Self-custody means you alone control your private keys and funds. No exchange, no custodian, no third party can freeze, seize, or lose them on your behalf. This is the core promise of cryptocurrency: “not your keys, not your coins.” Leaving assets on centralized platforms repeatedly leads to disasters—Mt. Gox, FTX, and countless exchange hacks prove the point. Self-custody eliminates that counterparty risk.

Hardware wallets (Ledger, Trezor, Coldcard, and others) are marketed as the gold standard for self-custody. They keep private keys offline in a “secure element,” require physical confirmation for transactions, and are presented as decentralized and tamper-resistant. The reality is different. They introduce new single points of failure, can be physically or supply-chain tampered with, and have produced repeated high-value losses. The devices and the companies behind them are not magically immune to the problems they claim to solve.  

Single points of failure and the decentralization myth  

A hardware wallet is a physical object manufactured by a company, shipped through a supply chain, updated with proprietary or semi-proprietary firmware, and often paired with companion software (Ledger Live, Trezor Suite, etc.). That creates multiple centralized choke points:

• The manufacturer controls the hardware design, secure element, and firmware.
• Shipping partners and resellers handle the physical devices.
• Users must trust that the device was not intercepted or modified before it reaches them.
• Seed generation, PIN protection, and display integrity all rely on the integrity of that single device.

If the device is compromised at manufacture, in transit, or via a firmware bug, the private keys (or the ability to derive them) can be extracted. The “decentralized” marketing collapses the moment one company’s supply chain, code, or logistics partner fails. True decentralization would not concentrate trust in a USB-stick-sized product from a handful of vendors.

Physical possession or supply-chain access is enough. Lab attacks (laser fault injection, side-channel analysis) have been demonstrated against secure elements used in these devices. More importantly, real-world attacks do not always require exotic lab gear—tampered devices or weak entropy at seed generation are sufficient.  

Documented losses: the figures  

Hardware-wallet-related incidents have already cost users hundreds of millions of dollars. Key public figures from 2026 and earlier include:

• Coldcard (Coinkite) seed-generation flaw (July–August 2026): A five-year-old firmware bug caused weak entropy (effective key strength collapsed to as low as ~40 bits on older models). Attackers brute-forced seeds offline and drained funds without ever touching the physical devices. Confirmed losses: approximately 1,816 BTC (~$116 million) from more than 5,200 addresses (TRM Labs). Other estimates range from ~$88 million to ~$130 million (Galaxy Research and others). This ranks among the largest crypto incidents of the year and is one of the biggest pure hardware-wallet exploits on record.
• Ledger-linked drains tied to Southeast Asian reseller CryptoBilis (October 2026): On-chain analysts tracked coordinated drains across Ethereum, TRON, Bitcoin, and other chains. Estimates started above $86 million and rose to ~$92.9–$93.4 million (and higher in some tallies) across hundreds of addresses (Specter, Bitquery, and others). Ledger investigated devices sold by the authorized reseller, advised affected users to move funds to new seeds, and pointed to possible supply-chain compromise or tampering. Reports of unauthorized hardware implants (e.g., modules that could capture seed phrases) circulated. Ledger has not publicly confirmed a final total.
• Fake Ledger Live iOS app (2026): A malicious app impersonating Ledger Live on the Apple App Store drained approximately $9.5 million from more than 50 users.
• Phishing and social-engineering campaigns leveraging hardware-wallet data breaches: A single January 2026 campaign using counterfeit letters and QR codes (building on earlier Ledger and Trezor customer data leaks) was linked to roughly $284 million stolen from one high-value target in some analyses. Other campaigns exploiting leaked names, addresses, and order details continue to produce losses.
• Physical “wrench attacks” and related violence targeting hardware-wallet holders: CertiK and Chainalysis tracked dozens of incidents. Estimates include more than $30 million stolen via physical violence in the first half of 2026 alone (heading toward or exceeding the ~$58 million recorded for all of 2025 in some prior-year figures). Home invasions and kidnappings specifically target people known to hold significant crypto in cold storage.

Additional data breaches (Ledger 2020 Shopify-related leak affecting ~270,000–292,000 customers; multiple Trezor shipping-partner breaches exposing tens of thousands of names, addresses, phones, and emails in 2026 and earlier; SafePal order-tracking exposure of ~40,000 customers) did not directly drain devices but enabled highly targeted phishing, fake devices, and physical threats. These leaks turn the “secure” hardware into a liability because the owner’s identity and location become public knowledge to attackers.

Earlier incidents (Ledger Connect Kit supply-chain issues, app-level flaws, and various support scams) add further losses in the hundreds of thousands to low millions. The pattern is clear: even when the secure element itself is not remotely hacked, the surrounding ecosystem—firmware, supply chain, software, and data handling—fails repeatedly.  

Why the “hardware is safer” argument falls short  

Proponents correctly note that many losses involve user error, phishing, or third-party software rather than a pure remote compromise of a genuine device’s secure element. That distinction does not rescue the model. Users still lose the funds. A system that requires perfect user behavior, perfect supply-chain integrity, perfect firmware, and perfect physical security is not robust. Software wallets with air-gapped computers, multisig setups, or carefully managed seed storage can achieve comparable or better security without introducing a proprietary physical device as a single point of failure.

Hardware wallets create a false sense of security. People transfer large sums onto them believing the problem is solved, then discover years later that a firmware bug from 2021 or a tampered unit from a reseller emptied the wallet. The same companies that sell the devices have suffered repeated data leaks that make their customers higher-value targets.  

Practical self-custody without relying on hardware wallets  

Self-custody remains essential. Better approaches emphasize distribution of risk rather than concentration in one device:

• Multisignature setups (2-of-3 or 3-of-5) across different environments and geographic locations.
• Air-gapped computers or offline machines used only for key generation and signing, with seeds stored in multiple secure, geographically separated locations (metal backups, etc.).
• Open-source software wallets with careful operational security.
• Avoiding any single manufacturer’s supply chain for the critical path of key generation.

No method is perfect. Operational security, education, and defense-in-depth matter more than any single product. The difference is that hardware wallets market themselves as the finished solution while repeatedly demonstrating single points of failure and real-world losses in the tens to hundreds of millions of dollars.

Crypto’s value proposition is sovereignty over one’s own assets. That sovereignty is undermined when users outsource trust to a plastic device whose firmware, shipping partner, or reseller can be the weak link. Self-custody is important precisely because no third party—including the makers of hardware wallets—can be fully trusted. The figures above show why.