Choosing a hardware wallet means balancing security, ease of use, price and your own comfort with technology. In Hardware Wallets Explained you saw why these devices are the standard for Bitcoin self-custody. Now the practical question: which one should you buy? This Ledger vs Trezor comparison goes beyond those two brands to cover Coldcard, BitBox, Blockstream Jade and Keystone too.
There’s no single “best” hardware wallet. The quick answer comes first; the detailed spec sheets follow, folded so you can open only the ones you need.
Updated 6 November 2026: prices are from the makers’ own stores (checked 3 November 2026 unless noted). Ledger Live is now called Ledger Wallet, Ledger and BitBox have new models (Nano Gen5, BitBox02 Nova), the Coldcard Mk4 and Foundation Passport Core are discontinued, and an October 2026 incident changed our advice on where to buy.
How to Choose: Decision Framework
| If you are… | Consider | Why, in one line |
|---|---|---|
| A beginner who wants clear guidance | Trezor Safe 5 ($129) | Colour touchscreen, step-by-step app, open-source firmware, secure chip. Note its 20-word backup (below). |
| On a tight budget | Trezor Safe 3 ($59), Ledger Nano S Plus ($69) or Blockstream Jade Classic ($67) | All do the core job well; Jade adds QR signing but has no secure chip. |
| Wanting to manage from your phone | Ledger Nano Gen5 ($179) or Nano X ($99) | Bluetooth to the phone app; the Gen5 has a larger touchscreen. |
| Bitcoin-only and privacy-minded | BitBox02 (€149 incl. VAT, EU store) or Trezor Safe 3/5 Bitcoin-only editions | Open-source firmware, Bitcoin-only builds, privacy features in the app. |
| Wanting to sign without ever plugging in | Keystone 3 Pro ($149, pre-order) or Blockstream Jade Classic ($67) | QR-code signing; Keystone has a 4" screen and three secure chips. |
| Experienced and security-focused | Coldcard Mk5 ($269, $219 on sale) or Coldcard Q ($369, $319 on sale) | Bitcoin-only, microSD/QR signing, advanced PIN tricks. No app of its own; steeper learning curve. |
Two terms you’ll meet throughout: a secure element is a tamper-resistant chip that guards secrets against physical attack, like the chip in a bank card; an air gap means the device never connects by cable or wireless to another device and passes data by QR code or microSD card instead.
What changes at setup, by brand
- Trezor Safe 3, 5, 7: by default you get a 20-word backup in a standard called SLIP-39. It restores on every Trezor except the original Trezor One, and on wallets such as Sparrow, Electrum, BlueWallet and the Keystone hardware wallet, but not on Ledger or Coldcard. If restoring on other brands matters to you, choose a 12- or 24-word BIP39 backup from Trezor Suite’s backup format option when you create the wallet.
- Ledger: 24 BIP39 words; you manage it with the Ledger Wallet app.
- Coldcard: 12 or 24 BIP39 words. There’s no Coinkite app: you pair it with a compatible wallet such as Sparrow, Nunchuk or Electrum.
- BitBox02: 24 BIP39 words, saved by default to the included microSD card (you can write them down instead); managed with the BitBoxApp.
Later, for large savings (Course 5)
People protecting large amounts sometimes combine several of these devices in a 2-of-3 multisig (three keys from three different makers, any two needed to spend) or add a passphrase. Both are powerful and easy to get wrong in a way that locks you out, so don’t start with them. Multisig is taught in Course 5 (multisig wallets explained, and why three keys from one vendor are not multisig); the passphrase in Seed Phrase Storage. Adding your own dice rolls to a new seed is a separate, optional step: the FAQ of Seed Phrases Explained says when it helps.
Choosing the Best Hardware Wallet in 2026
Early on, the choice was Ledger or Trezor. Today several makers offer devices with different security philosophies. Here’s what to weigh:
- Secure element: does it have a tamper-resistant chip?
- Air gap: can it work without ever connecting by USB or Bluetooth?
- Open-source firmware: can anyone read and audit the device’s code?
- Screen: can you comfortably check a whole address on the device?
- Software: how good is the maker’s app, and does it work with Sparrow or Electrum?
- Price: relative to what you’re protecting.
- Bitcoin-only option: less code means fewer places for bugs.
For a quick side-by-side view, see our hardware wallet comparison chart.
Ledger Hardware Wallets
Ledger is a French company and one of the two original hardware wallet makers, with the widest coin support of any brand. All Ledger devices use the Ledger Wallet app (called Ledger Live until October 2025) and the same closed-source operating system running on a secure element. They create 24-word BIP39 backups. In October 2026 Ledger also announced the Ledger Atom, an Android-based device with a secure element running Ledger OS; it can only be reserved so far, with delivery estimated for mid-2027, so it isn’t in this comparison.
Ledger Nano S Plus ($69): entry-level, USB only
- Connectivity: USB-C
- Screen: small OLED, two buttons
- Secure element: ST33K1M5 (CC EAL6+)
A reliable starter. The small screen means scrolling to check a full address, which works but is slower.
Ledger Nano X ($99): adds Bluetooth
- Connectivity: USB-C and Bluetooth; built-in battery
- Screen: small OLED, two buttons
- Secure element: ST33J2M0 (CC EAL5+, one level below Ledger’s newer chip)
Bluetooth lets you use it with the Ledger Wallet phone app. Some people avoid wireless interfaces on principle; Ledger encrypts the link, and the keys stay in the secure element either way.
Ledger Nano Gen5 ($179): touchscreen, Bluetooth, launched October 2025
- Screen: 2.8" E Ink touchscreen
- Connectivity: USB-C, Bluetooth, NFC
- Secure element: ST33K1M5 (CC EAL6+)
Ledger’s newest Nano, with a larger screen than earlier Nanos so you can read full addresses more easily. Ships with a Ledger Recovery Key card, which Ledger says works alongside your paper backup, not instead of it. We have not reviewed it hands-on.
Ledger Flex ($249): larger E Ink touchscreen
- Screen: 2.8" E Ink touchscreen
- Connectivity: USB-C, Bluetooth, NFC
- Secure element: ST33K1M5 (CC EAL6+)
Full addresses without scrolling make checking faster and less error-prone.
Ledger Stax ($399): premium curved screen
- Screen: 3.7" curved E Ink touchscreen
- Connectivity: USB-C, Bluetooth, NFC, Qi wireless charging
- Secure element: ST33K1M5 (CC EAL6+)
Same security as the Flex; the extra cost is for design and screen size.
Ledger: Pros and Cons
Pros:
- Long track record and the widest coin support
- Polished app with buying, swapping and many extras built in
- Certified secure elements in every model
Cons and debates:
- Closed-source firmware: outsiders can’t audit all the code running on the secure element; you trust Ledger and its certifications.
- Ledger Recover (2023): an optional paid service that, if you sign up and approve it on the device, encrypts your seed, splits it into three fragments held by Ledger, Coincover and EscrowTech, and lets you recover with two of them after an identity check. Critics argued it showed that Ledger’s firmware can be updated to export a seed; Ledger replied that it’s opt-in and needs your PIN and approval. In principle any hardware wallet’s firmware could be changed to export a seed; the debate is over how much you can verify, which open-source firmware makes easier.
- 2020 customer data breach: Ledger’s e-commerce database leaked customers’ names, emails, phone numbers and home addresses. No funds or device secrets were affected, but customers faced phishing and threats.
More in our complete Ledger security analysis.
Trezor Hardware Wallets
Trezor, made by the Czech company SatoshiLabs, launched the first commercial hardware wallet in 2014. Its main difference is open-source firmware: the wallet’s own code is public, so anyone can read, audit and build it. The secure chips in the Safe 3 and Safe 5 are not open source; Trezor chose them partly because they are “NDA-free”, which lets it publish all of its own code that talks to them. The Safe 7 adds a second chip, TROPIC01, which Trezor presents as an independently auditable secure element.
Trezor Safe 5 ($129): colour touchscreen
- Screen: 1.54" colour touchscreen, haptic feedback
- Connectivity: USB-C
- Secure element: Infineon OPTIGA Trust M (CC EAL6+)
- Firmware: open source; Bitcoin-only edition available
Its touchscreen makes setup and address checking straightforward, and the secure chip fixes the main criticism of older Trezors, which had none.
Trezor Safe 3 ($59): budget, buttons
- Screen: 0.96" monochrome OLED, two buttons
- Connectivity: USB-C
- Secure element: Infineon OPTIGA Trust M
- Firmware: open source; Bitcoin-only edition available
The same secure chip as the Safe 5 in a smaller package. Very capable for the price; the small screen is less comfortable for frequent use.
Trezor Safe 7 ($249): largest Trezor screen, Bluetooth
Trezor says it has its biggest, brightest colour display yet, encrypted Bluetooth and Qi2-compatible wireless charging, with OPTIGA Trust M plus TROPIC01. We have not reviewed it, so it’s not in the comparison table.
Trezor: Pros and Cons
Pros:
- Open-source firmware, independently auditable
- Trezor Suite is a clear app, with built-in Tor (a network that hides your IP address) for privacy
- Current models have a secure chip
- Bitcoin-only editions of the Safe 3, Safe 5 and Safe 7
Cons:
- No air-gap option: USB (and Bluetooth on the Safe 7)
- Older models (Trezor One, Model T) had no secure element; in 2022 a hardware hacker extracted the seed from a Trezor One running old firmware with physical access
- The default 20-word backup doesn’t restore on Ledger or Coldcard (see “What changes at setup”)
Coldcard Hardware Wallets (Coinkite)
Security advisory (checked 5 November 2026): a firmware flaw disclosed in July 2026 made some Coldcard seeds far weaker than intended, and wallets were emptied. Coinkite has released fixed firmware, and current firmware makes you add your own randomness before creating a seed. If you created a seed on a Coldcard, read who is affected and exactly what to do.
Coldcard, made by the Canadian company Coinkite, is built for security-focused Bitcoin users. Every Coldcard is Bitcoin-only. Its firmware is published under the MIT licence with the “Commons Clause”: you can read, build and modify it, but not sell it. Coinkite describes its products as open source; under the usual definition, which doesn’t allow a no-selling clause, the licence is “source-available”. Either way, the code is public to read.
Coldcard Mk5 ($269, $219 on sale): replaced the Mk4
- Connectivity: microSD, NFC, USB-C; can work fully air-gapped via microSD
- Secure elements: two, from different vendors: Microchip ATECC608 and Maxim DS28C36B
- Input: keypad, so your PIN is typed on the device
- Screen: Coinkite describes a bigger, brighter screen than the Mk4’s, behind Gorilla Glass
Two chips from different makers mean a flaw in one vendor’s chip isn’t enough on its own. Coldcard extras: a duress PIN that opens a decoy wallet, a “brick-me” PIN that destroys the secure elements, a login countdown, and two anti-phishing words shown during PIN entry that confirm it’s your device. Mk4 owners: our Coldcard Mk4 setup guide.
Coldcard Q ($369, $319 on sale): keyboard, camera, big screen
- Screen: larger LCD (320×240)
- Connectivity: microSD and QR codes (built-in camera), plus NFC and USB-C
- Input: full QWERTY keyboard
- Secure elements: Microchip ATECC608 and Maxim DS28C36B
- Power: AAA batteries or USB
The keyboard makes long passphrases much easier to type than on a keypad, and QR codes add a second air-gapped route.
Coldcard: Pros and Cons
Pros:
- Two secure chips from different vendors, air-gapped signing and anti-coercion features
- Bitcoin-only, focused development
- Readable source code
Cons:
- Steeper learning curve; not designed for beginners
- No app of its own: you pair it with a wallet such as Sparrow, Nunchuk or Electrum
- Licence isn’t open source in the strict sense
- The July 2026 seed flaw (see the advisory)
BitBox02 (BitBox / Shift Crypto)
The BitBox02, from the Swiss company Shift Crypto (which trades as BitBox since 2023), is a minimalist USB device: €149 including VAT in its EU store (3 Nov 2026). A newer model, the BitBox02 Nova, adds a newer secure chip (Infineon OPTIGA Trust M V3) and optional Bluetooth so it works with iPhone and iPad; Bluetooth can be permanently switched off. Check bitbox.swiss for its current price.
BitBox02 specs
- Screen: small OLED (128×64)
- Connectivity: USB-C
- Secure element: Microchip ATECC608B
- Input: touch sliders on the edges
- Firmware: open source (Apache 2.0)
- Editions: Bitcoin-only and Multi
You swipe and tap the edges to navigate; it takes a few minutes to get used to. The Bitcoin-only firmware contains no altcoin code at all. The BitBox02 also uses “anti-exfil” signing, which stops a malicious device from hiding your seed inside its signatures (see Hardware Wallets Explained).
Pros: open-source firmware under a permissive licence; Tor support in the BitBoxApp; secure chip plus open firmware; discreet USB-stick size. Cons: no air gap; small screen means scrolling to check addresses; the touch sliders can feel imprecise at first.
Blockstream Jade
The Blockstream Jade, now sold as the Jade Classic, is the cheapest way to sign by QR code: $67 (Nov 2026). Blockstream also sells the Jade Plus at $149 (plastic) or $169 (metal), and the Jade Core ($99), which has no camera, so it can’t sign by QR code.
Jade specs and how it protects keys without a secure element
- Screen: 1.14" colour LCD
- Connectivity: USB-C, Bluetooth, or QR codes via its camera
- Secure element: none; uses a “virtual secure element”
- Firmware: open source
Instead of a hardware chip, Jade encrypts your keys on the device and uses a “blind oracle” server run by Blockstream that holds part of what’s needed to unlock them. Neither the device nor the server alone can unlock the keys; together, after your PIN, the keys are decrypted on the device. You can run your own oracle. There’s also a mode that works fully offline by keeping your seed as a SeedQR (your words encoded in a QR code) that you scan each time. Jade supports Bitcoin and assets on the Liquid sidechain (a separate network, run by a federation of companies, whose coins are pegged to bitcoin), not general altcoins, and uses anti-exfil signing.
Pros: cheapest air-gapped option; open source; camera for QR signing; works with Blockstream’s app and Sparrow. Cons: no hardware secure element; normally needs the oracle server to unlock; small screen. Full Blockstream Jade review.
Keystone 3 Pro
The Keystone 3 Pro signs mainly by QR code and has no Bluetooth; with its multi-coin firmware it can also connect over USB to some wallets (Keystone firmware changelog). Keystone lists it at $149, on pre-order (expected to ship in 4–6 weeks, as of 3 Nov 2026).
Keystone 3 Pro specs
- Screen: 4" colour touchscreen
- Connectivity: QR codes; USB with some wallets on the multi-coin firmware; no Bluetooth
- Secure elements: three different chips, per Keystone: Microchip ATECC608B and Maxim DS28S60 protect the seed; a Maxim MAX32520 protects fingerprint data
- Firmware: open source; multi-chain, with Bitcoin-only firmware available
- Fingerprint sensor: yes
Keystone says the device has anti-tamper protection that wipes the secure elements if someone opens it. The large screen makes checking full addresses comfortable.
Pros: true air gap; one of the largest screens; open-source firmware; can restore Trezor’s 20-word backups. Cons: multi-chain by default (the Bitcoin-only firmware is installed after purchase); shorter track record; bigger device. See our Keystone Pro security analysis.
Foundation Passport Core (Discontinued)
The Bitcoin-only, open-source, air-gapped Passport (later called Passport Core) is no longer sold. Foundation now sells the Passport Prime (€388.95, Nov 2026), which we have not reviewed. Current owners can find the details in our Foundation Passport review.
Complete Hardware Wallet Comparison Table
Prices from the makers’ stores, checked 3 November 2026 (Nano Gen5 from Ledger’s launch notice). For a regularly updated version, see our full comparison chart.
| Device | Price | Secure Element | Air Gap | Open Source | Screen | Connectivity | Bitcoin-Only | Default backup |
|---|---|---|---|---|---|---|---|---|
| Ledger Nano S Plus | $69 | Yes (ST33K1M5, EAL6+) | No | No | Small OLED | USB-C | No | 24 words (BIP39) |
| Ledger Nano X | $99 | Yes (ST33J2M0, EAL5+) | No | No | Small OLED | USB-C, Bluetooth | No | 24 words (BIP39) |
| Ledger Nano Gen5 | $179 | Yes (ST33K1M5, EAL6+) | No | No | 2.8" E Ink touch | USB-C, Bluetooth, NFC | No | 24 words (BIP39) |
| Ledger Flex | $249 | Yes (ST33K1M5, EAL6+) | No | No | 2.8" E Ink touch | USB-C, Bluetooth, NFC | No | 24 words (BIP39) |
| Ledger Stax | $399 | Yes (ST33K1M5, EAL6+) | No | No | 3.7" curved E Ink | USB-C, BT, NFC, Qi | No | 24 words (BIP39) |
| Trezor Safe 5 | $129 | Yes (OPTIGA) | No | Firmware yes | 1.54" colour touch | USB-C | Edition available | 20 words (SLIP-39) |
| Trezor Safe 3 | $59 | Yes (OPTIGA) | No | Firmware yes | Small OLED | USB-C | Edition available | 20 words (SLIP-39) |
| Coldcard Mk5 | $269 ($219 on sale) | Yes (ATECC608 + DS28C36B) | Yes (microSD) | Source-available | Small screen | microSD, NFC, USB-C | Yes | 12 or 24 words (BIP39) |
| Coldcard Q | $369 ($319 on sale) | Yes (ATECC608 + DS28C36B) | Yes (microSD + QR) | Source-available | Larger LCD | microSD, QR, NFC, USB-C | Yes | 12 or 24 words (BIP39) |
| BitBox02 | €149 incl. VAT | Yes (ATECC608B) | No | Yes (Apache 2.0) | Small OLED | USB-C | Edition available | 24 words (BIP39), microSD |
| Blockstream Jade Classic | $67 | No (virtual SE) | Yes (QR) | Yes | 1.14" colour LCD | USB-C, BT, QR | Bitcoin + Liquid | BIP39 |
| Keystone 3 Pro | $149 (pre-order) | Yes (three chips) | Yes (QR) | Yes | 4" colour touch | QR; USB with some wallets | BTC-only firmware | BIP39 |
Ledger vs Trezor: Direct Comparison
| Criteria | Ledger | Trezor |
|---|---|---|
| Open-source firmware | No | Yes (the secure chips themselves are not) |
| Secure element | Yes, all models (EAL6+, Nano X EAL5+) | Yes on Safe 3, 5 and 7; older models had none |
| Air gap option | No | No |
| App | Ledger Wallet (feature-rich) | Trezor Suite (privacy-focused, Tor) |
| Default backup | 24 BIP39 words | 20 SLIP-39 words (12/24 BIP39 optional) |
| Bluetooth | Nano X, Nano Gen5, Flex, Stax | Safe 7 |
| Touchscreen | Nano Gen5, Flex, Stax | Safe 5, Safe 7 |
| Price range (Nov 2026) | $69–$399 | $59–$249 |
| Data breach history | 2020 customer data leak | January 2024: someone accessed the third-party support portal Trezor used, possibly exposing names and emails of up to 66,000 support contacts; no funds affected, per Trezor’s notice of 19 Jan 2024 |
| Optional seed-backup service | Ledger Recover (opt-in, paid) | None |
| Bitcoin-only option | No | Yes (Safe 3, Safe 5 and Safe 7 editions) |
Choose Ledger if: you want Bluetooth for phone use, the widest app features, or 24-word backups that restore on most other brands, and you’re comfortable trusting closed-source firmware from a long-established company.
Choose Trezor if: you want firmware anyone can audit, a privacy-focused app with Tor, and a Bitcoin-only edition, and you’re happy with a 20-word backup (or choose the BIP39 format at setup).
For more detail, see our Trezor vs Ledger 2026 complete comparison.
Where to Buy Hardware Wallets Safely
This matters as much as which device you choose.
Buy Directly From the Maker
In October 2026 Ledger confirmed a hidden implant in a device sold by CryptoBilis, an authorised reseller of Ledger and Trezor in Southeast Asia: it copied the recovery words during setup and sent them out over a mobile connection. Ledger says the attackers had bought genuine devices, opened them, fitted the hidden parts and put them back into distribution through resellers in the region, and that it found no compromised units when it screened its own stock (our advisory). A tampered device can come with a seed the seller already knows, with modified hardware, or be a counterfeit with no real security at all.
Buying Rules
- Buy new, from the maker’s own store: ledger.com, trezor.io, store.coinkite.com, bitbox.swiss, store.blockstream.com, keyst.one. If the maker doesn’t deliver to your country, use a reseller listed on the maker’s own website, and check our security advisories for that reseller first.
- Avoid Amazon, eBay and other marketplaces, even listings labelled “official store”.
- Never buy second-hand. No exceptions: a reset can’t prove nobody modified the hardware.
- Check the packaging the way your maker says (Trezor’s holographic seal, Coldcard’s numbered bag, Ledger’s Genuine Check in the app) and stop if anything looks opened or wrong.
- Run the maker’s authenticity check during setup, knowing it can’t catch every physical change.
- Let the device make a new seed. A device that arrives with words already on a card is compromised: return it.
Once you’ve chosen, How to Set Up a Hardware Wallet walks you through setup, whichever brand you picked.
Frequently Asked Questions
Is Ledger or Trezor better?
Neither is better for everyone. Ledger offers Bluetooth, the broadest app and 24-word backups that restore on most brands, with closed-source firmware. Trezor offers open-source firmware, a privacy-focused app and Bitcoin-only editions, with a 20-word default backup that restores on fewer brands. If auditability matters most to you, Trezor; if phone use and broad compatibility do, Ledger. See our Trezor vs Ledger 2026 comparison.
Do I need an air-gapped wallet?
For most personal holdings, a USB hardware wallet from a reputable maker is more than adequate. An air gap removes the USB link as an attack channel, which appeals for large holdings, at the cost of a slightly more complex routine. The difference between USB and air gap is far smaller than between any hardware wallet and a software wallet.
Is open-source firmware important?
Open code can be checked by independent researchers, so bugs and backdoors are more likely to be found. Closed code means trusting the maker. Both approaches have produced secure devices; it comes down to how much you value being able to verify. More in why open-source hardware wallets matter.
Can hardware wallets be hacked?
No remote attack on a hardware wallet’s key storage has been seen in the wild. Physical attacks on older models are real: in 2022 a hardware hacker used voltage glitching to extract the seed from an old Trezor One running outdated firmware. The July 2026 Coldcard flaw didn’t need the device at all: it made seeds that could be guessed (see the advisory). The everyday risks are user-side: typing words into fake apps or sites, not checking addresses on the device, and buying from anyone but the maker. The Scams That Empty Self-Custody Wallets shows how each of these works and what stops it.
Which hardware wallet is best for beginners?
The Trezor Safe 5 ($129): its touchscreen and Trezor Suite guide you through each step. Know that it makes a 20-word SLIP-39 backup by default. On a tighter budget, the Trezor Safe 3 ($59) or Ledger Nano S Plus ($69) do the core job well. Our buying guide has more help.
Check Your Understanding
1. You might move to a different brand of hardware wallet one day. What should you choose when setting up a Trezor Safe, and why?
Answer
Choose a 12- or 24-word BIP39 backup from Trezor Suite’s backup format option. The default 20-word SLIP-39 backup restores on Trezor and some wallets, but not on Ledger or Coldcard; a BIP39 backup restores on most brands.
2. An authorised reseller near you sells the device you want at a discount. Why buy from the maker’s own store instead?
Answer
A device tampered with before it reaches you can steal everything you put on it, and the maker’s authenticity check can’t detect every physical modification. In October 2026 Ledger confirmed an implant that copied the recovery words in a device sold by an authorised reseller, CryptoBilis. Buying new from the maker removes the middle link.
3. What does a secure element protect against, and what doesn’t it?
Answer
It makes it much harder for someone with the device in hand to extract the keys, by resisting glitching, probing and side-channel attacks. It does nothing if you type your words into a fake app, approve a payment to the wrong address, or lose your backup.