Security advisory (updated 3 November 2026): a firmware flaw in some Coldcard models, disclosed in July 2026, produced seeds with far less randomness than intended. Coinkite has released fixed firmware for every affected model, but updating does not repair a seed created on affected firmware. If you created a seed on a Coldcard, read who is affected and exactly what to do, or use the two-minute check. All current advisories: security advisories.
If you hold Bitcoin on an exchange, you don’t actually own it. The exchange does. A hardware wallet fixes that by letting you hold your own private keys on a dedicated device that never exposes them to the internet. But with dozens of hardware wallets on the market — ranging from about $60 to $400 — choosing the right one is overwhelming.
This guide compares the main hardware wallets on sale in November 2026, with honest assessments of their strengths and weaknesses. We focus on Bitcoin-specific features because that’s what matters if you’re here for long-term security, not trading altcoins.
Updated November 2026: prices checked on the makers’ own stores; the Coldcard Q and four newer models (Trezor Safe 7, Ledger Nano Gen5, BitBox02 Nova, Blockstream Jade Core) added; where-to-buy advice updated after the October 2026 reseller incident.
Affiliate disclosure: the BitBox02 link in this guide is an affiliate link (we may earn a commission, paid in BTC). It is the only affiliate link on the page — our Top Picks below carry none, and every ranking here is the one we would publish either way.
Why You Need a Hardware Wallet
Your Bitcoin private keys are the only thing standing between your funds and a thief. If those keys exist on a phone, computer, or any internet-connected device, they’re vulnerable to malware, phishing attacks, operating system vulnerabilities, and remote access exploits.
A hardware wallet is a single-purpose device designed to:
- Generate private keys in a secure environment, usually guarded by a secure element: a tamper-resistant chip of the same type used in passports and bank cards.
- Store keys offline permanently. Your private keys never leave the device, which is built so that even a compromised computer can’t extract them. Known bugs that broke this were fixed by updates, so keep its software current.
- Sign transactions internally. When you want to send Bitcoin, the transaction details are sent to the hardware wallet, you verify the amount and address on the device’s screen, and the device signs the transaction internally. Only the signed transaction (not the private key) is sent back to your computer.
The risk calculation is simple: if you hold more Bitcoin than you’re comfortable losing, you need a hardware wallet. Where to draw that line is personal: some people move to a hardware wallet at $500, others at $1,000 or $5,000. The cost of a hardware wallet ($59–$269 for most models in this guide, Nov 2026) is a small price to pay for actual security.
For a deeper look at why cold storage architecture matters, including how to balance hot and cold wallets, see our dedicated guide.
How Hardware Wallets Work
Understanding the internals helps you make a better buying decision. Every hardware wallet has three key components:
1. Secure element
The secure element is a specialized chip designed to resist physical tampering. On some devices, such as Ledger’s, it stores your private keys and signs with them. On others, including the Trezor Safe 3 and Safe 5 and the BitBox02, the keys sit encrypted on the main chip, and the secure element guards a secret that, together with your PIN or password, is needed to decrypt them. Either way, even if someone disassembles your hardware wallet and puts its chips under an electron microscope, they shouldn’t be able to extract your keys.
Independent labs rate many of these chips under the Common Criteria scheme: EAL5+ and EAL6+ are assurance levels, and a higher level means a more rigorous evaluation. Current Ledger and Trezor Safe devices use chips rated at one of those levels. Other makers answer the same question differently. The Coldcard Mk5 uses two secure elements from different manufacturers, so neither chip alone holds the full secret. The Blockstream Jade has no secure element at all: a Blockstream server helps unlock it without learning the key. Wallets with neither (like older Trezor models) rely on a general-purpose microcontroller, which is more vulnerable to physical attacks. So ask whether a device has a secure element, and if it doesn’t, what protects the keys instead.
Be aware that side-channel attacks have been demonstrated on some hardware wallets: in 2019, researchers recovered a Trezor One’s PIN from its power consumption. These attacks attempt to extract key information by analyzing power consumption, electromagnetic emissions, or timing variations during cryptographic operations. Most need the device in the attacker’s hands, and how well a model resists them depends on its chip and firmware.
2. Display and input
The screen on your hardware wallet is your most important security feature after the secure element. It allows you to verify transaction details (receiving address and amount) on the device itself, independent of your potentially compromised computer. A hardware wallet without a screen (or with a screen you can’t easily read) undermines the entire security model.
Input methods vary: physical buttons, touchscreen, or touch-sensitive strips. Touchscreens are more convenient; physical buttons are harder to hack remotely (not that this is a practical attack vector for most threat models).
3. Connectivity
This is where hardware wallets differ the most — and the trend toward air-gapped solutions has accelerated significantly:
- USB-C: Direct connection to your computer. Simple but means the device is physically connected to a potentially compromised machine. The secure element guards against physical tampering, not against a software bug that machine can reach over the cable.
- Air-gapped (QR codes): Transaction data is exchanged by scanning QR codes between the hardware wallet’s camera and your computer screen. No physical or wireless connection ever exists. This is the highest security tier for connectivity.
- Air-gapped (MicroSD): Transaction data is transferred via a MicroSD card. Similar security to QR codes but requires physically moving a card between devices.
- Bluetooth: Wireless connection to your phone. Convenient for mobile use but introduces a wireless attack surface. Ledger uses encrypted Bluetooth, but purists avoid it.
- NFC: Short-range wireless, used by Coldcard for tap-to-sign with compatible phones. Limited range makes interception difficult.
Hardware Wallet Comparison Table 2026
Here are the main hardware wallets on sale, with prices checked in November 2026:
| Wallet | Price | Screen | Air-Gapped | Open Source | Coin Support | Best For |
|---|---|---|---|---|---|---|
| Coldcard Mk5 | $269 list / $219 sale (Nov 2026) | 1.54" screen | Yes (microSD; NFC optional) | Source-available firmware | Bitcoin only | Security maximalists |
| Coldcard Q | $369 list / $319 sale (Nov 2026) | Larger LCD + QWERTY keyboard | Yes (microSD + QR; NFC optional) | Source-available firmware | Bitcoin only | Long passphrases, QR signing |
| Trezor Safe 3 | $59 (Nov 2026) | Monochrome OLED | No (USB-C) | Firmware and hardware design (not the secure chip) | Thousands of coins | Budget + open source |
| Trezor Safe 5 | $129 (Nov 2026) | 1.54" color touchscreen | No (USB-C) | Firmware and hardware design (not the secure chip) | Thousands of coins | Premium touchscreen |
| Ledger Nano S Plus | $69 (Nov 2026) | Small OLED | No (USB-C) | No (closed source firmware) | 500+ in Ledger Wallet; thousands via other wallets | Budget multicoin |
| Ledger Nano X | $99 (Nov 2026) | Small OLED | No (USB-C + Bluetooth) | No (closed source firmware) | 500+ in Ledger Wallet; thousands via other wallets | Mobile users |
| Foundation Passport Core (discontinued) | No longer sold | Large color IPS | Yes (QR + MicroSD) | Fully open source | Bitcoin only | Premium Bitcoin UX |
| Blockstream Jade Plus | $149 plastic / $169 metal (Nov 2026) | Color screen + camera | Yes (QR codes) | Fully open source | Bitcoin + Liquid | Open source air-gapped |
| Keystone 3 Pro | $149 (pre-order, Nov 2026) | 4" color touchscreen | Yes (QR codes) | Open source firmware | 5,500+ assets | Touchscreen air-gapped |
| BitBox02 | €149 incl. VAT (EU store, Nov 2026) | Small OLED + touch sensors | No (USB-C) | Firmware (Apache 2.0) | Bitcoin-only edition available | Minimalist Swiss design |
Prices are from each manufacturer’s own store, checked 3 November 2026, in US dollars except the BitBox02, which we could only confirm in euros from its EU store. They change often. Buy new from the manufacturer’s own store, or from a reseller it lists if it doesn’t deliver to you. Avoid Amazon, eBay and other marketplaces, even listings labelled “official store”, and second-hand devices, which may have been tampered with. For an interactive side-by-side breakdown, see our hardware wallet comparison chart.
Newer models (updated November 2026)
Four newer models aren’t in the table because we haven’t tested them. The details below come from the makers’ own pages, checked on 7 November 2026:
- Trezor Safe 7 ($249): launched in October 2025, with Trezor’s largest colour touchscreen (2.5"), USB-C, encrypted Bluetooth that you can switch off, and Qi2 wireless charging. It pairs an EAL6+ OPTIGA chip with a second secure element, TROPIC01, which Trezor presents as an independently auditable secure element. Trezor calls it the first hardware wallet to use post-quantum signatures (SLH-DSA-128) to check its own firmware and boot process. That protects the device’s updates, not your coins: your bitcoin is protected by Bitcoin’s own signatures, which haven’t changed. A Bitcoin-only edition is available.
- Ledger Nano Gen5 ($179): Ledger’s newest Nano, launched in October 2025. Its 2.8" E Ink touchscreen is larger than earlier Nanos’ screens, so full addresses are easier to read. It has USB-C, Bluetooth, NFC (for Ledger’s Recovery Key card) and an EAL6+ chip (ST33K1M5).
- BitBox02 Nova (€175 in BitBox’s EU store): the BitBox02 with a glass-topped screen, a newer EAL6+ chip (OPTIGA Trust M V3) and Bluetooth so it works with an iPhone or iPad. Bitcoin-only and Multi editions.
- Blockstream Jade Core ($99): a Jade without the camera, so it signs over USB-C or Bluetooth rather than by QR code. The original Jade, which has a camera, still sells for $67.
Best Bitcoin-Only Hardware Wallets
If you’re stacking sats and don’t care about altcoins, a Bitcoin-only hardware wallet is the smart choice. A smaller codebase means a smaller attack surface. Every line of altcoin support code is a line that could contain a vulnerability affecting your Bitcoin.
Coldcard Mk5 — The paranoid Bitcoiner’s choice
Coinkite no longer sells the MK4. Its current models are the Mk5 ($269 list, $219 on sale) and the Q ($369 list, $319 on sale), as of November 2026. The Mk5 keeps what made the Coldcard a long-standing reference for Bitcoin-only security: dual secure elements (from two different manufacturers), air-gapped operation via MicroSD, optional NFC for mobile signing, and a deep menu of power-user features: trick PINs, brick PINs, BIP85 derived wallets, multisig support, and a login countdown.
Coldcard’s firmware code is public: you can read, build and check it. It’s published under the MIT licence with the “Commons Clause”, which forbids selling it. Coinkite calls it open source; under the usual definition, which doesn’t allow a no-selling clause, the licence is “source-available”.
The trade-off is UX. The Coldcard’s small screen and keypad navigation feel dated compared to touchscreen competitors. The learning curve is steep. On fixed firmware the Coldcard is still a solid device, but the July 2026 seed flaw (see the advisory at the top) is a reminder that no single device should hold your savings on its own. For long-term savings, consider making it one key of a 2-of-3 multisig with devices from three different manufacturers. Current Coldcard firmware makes you add your own randomness (key presses, dice or coin flips) before it creates a seed. If you use dice, follow our dice rolls guide: careless rolls make a seed weaker, not stronger. Some devices mix your rolls with their own randomness; others, such as the BitBox02, use your rolls instead of it.
The Coldcard Q ($369 list, $319 on sale, November 2026) has the same two-chip security design and adds a full QWERTY keyboard, a larger screen and a camera for QR codes. The keyboard makes long passphrases practical to type, and QR codes give it a second air-gapped route besides the microSD card.
Who it’s for: Experienced Bitcoiners with significant holdings who prioritize security over convenience. Users who run their own node and use PSBT workflows. Multisig participants who need a reliable signing device. If you still use a Mk4: Coinkite no longer sells it, but it runs the same firmware line as the Mk5 (5.6.3, released 30 September 2026). Update it before you create or review a seed; our Coldcard Mk4 setup guide walks through the device.
Foundation Passport Core (discontinued) — Security meets design
Foundation no longer sells the Passport Core; it now sells the Passport Prime (€388.95, Nov 2026), which we have not reviewed. We keep this description for people who already own a Core. The Passport Core proves that a Bitcoin-only wallet doesn’t have to look like it was built in a garage. It features a large color IPS display, intuitive guided onboarding, full air-gapped operation (QR codes and MicroSD — no USB data connection), and completely open-source hardware and firmware.
Foundation’s approach is “trust, but verify.” Because both the hardware schematics and firmware code are public, anyone can audit the entire device. The Passport Core also has a removable battery (increasingly rare in electronics), which means no built-in obsolescence from a degrading battery.
Who it was for: Bitcoiners who wanted Coldcard-level security with a modern UX. People new to hardware wallets who wanted guided setup. Users who value open-source as a principle. Read our full Foundation Passport wallet review for a detailed assessment.
BitBox02 Bitcoin-only — Swiss minimalism
The BitBox02 takes a different design philosophy. It has no buttons: you tap and slide on capacitive touch sensors, and confirm addresses and amounts on its small OLED screen (128 × 64 px). A microSD card provides a backup of your seed, and the device connects over USB-C only (no wireless, no air gap).
Its strongest feature is open-source firmware (Apache 2.0 licence) and an open-source companion app, the BitBoxApp, from a Swiss company with a strong privacy reputation. The Bitcoin-only edition runs a separate firmware build that contains no altcoin code at all; it isn’t a setting you can switch.
For advanced setups, the BitBox02 has supported Miniscript wallet policies since firmware 9.15 (August 2023) and Miniscript on Taproot since 9.21 (September 2024). That lets it hold a key in wallets with spending rules, such as Liana’s timelocked recovery path for inheritance. BitBox also sells the BitBox02 Nova, which adds Bluetooth for iPhone and iPad (see the newer models above).
If you use a BitBox02, keep its firmware up to date. Version 9.26.5 (17 August 2026) brought “security improvements”, according to BitBox’s release notes; if your device runs anything older, update it in the BitBoxApp. Details in our BitBox02 advisory.
Who it’s for: Users who want a simple, no-nonsense Bitcoin signing device. People who appreciate minimal design. Those who prefer USB-C simplicity over air-gapped complexity.
If that matches how you want to hold Bitcoin, the Bitcoin-only edition is available directly from BitBox[#aff]. If air-gapped signing matters more to you, the air-gapped picks below skip the USB link entirely.
Best Budget Hardware Wallets
You don’t need to spend $200 to secure your Bitcoin. These wallets offer genuine security at entry-level prices.
Trezor Safe 3 — $59 (Nov 2026)
The Safe 3 is the best value proposition in hardware wallets right now. For $59, you get an EAL6+ secure element, open-source firmware and published hardware designs (the secure chip’s own design is closed), a functional (if basic) monochrome screen, and compatibility with the Trezor Suite software. It supports Shamir Backup (SLIP39), which lets you split your seed into multiple shares for distributed storage. Since June 2024 it makes a 20-word backup in that standard by default, which a Ledger or a Coldcard can’t restore; if you might switch brands one day, choose a 12- or 24-word backup when you create the wallet in Trezor Suite.
The main limitation is the two-button interface, which makes entering your PIN and confirming transactions slower than touchscreen alternatives. But at this price, it’s hard to complain.
Blockstream Jade Plus — from $149 (Nov 2026)
The Jade Plus punches above its price class. For $149 (plastic case; $169 in metal), you get a color screen with a camera for QR code scanning (air-gapped signing for Bitcoin), open-source firmware, and Blockstream’s “virtual secure element” model in place of a secure chip: the device encrypts your keys, and a “blind oracle” server run by Blockstream holds part of what’s needed to unlock them, so neither the device nor the server can unlock them alone. You can run your own oracle, or keep your seed as a SeedQR (your words encoded in a QR code) and scan it each time to work fully offline.
The Jade supports Bitcoin and the Liquid Network, though Liquid works only over USB or Bluetooth, not by QR code. It’s one of the few budget-friendly options that offers genuine air-gapped operation. Blockstream’s companion app (Green is now called the Blockstream app) is clean and functional. If price matters most, the original Jade ($67, Nov 2026) is the cheapest way to sign by QR code; its screen is smaller. See our detailed Jade hardware wallet review for a full assessment.
Ledger Nano S Plus — $69 (Nov 2026)
The Nano S Plus is Ledger’s entry-level device. It has a certified secure element (ST33K1M5, CC EAL6+) and supports more than 500 cryptocurrencies in the Ledger Wallet app (called Ledger Live until October 2025), and thousands more through other wallets. It makes a 24-word BIP39 backup, which restores on most other brands. Build quality is solid for the price.
The significant caveat: Ledger’s firmware is closed source. You’re trusting Ledger and its certifications without being able to independently verify the code. For a thorough examination, read our complete Ledger security analysis. Ledger also offers Ledger Recover, an optional paid service that, if you sign up and approve it on the device, splits an encrypted copy of your seed among three companies. Critics argued it showed that Ledger’s firmware can be updated to export a seed; Ledger replied that it’s opt-in and needs your PIN and approval. If being able to audit the firmware matters to you, the Trezor Safe 3 costs less and its firmware is open source; for air-gapped signing, look at the Jades.
Best Air-Gapped Hardware Wallets
Air-gapped wallets never connect to a computer or phone via USB, Bluetooth, or any wired/wireless protocol. Transaction data is exchanged via QR codes (scanned by the wallet’s built-in camera) or via MicroSD card. This eliminates an entire category of potential attack vectors.
Top air-gapped picks
| Wallet | Air-Gap Method | Camera | Price | Notes |
|---|---|---|---|---|
| Foundation Passport Core (discontinued) | QR + MicroSD | Yes | No longer sold | Successor (Passport Prime) not yet reviewed by us |
| Coldcard Mk5 | MicroSD | No | $269 / $219 sale (Nov 2026) | MicroSD-based (no QR); NFC optional |
| Coldcard Q | QR + MicroSD | Yes | $369 / $319 sale (Nov 2026) | QWERTY keyboard for long passphrases; NFC optional |
| Keystone 3 Pro | QR codes | Yes | $149 (pre-order, Nov 2026) | Largest screen; multicoin support; USB data only with some wallets, once you approve it |
| Blockstream Jade Plus | QR codes | Yes | $149 / $169 metal (Nov 2026) | Open-source firmware; the original Jade ($67) is the cheapest QR option |
QR-based air gaps are generally preferred over MicroSD because they’re faster (scan instead of physically swapping a card) and there’s zero risk of file-based exploits via the storage medium. The Jade Plus handles QR-based PSBTs (Partially Signed Bitcoin Transactions) smoothly, as did the now-discontinued Passport Core.
If air-gapped operation is your priority, skip any wallet that requires USB or Bluetooth as the primary connection method. For advanced setups, see our guide on implementing multisig with hardware wallets.
Open Source vs Closed Source: Why It Matters for Bitcoin
This is the most important factor that most comparison guides ignore. Here’s why it matters for your Bitcoin security:
Wallets with public firmware code (Trezor, Jade, BitBox02, Coldcard, Passport)
- Anyone can audit the code that runs on your device. Trezor, Jade and BitBox02 firmware is open source. Coldcard’s is source-available: public to read, build and check, under a licence that forbids selling it.
- Security researchers can (and do) find and report vulnerabilities before attackers exploit them.
- You can check that an official firmware release was built from the published source code (reproducible builds), and, where the device offers a firmware hash check, confirm that your device runs that release.
- Public code and reproducible builds make it much harder for the manufacturer to hide backdoors, tracking, or data exfiltration in the firmware.
- If the company goes out of business, the community can maintain and update the firmware.
Closed source wallets (Ledger)
- You’re trusting the manufacturer’s security claims without independent verification.
- The manufacturer could theoretically include code that phones home, logs activity, or even exfiltrates keys — and you’d have no way to know.
- Ledger has a strong track record, and their secure element does provide genuine protection. But “trust us” is a weak security model in a field built on the principle of “don’t trust, verify.”
- Ledger’s customer database was famously hacked in 2020, exposing names, emails, phone numbers, and physical addresses of hundreds of thousands of customers. The hardware wasn’t compromised, but the data breach led to targeted phishing campaigns against Ledger users.
Our view: we prefer firmware whose code is public, because Bitcoin works on “don’t trust, verify”, and public code lets independent researchers check what a device runs. Closed firmware means trusting the maker and its certifications. Both approaches have produced secure devices, so weigh this against what else you need: if you want Bluetooth for your phone or many coins in one app, a Ledger can still be the right choice (see “When a Ledger is the right choice” below). For an in-depth exploration of this topic, read why open-source hardware wallets matter.
How to Set Up Your Hardware Wallet: Step by Step
Regardless of which wallet you buy, the setup process follows the same general steps, though each device sets its own order:
- Verify the package is sealed and untampered. Check holographic seals, shrink wrap, and any tamper-evident packaging. If anything looks off, contact the manufacturer and request a replacement. Never use a hardware wallet that arrived with a pre-filled seed phrase or recovery card — this is a common scam.
- Download the companion software directly from the manufacturer’s website. Trezor Suite, Ledger Wallet (formerly Ledger Live), BitBoxApp, the Blockstream app, Envoy (for Passport), or Sparrow Wallet (works with most hardware wallets). Verify the download hash if you know how.
- Connect the device and run the firmware update. Most hardware wallets ship with older firmware. Update to the latest version before generating your seed. This ensures you have the latest security patches. See our guide on hardware wallet firmware update best practices.
- Generate a new seed phrase on the device. The hardware wallet will generate your seed phrase using its internal random number generator: 12 or 24 words on most devices, or 20 words by default on a Trezor Safe (SLIP-39, a different standard; see the Trezor Safe 3 above). If your device lets you choose, 24 words give a free extra margin for long-term savings. Write down every word on paper, in its numbered slot. Do not skip this step. Do not take a photo. Do not type the words into your computer.
- Verify the seed phrase. Your device will check your copy, though each brand does it differently: a Trezor asks for specific words from your list, a Coldcard quizzes you on word positions, and a Ledger or a BitBox02 has you confirm the words on the device. Pay close attention — this is your chance to catch any transcription errors.
- Set a strong PIN. Your device asks for it at its own point: a Coldcard or a Ledger asks first, before the seed, and a Coldcard won’t update its firmware until you set one. Choose a PIN that you’ll remember but that isn’t obvious (not 1234, not your birthday). Some wallets support alphanumeric PINs. Use the longest PIN your wallet supports.
- Test a receive address. Generate a receiving address on the hardware wallet and verify it matches what the companion software shows. Send a small test amount of Bitcoin to this address.
- Test your backup before adding more. This step is critical and most people skip it. First use the device’s built-in check, which compares the words on your paper with the wallet the device holds and erases nothing (Check backup in Trezor Suite, the Recovery Check app on a Ledger, a temporary seed on a Coldcard). On a Coldcard the check passes only when the device refuses your words, saying it can’t use the master seed as temporary (the screen is titled FAILED); if it accepts them, your paper opens a different wallet: choose Restore Master and find the mistake. Only after it passes, if you want a full test, reset the device or use a second one that accepts your kind of backup, and recover the wallet using only your written seed phrase. Verify that the same receive address appears and that the test Bitcoin is visible. Now you know your backup works. On a Coldcard the reset is Destroy Seed (Advanced/Tools, then Danger Zone, then Seed Functions): your PIN stays, and you restore with Import Existing. Destroy Seed also erases the Coldcard’s settings, multisig wallets and Trick PINs, and only a Coldcard backup file brings those back, so once you have set any of them up, keep to the temporary-seed check. Nuke Device, in the same Danger Zone menu, makes the Coldcard unusable for good. Our setup lesson shows the check for each brand.
- Transfer your seed to a metal backup. Once you’ve verified the seed phrase works, transfer it to a metal seed storage solution. Check every word and its position on the metal, then run the device’s built-in check again using the words from the metal. Only after it passes, destroy the paper copy and store the metal securely.
- Consider setting up a passphrase. For additional security, enable a passphrase (25th word) that creates a hidden wallet behind your standard wallet. It is a separate wallet, so test it before you fund it: note its first receive address, close it, reopen it from your written copy of the passphrase and check that the same address appears. The passphrase is case-sensitive, and recovering this wallet needs both your seed phrase and the exact passphrase. Store the passphrase separately from your seed phrase backup.
If you are migrating from an existing hardware wallet, be aware that script types and derivation paths can vary between devices. Understanding these differences is essential for a smooth migration without losing access to funds.
Hardware Wallet Security: What to Look For
When evaluating a hardware wallet, these security features separate the serious devices from the toys:
Must-have features
- Protection against someone holding the device: usually a secure element (rated EAL5+ or EAL6+ on Ledger and Trezor Safe devices; two from different makers on a Coldcard), or, on a Jade, a server that helps unlock the device without learning the key. Keys on a general-purpose chip with neither are vulnerable to fault injection and glitching attacks.
- On-device verification screen: You must be able to verify transaction details (address and amount) on the hardware wallet’s own screen. If you can only see this information on your computer, a compromised computer could show you one address while sending to another.
- Active development: Check the manufacturer’s firmware release notes or GitHub for recent updates. A wallet that hasn’t been updated in a year may have unpatched vulnerabilities.
Weigh carefully
- Public firmware code: As discussed above, open-source (or source-available) firmware lets independent researchers check that the device does what the manufacturer claims. We give it a lot of weight. Ledger is the main maker without it; many people choose a Ledger anyway for Bluetooth and broad coin support.
Nice-to-have features
- Air-gapped operation: Eliminates the USB/Bluetooth attack surface entirely.
- Multisig and Miniscript support: Essential if you’re building a multisignature setup for higher-value storage. Miniscript support lets a device sign for wallets with extra spending rules, such as a timelocked recovery key for inheritance.
- Passphrase support: Creates hidden wallets and adds plausible deniability.
- Duress features: Trick PINs (Coldcard) that show a decoy wallet, or brick PINs that destroy the device.
- BIP85 support: Derive child seeds from your master seed, useful for managing multiple wallets without multiple seed backups.
- Coin control: Ability to select specific UTXOs when building transactions, important for privacy-conscious Bitcoin usage.
Red flags
- No secure element and nothing in its place: Your keys deserve better than a general-purpose microcontroller on its own.
- Required accounts or cloud services: A hardware wallet should work without creating an account or connecting to the manufacturer’s servers.
- Pre-installed seed phrases: If your wallet arrived with a seed phrase already written on a card, it’s a scam. Generate your own, always.
- No independent verification of addresses: If you can’t verify addresses on the device screen, the security model is fundamentally broken.
For an analysis of advanced hardware security threats including the Dark Skippy attack, see our deep dive on hardware wallet security vulnerabilities.
Common Mistakes When Buying a Hardware Wallet
1. Buying from unauthorized sellers
Buy new, from the manufacturer’s own store. If it doesn’t deliver to your country, use a reseller listed on the manufacturer’s website, and check our security advisories for that reseller first: in October 2026 Ledger confirmed a hidden implant that copied the recovery words in a device sold by CryptoBilis, an authorized reseller in Southeast Asia. Avoid Amazon, eBay and other marketplaces, even listings labelled “official store”, and never buy second-hand: a reset can’t prove nobody modified the hardware. Tampered devices are a real threat — attackers have been caught selling hardware wallets with pre-generated seed phrases, allowing them to drain funds as soon as victims deposit Bitcoin.
2. Choosing based on coin support instead of security
If you’re buying a hardware wallet primarily for Bitcoin, you don’t need support for thousands of altcoins. In fact, broader coin support means a larger codebase and a larger attack surface. Bitcoin-only devices have leaner firmware with fewer potential vulnerabilities.
3. Ignoring the software ecosystem
A hardware wallet is only as good as the software you use with it. Check compatibility with your preferred wallet software before buying. Most Bitcoin-focused hardware wallets work with Sparrow Wallet, which is the gold standard for desktop Bitcoin wallet management. Sparrow supports all major hardware wallets, provides coin control, and is fully open source.
4. Waiting for the “perfect” wallet
Keeping your Bitcoin on an exchange while you research hardware wallets for months is worse than buying any reputable hardware wallet today. Don’t let perfect be the enemy of good. Pick one from our comparison table, buy it, and move your coins off the exchange.
5. Not updating firmware
Hardware wallets receive security updates just like any other device. Check for firmware updates regularly and install them promptly. Outdated firmware may contain known vulnerabilities.
6. Buying only one device for a multisig setup
If you’re building a multisig wallet, use hardware wallets from at least two manufacturers, and ideally a different maker for each key. With a different maker for each key, a flaw in one maker’s devices reaches only one key, and a 2-of-3 needs two to spend. With only two makers, one of them made two of your three keys, so a flaw in its devices reaches the two keys a thief needs.
Frequently Asked Questions
Can a hardware wallet be hacked?
No hardware wallet is 100% unhackable, but the attack surface is extremely small. Successful attacks against hardware wallets typically require physical access to the device, specialized equipment, and significant expertise. No remote attack on a hardware wallet’s key storage has been seen in the wild. The July 2026 Coldcard flaw didn’t need the device at all: faulty firmware made seeds that could be guessed, which is why you update firmware before you create a seed. The far more common risk is social engineering — tricking users into entering their seed phrase on a phishing site, not breaking the hardware itself. Using an air-gapped wallet further reduces the attack surface by eliminating all digital connectivity.
What happens if my hardware wallet manufacturer goes out of business?
Your Bitcoin is safe. For a single-signature wallet, your seed phrase (the words you wrote down during setup) is all you need to recover your funds, plus the exact passphrase if you added one. For a multisig wallet, you need enough seeds to sign (two in a 2-of-3) and the wallet descriptor, which lists every cosigner’s public key. A 12- or 24-word phrase restores on any other wallet that supports BIP39 (which is virtually all of them); a Trezor’s default 20-word backup restores on wallets that support SLIP-39, such as Sparrow, Electrum or Keystone. Open-source wallets have an advantage here: even if the company disappears, the firmware source code remains publicly available and the community can continue maintaining it. This is one of several reasons to prefer open-source hardware wallets.
Do I need a hardware wallet if I only have a small amount of Bitcoin?
A hardware wallet is worth it if you hold more Bitcoin than you’d be comfortable losing. For small amounts you’re learning with, a reputable phone wallet such as the Blockstream app or BlueWallet, with its recovery words written on paper, is a responsible place to start. Get a hardware wallet before your first significant purchase, so you can send it straight to the device. A budget option like the Trezor Safe 3 at $59 (Nov 2026) does the job and builds good security habits from the start.
Should I buy a Bitcoin-only hardware wallet or one that supports multiple cryptocurrencies?
If you only hold Bitcoin, buy a Bitcoin-only wallet. The firmware is simpler, which means fewer potential bugs and a smaller attack surface. Every additional cryptocurrency supported adds code that could introduce vulnerabilities affecting your Bitcoin. Bitcoin-only devices such as the Coldcard, the BitBox02 Bitcoin-only edition and the Bitcoin-only editions of the Trezor Safe 3 and 5 are purpose-built for one thing: securing your Bitcoin. If you also hold other cryptocurrencies, you can use a multicoin wallet for those while keeping your Bitcoin on a dedicated Bitcoin-only device.
Is Ledger safe to use despite the data breach?
Ledger’s hardware was not compromised in their 2020 data breach — the breach exposed customer personal data (names, addresses, phone numbers) from their e-commerce database. Ledger devices themselves still provide genuine security through their certified secure element. However, the data breach remains concerning because it demonstrates how the company handles sensitive customer data, and the closed-source nature of their firmware means you can’t independently verify their security claims. The breach on its own doesn’t put a Ledger you already own at risk; if you bought it from the reseller CryptoBilis, read our advisory. If you’re buying new and want to be able to check the code your device runs, Trezor, Coldcard or BitBox02 publish theirs. If you want Bluetooth for your phone or broad coin support, a Ledger remains a reasonable choice; our Ledger vs Trezor lesson compares them.
Our Top Picks: Which Hardware Wallet Should You Buy?
Based on manufacturer documentation, firmware release notes and independent reviews (facts checked 7 Nov 2026), here are our recommendations based on different user profiles:
Best for beginners: Trezor Safe 5 ($129, Nov 2026)
Its colour touchscreen and the Trezor Suite app guide you through each step, its firmware is open source, and it has an EAL6+ secure chip. This is also the pick in our free course. Know that it makes a 20-word SLIP-39 backup by default; choose 12 or 24 words at setup if you might switch brands one day. Our previous overall pick, the Foundation Passport Core, is discontinued; Foundation now sells the Passport Prime (€388.95, Nov 2026), which we have not reviewed.
Best for security maximalists: Coldcard Mk5 ($269 list / $219 sale) or Coldcard Q ($369 list / $319 sale), Nov 2026
If you run your own Bitcoin node, understand PSBTs, and want every possible security feature crammed into a device, the Coldcard on fixed firmware is still a strong pick: dual secure elements, trick PINs, brick PINs, BIP85 child seeds, a login countdown, and deep multisig support. Choose the Q if you’ll type long passphrases or want QR signing; its keyboard is worth the extra cost. The UX is functional but not pretty — you’re buying this for what it does, not how it looks. For savings, use it as one key of a 2-of-3 multisig with devices from three different manufacturers, as described in the Coldcard section above.
Best budget option: Trezor Safe 3 ($59, Nov 2026)
At $59, the Safe 3 is the cheapest way to get a hardware wallet with an EAL6+ secure element and open-source firmware. It’s a legitimate security device at an entry-level price. If your budget is tight, this is where to start. You can always upgrade later: a 12- or 24-word backup restores on most other brands, while the Safe 3’s default 20-word backup restores on another Trezor (not the original Trezor One) or on wallets that support SLIP-39, such as Keystone or Sparrow.
Best for phone use with an air gap: Blockstream Jade Plus (from $149, Nov 2026)
If you want to manage your Bitcoin primarily from your phone, the Jade Plus works with the Blockstream app on both iOS and Android. The QR-based air gap means you never need to plug in a USB cable. The camera and color screen make QR signing smooth. And from $149 with open-source firmware, it’s strong value for the money.
When a Ledger is the right choice
Choose a Ledger if you want to manage your bitcoin from your phone over Bluetooth, keep other coins in the same app, or want a 24-word backup that restores on most other brands, and you’re comfortable trusting closed-source firmware from a long-established company. On a tight budget the Nano S Plus ($69) does the core job. For phone use, the Nano X ($99) or the Nano Gen5 ($179) pairs with the Ledger Wallet app; the Gen5 has a larger touchscreen. The Flex ($249) and Stax ($399) add bigger E Ink touchscreens (prices Nov 2026). The hardware is solid and the secure element is genuine; what you give up is the ability to check the firmware yourself. Our Ledger vs Trezor lesson compares the two brands side by side.
Related Resources
Continue learning about hardware wallet security and Bitcoin self-custody:
- Hardware Wallet Self-Custody: Full Guide
- Dark Skippy Attack: Is Your Hardware Wallet Safe?
- Hardware Wallet Multisig Setup Guide
- Air-Gapped Hardware Wallets: 2026 Guide
- Bitcoin Seed Phrase Storage: Best Practices
- Hardware Wallet Seed Phrase Migration: Step by Step
- Singlesig to Multisig Bitcoin Migration
- DIY Bitcoin Signing Device: Hardware Guide
- Best Bitcoin Cold Storage Methods: Six Options Compared
- Bitcoin Self-Custody Checklist: 44 Steps
