Are cold wallets safe in 2026? Ledger, Coldcard, Trezor, and SafePal all had incidents. Learn the real vectors and how to secure your funds.
Author: Kritika Gupta
$86 million drained. Cold wallets were supposed to prevent this.
In early October 2026, users across Southeast Asia began reporting emptied wallets. Soon afterward, according to the supplied research, investigators linked the losses to Ledger devices purchased through CryptoBilis. Attackers allegedly modified the devices before delivery, installing hidden chips that captured recovery phrases during setup.
As a result, buyers could follow familiar self-custody instructions and still lose their crypto. The reported attack bypassed Ledger’s secure element without breaking its cryptography.
That distinction exposes the broader problem: cold wallets protect private keys, but their security also depends on everything surrounding them. Supply chains, firmware, vendor data practices, and recovery procedures can each create a route to loss. Therefore, protecting your crypto requires more than buying a reputable device and writing down a recovery phrase.
In early October 2026, users in Southeast Asia began reporting drained cold wallets. Soon afterward, according to the supplied research, on-chain investigators linked the activity to devices that customers purchased from CryptoBilis, an authorized Ledger reseller serving Indonesia, Malaysia, and the Philippines. Initially, researchers estimated losses at roughly $86 million. However, other reported estimates reached $93 million–$102 million across hundreds of wallets on Bitcoin, Ethereum, Tron, and other networks.
Following those reports, Ledger traced every verified case to CryptoBilis purchases, according to the supplied account. At the same time, it reported no impact on its own systems or direct sales channels. The account describes a supply-chain attack: first, attackers opened genuine devices and installed a hidden LTE-enabled microcontroller and eSIM. Next, they resealed the packaging. Then, during setup, the implant allegedly captured the recovery phrase from the display and transmitted it over a cellular connection. Through this process, attackers bypassed the secure element without compromising it.
As a result, customers could follow familiar setup instructions and still expose their funds. In response, according to the supplied account, Ledger told recent CryptoBilis buyers to stop initializing devices. It also advised users with existing holdings to transfer their funds to a new device with a fresh recovery phrase. Therefore, the distinction matters for crypto holders: a genuine device and legitimate reseller status do not eliminate every risk before delivery.
Ledger–CryptoBilis incident overview
While the Ledger account centers on physical tampering, the supplied Coldcard account describes a firmware failure. Specifically, it states that attackers drained roughly 1,816 BTC, worth about $116 million at the time, from more than 5,200 Bitcoin addresses between July 30 and early August 2026. According to that account, victims generated their recovery phrases on Coldcard devices. However, attackers did not need to steal those devices or connect them to the internet.
The research attributes the incident to a build-system error that affected firmware from around March 2021, including version 4.0.1 and later affected builds. Under the intended process, the device used a hardware true random number generator. Instead, a linker error allegedly redirected the relevant call to MicroPython’s Yasmarang software pseudorandom number generator. As a result, the account estimates that effective entropy, or unpredictability, fell from a designed 128 bits to roughly 40 bits on older Mk2/Mk3 models and about 72 bits on newer models.
When seed generation produces too little randomness, attackers can search a much smaller set of possible recovery phrases. Furthermore, a firmware update cannot strengthen a phrase that a device already generated. In response, according to the supplied account, Coinkite released fixes. However, affected users still needed to create fresh recovery phrases on corrected firmware and transfer their funds. Therefore, the broader custody lesson is clear: seed-generation quality matters as much as offline key storage.
Coldcard incident overview
The supplied research describes two customer-data exposures in August 2026. First, it states that a breach at Trezor’s shipping partner, ShipMonk, exposed information relating to roughly 13,689 customers. More specifically, about 11,742 records reportedly contained names, email addresses, phone numbers, and shipping addresses. Separately, an authorization flaw in SafePal’s order-tracking plugin reportedly exposed records for approximately 39,798 customers. Taken together, these figures cover more than 53,000 buyers.
According to the supplied accounts, neither incident exposed recovery phrases or private keys, and neither directly moved customer funds. Nevertheless, customer records can help criminals identify crypto holders. From there, they can use those details to tailor phishing emails, fake support calls, fraudulent letters, or physical threats. As a result, a data breach can create security risks even when attackers never access the cold wallets itself.
Similarly, Ledger’s 2020 e-commerce database leak illustrates how customer-data exposure can create lasting risks. In that case, the supplied research cites roughly one million exposed email addresses, alongside hundreds of thousands of records containing additional personal details. Consequently, the implications for self-custody users extend beyond wallet security: a hardware-wallet purchase can link a real identity and home address to potential crypto ownership.
Trezor–ShipMonk data exposure overview
Cold wallets face risks beyond private-key theft, as this timeline of data leaks, software exploits, and physical attacks illustrates.
2020: Attackers obtained Ledger customer records through an e-commerce database leak.
2022: Slope’s mobile-wallet software logged sensitive seed information. Consequently, users who reused those recovery phrases across wallets exposed the shared key material. Separately, attackers used a Trezor-related Mailchimp breach to distribute phishing messages.
2023: Attackers compromised Ledger Connect Kit and then used malicious software to persuade wallet users to sign transactions that drained roughly $600,000.
2024: A Trezor support-portal exposure put customer contact information at risk, highlighting another route to targeted phishing.
2025–2026: Meanwhile, criminals increasingly targeted crypto holders through physical coercion, home invasions, and kidnappings. According to the supplied research, CertiK and Chainalysis reports describe dozens of incidents during the first half of 2026, with France and other European locations featuring prominently.
Although these cases involve crypto custody, they target different attack surfaces. For example, a customer-data leak does not compromise private keys by itself. Similarly, attackers can exploit malicious transaction approvals without extracting a key from a hardware wallet. Nevertheless, both routes can contribute to losses. Therefore, crypto readers should identify the failure mechanism before judging what an incident reveals about cold storage.
The phrase “cold wallets hack” often hides the actual route to a loss. In practice, attackers can exploit weaknesses across seven layers:
Therefore, evaluating wallet security requires more than checking the chip specification. Holders must also assess how they generate keys, store backups, interact with applications, and protect their personal information. Together, these practices determine the strength of the broader custody setup.
How to Actually Keep Your Cold Wallet Safe in 2026
These 10 steps address the failure mechanisms described in the article’s supplied 2026 incident accounts.
1. Use independent keys for substantial holdings. Finally, consider a carefully designed multisignature wallet with separate signing devices, secure locations, and tested recovery instructions. Crucially, multiple devices sharing one phrase do not provide independent protection.
Incident link: Multisignature could limit losses from one compromised device or key in incidents like the reported CryptoBilis and Coldcard cases, provided attackers cannot compromise enough signers.
2. Buy directly from the manufacturer. First, verify the website address independently and check the manufacturer’s seller guidance before purchasing.
Incident link: Buying directly would have avoided the CryptoBilis reseller channel described in the Ledger account. However, direct purchasing cannot eliminate all supply-chain risks.
3. Inspect the device and verify authenticity. Next, check the packaging, follow official authenticity checks, and stop setup if anything looks unusual. Nevertheless, intact seals and successful software checks may not reveal every hardware modification.
Incident link: These checks address the tampering risk described in the CryptoBilis account, although they do not guarantee detection of a hidden implant.
4. Generate a fresh recovery phrase through a trusted process. During setup, use the manufacturer’s documented procedure and never accept a phrase supplied in the box. Additionally, avoid importing a phrase that previously secured a hot wallet.
Incident link: The reported Coldcard failure highlights why trustworthy seed generation matters. However, generating a fresh phrase on vulnerable firmware would not have prevented that incident.
5. Replace recovery phrases affected by confirmed flaws. If the manufacturer confirms a flaw, check its affected-device guidance. Then, generate a new phrase on corrected firmware and transfer your funds.
Incident link: This addresses the reported Coldcard RNG failure because a firmware update alone cannot strengthen an existing weak recovery phrase.
6. Limit the personal information you share. Furthermore, use a dedicated purchasing email and consider lawful delivery options that protect your home address.
Incident link: This could reduce the targeting information exposed through the reported Trezor–ShipMonk and SafePal leaks. However, it would not prevent the underlying breaches.
7. Verify support messages independently. Whenever you receive an unsolicited message, open the manufacturer’s website yourself instead of following its links. Moreover, never disclose your recovery phrase to support staff or enter it into a website or diagnostic tool.
Incident link: This helps prevent follow-on phishing that criminals could build around the reported Trezor and SafePal customer-data exposures.
8. Set a strong PIN and understand passphrase recovery. If you enable a passphrase, protect it separately and test access before transferring substantial funds. However, remember that losing it can also mean losing access.
Incident link: These controls address device theft and some consequences of recovery-phrase exposure. Nevertheless, neither guarantees protection against the reported firmware failures, implants, or physical coercion.
9. Install official firmware and read security notices. Before updating, verify the instructions independently. Also, check whether the manufacturer requires additional action beyond installing an update.
Incident link: This addresses the reported Coldcard firmware issue once a correction becomes available. Even then, affected users would still need to replace weak recovery phrases.
10. Secure your recovery backups offline. In addition, protect backups against theft, fire, and accidental loss. Avoid photographs, cloud copies, and digital notes, and secure every location containing a complete phrase.
Incident link: This addresses backup theft and the physical targeting risks discussed in the 2026 accounts. However, it cannot prevent vendor-data leaks or coercion by itself.
Yes. A properly configured hardware wallet can substantially reduce exposure to online key theft while giving holders direct control over their assets. However, the right custody arrangement also depends on the user’s ability to manage devices, backups, transaction approvals, and recovery procedures.
Furthermore, security extends beyond cryptography. Supply chains, firmware, vendor records, companion software, and human decisions all influence how well a wallet protects funds. Therefore, effective self-custody requires ongoing attention to the device’s origin, security notices, backup quality, and physical privacy.
Ultimately, a cold wallet reduces specific risks, but it does not eliminate every route to a loss. For this reason, treat the device as one part of a broader custody system. Then, build the surrounding practices with the same care that you give your private keys.
This article is for educational purposes. If you believe your wallet has been compromised, move your funds to a new device immediately and contact the manufacturer.
Cold Wallet Safety 2026: Are Hardware Wallets Still Safe?
One Token, Multiple Products. Can Zylo Deliver?
The Rise of NEAR Protocol 2026: Inside the 530% Rally and the ETF
The Art of Executing a Good Long Term Trade
Cold Wallet Safety 2026: Are Hardware Wallets Still Safe?
One Token, Multiple Products. Can Zylo Deliver?
The Rise of NEAR Protocol 2026: Inside the 530% Rally and the ETF
The Art of Executing a Good Long Term Trade
