Six hardware wallet brands have disclosed security issues since the start of 2026, with confirmed crypto-asset losses involving Coldcard and a Ledger distributor. The latest case concerns devices allegedly tampered with before delivery. Existing reports indicate that some affected Ledger devices may have reached markets outside Southeast Asia, although the scope and number of users remain unclear. For users who rely on hardware wallets to keep assets offline, the risks extend beyond the device itself to key generation, supply-chain controls and customer-data management.
Coldcard key-generation flaw linked to losses
Thieves began moving assets from some Coldcard wallets on July 30. The incident was linked to insufficient randomness during private-key generation. Galaxy Research later estimated that losses connected to Coldcard had exceeded $115 million. The case shows that even when private keys are generated by a hardware wallet, a weakness in the underlying key-generation process can still compromise asset security.
Laser attacks require device access and laboratory equipment
Ledger's internal security team tested laser-based attacks against the chip used in the Trezor Safe 7 in June and carried out a similar test on Tangem cards in July. Both attacks required physical access to the device and specialized laboratory equipment. Trezor said user funds were not affected. Tangem said the risk to ordinary users was "virtually nonexistent" and noted that the researchers involved came from a competing company.
BitBox patches firmware flaws with no reported theft
BitBox fixed several firmware vulnerabilities in August. The company's engineers described the flaws as serious, but BitBox has not reported any resulting theft of funds. Compared with the Coldcard incident, the disclosures highlight that the nature and consequences of a security issue can vary significantly. Whether an attack requires physical access and whether the flaw has been exploited are also key factors in assessing the practical risk.
Data leaks and device tampering pose different risks
Other incidents affected users' personal information rather than directly exposing wallet keys. A shipping partner used by Trezor leaked data belonging to 13,689 buyers, while a SafePal data breach involved nearly 40,000 home addresses. The exposure of addresses and similar information can create privacy and follow-on security concerns, but the available information does not indicate that these incidents directly led to the theft of users' crypto assets.
The Ledger case centers on the supply chain. The devices were allegedly altered before reaching buyers. The available materials do not specify how many devices were affected, provide details of the sales channels, or identify their precise distribution beyond Southeast Asia. What can be established at this stage is that six brands disclosed security issues in 2026, while known cases involving lost crypto assets include Coldcard and a Ledger distributor. The potential reach of the allegedly tampered Ledger devices remains unresolved.