deal of randomness within that generation. But in this case, there wasn't a big randomness in the generation of that seed phrase.

3:10 And because of that, you could essentially regenerate or redo all those seed phrases and work them out. It's like rolling the dice once or twice and suddenly you keep on rolling sevens and you're getting the seed phrases over and over again from those devices. And this led to a massive compromise with 594 BTC being drained and from 500 air-gapped wallets in 25 minutes. That's huge. And it had massive impact because a lot of people trusted this particular wallet and people were essentially losing their entire life savings that they had put into Bitcoin in thinking they were doing the right thing using a hardware wallet. Now, this one here is another more recent one. This is from Foundation Wallet. I have heard of these guys before.

3:55 This is what the hardware device kind of looks like. Now, this Foundation Compromise wallet It looked like the hackers managed to get into the Cloudflare account and compromise one of the API keys. And with the API key, they could send out emails from the foundation domain. So that's very concerning.

4:15 Now the major breach that happened recently is with the ledger devices itself. I did a whole video that covered this one here, but the ledger devices here had eSIMs implanted in them and listening hardware devices. So that way, the hackers could actually see the seed phrases as they were being generated, get a copy of them, and then listen to the device and see when large amounts of crypto assets were being moved to these hardware devices. Once they saw that, they could write the scripts around those particular wallets so that they could drain them all in one go. And that is exactly what happened in this case.

4:53 So as soon as Mark Capelles started doing the research and exposing this online, I believe the hackers panicked and just flicked the switch, drained all the wallets that they had access to and started liquidating all those assets. The more concerning part here is the fact that the whole supply chain here was compromised. So if you're buying alleged device from Amazon, from any third party, it could have been compromised. Now, from investigations, we've seen that the reseller in Southeast Asia said They were the one that were selling this and it appeared that their supply chain had been compromised along the way. So hackers were receiving the hardware devices and implanting the listening devices and then sending

5:38 them back to the reseller to resell online or wherever they were selling it through. And because of that, so many of these devices were compromised, but this one had a major impact. So if you are interested in finding out if your ledger device has been compromised or not. There are instructions online on how you can open up your ledger. It's quite easy to do. You can just pop it open and then look for these particular bits of hardware that appear to be soldered onto the main PCB board. And that would be a good indicator to let you know if your ledger device has been compromised or not. But you can see here a massive pattern.

6:15 All of these particular devices have been compromised in some sort of way. And when there are a lot of value being stored on these, they become a target. Now, one of the main concerns that I have around the customer data breaches across all of these hardware companies is wrench attacks. So if you have a look at this meme here, it just says it all. So crypto nerd's imagination, his laptop's encrypted. Let's build a multi-million dollar cluster to crack it. No good. It's 4096 bit RSA. Blast, our evil plans are foiled. What actually happened? His laptop's encrypted. Right, drug him, hit him with this $ 5 wrench until he tells us the password. Got it. And that's what we're seeing.

6:59 And it's very concerning. There's so many wrench attacks around the world that it's getting more common. So this attack here on Ledger, where they had their database compromised back in 2020, It leaked over 1 million email addresses, but then also 272,835 hardware wallet orders. That includes their email, their physical address, their phone numbers, and all that stuff.

7:23 This led to fake Ledger devices being sent out across the world. Isn't that crazy? So it's like, oh, your Ledger was potentially compromised. Let's send you a fake hardware wallet so that you would store your assets on. Not to leave Tracer out, now it wasn't Tracer themselves, it was a supplier, a shipper within their supply chain. And what they were affected with was about 11,742 customers with full names, shipping addresses, phone numbers and email addresses, which is very, very unfortunate. Now they do have a 90-day data storage policy, so the breach was limited. Now the wrench attacks are very alarming and here, France is the leading country on the planet for crypto kidnappings and wrench attacks,

8:09 largely because their tax authority leaked personal data of everyone. This is absolutely crazy. And the amount of wrench attacks around the world have only increased. And if you have a look at this interactive map here that tracks all of them, you can see the numbers are quite alarmingly high. So Russia got 41. China, we got 15. India got 36.

8:28 Even China. Australia has six attacks. The US has 78 attacks. Brazil, 38. So a lot of people are suffering from these wrench attacks. Now, if your data does get compromised from a data breach, you may find yourself a victim of a wrench attack or kidnapping or anything like that. Now, one of the best strategies if you are thinking about buying a hardware device is to use an office or business address or Provide a secondary email, which a lot of people do.

9:00 So they don't use their primary email. They use fake ones that they set up or aliases and same with their phone numbers as well. That way you don't get your main data leaked. So that's a good approach and a good bit of advice when buying these hardware devices. So what are the solutions? What options do you have now that all these hardware devices are compromised? They've got your data and they're essentially honeypots for hackers. Now, this I thought was a really cool, different and novel solution.

9:31 This here is from Raul. Raul is the CTO of Fluid Tokens. I did an interview with him that I released just yesterday. So if you're interested into seeing what Raul is building on Fluid Tokens, links in the top right hand corner, or I'll put links down in the show notes for you guys. But here he has used his Game Boy Advance and created some software and called it Off Wallet. Now, what Off Wallet is, a hardware wallet solution, but using your Game Boy as the hardware.

10:05 Let me talk you through this. It sounds kind of outrageous. So the solution against hardware wallet attacks is not a new hardware wallet. Let me introduce Off Wallet. Managed to generate a new BIP39 wallet. So that's a wallet within the Bitcoin ecosystem. Received Bitcoin on the Game Boy. Sent them over a different address. Signed the transaction on the Game Boy. No internet connection required. No connection to the PC used. Signed transaction was exported with the display itself.

10:33 No new hardware. Most of you already have one at home. No supply chain compromise. Just cryptography. and skipped two, five, six K one and eight bit CPU make self custody credit again. That's brilliant. This is really cool. So it's a really nice way of doing it. And I kind of really like it because there's a lot of these game boy devices around and you can probably pick one up on eBay or something quite cheaply. So I did have a look at how much they are for Australian viewers here. They're about just 120, $ 150. And they're dual purpose.

11:07 It can store your Bitcoin and also play games at the same time. So retro vibes plus storing your Bitcoin in a secure way. So this is off wallet here. It's a GitHub repo. If you are technically minded, you can go through the GitHub repo and work out how to get this installed and working on your Game Boy.

11:25 But once you have it, you've got a fully air-gapped cold storage for Bitcoin. And I might actually try this. If you're interested in seeing a video tutorial about Bitcoin, setting up a Game Boy with Off Wallet. Leave a comment down below and I will get that video up and running for you guys. That is majorly cool. That is so cool. Raul, you are the absolute GOAT. Now, another solution that you can use is a simple paper wallet.

11:52 Paper wallets have been around since the beginning of crypto. And this here I absolutely love because your seed phrase isn't exposed online. It's not like a hot wallet where you're interacting with websites or anything like that. And in terms of seed phrase, it's offline. It's in that paper wallet. Once you print it off, it doesn't live on your computer.

12:12 So that's really good too. And then in terms of the email databases and your customer data, none of that gets breached because you didn't expose any of that online either, unlike all the hardware devices out there. So now that my wallet has been generated, I can click continue here. And I've got a Bitcoin cash wallet all ready to go.

12:30 So I've got my public address here. I've got my private key. I've got some details that I can write on this. I just print this out. I can store it somewhere in a safe, laminate this, etch it onto a piece of metal, all these particular details. And that's it. That's my paper wallet that's safe and secure. And I don't need to worry about customer data breaches or exposing my seed phrase online. So that's probably one of the best ways that you can go about storing your crypto assets.

12:58 The old school way that is very safe and secure. Hopefully you got a nice little update from this. All these hardware companies out there probably have a little bit more work to do to ensure that all of our data is safe. All their hardware devices are safe. Their software firmware is all safe as well. All right, guys, if you got something out of this, make sure you hit that thumbs up, like, subscribe, notification bell. I've got YouTube memberships down below so you can support me that way.

13:23 Or I've got buy me a coffee links there too. Another great way to support the channel. And if you can't do any of that, just make sure you hit that thumbs up on your way out. Try and stay positive, guys. I'll see you in the next video.