The 10 best hardware wallets for Bitcoin, reviewed by a custodian who owns each.

🔴 Ledger Connect-Kit. Npm supply-chain attack

A former Ledger employee was phished. The attacker pushed malicious versions 1.1.5 through 1.1.7 of the Connect-Kit npm package, which is loaded by dozens of dApps including Zapper, SushiSwap, Phantom, Balancer and Revoke.cash. Visitors who interacted with those dApps during the ~40-minute window saw a fake wallet-drainer modal injected into the page. The Ledger hardware itself was not compromised: the attack happened at the JavaScript-library layer between the dApp UI and the wallet. Ledger patched within ~40 minutes and reimbursed victims. Full timeline at BleepingComputer and Ledger’s own incident report.

Why Ledger Nano X is still ranked #1: The hardware design and secure element worked exactly as intended. The failure was in employee access controls and npm package signing, both of which Ledger restructured publicly. Nothing here changes the wallet’s security model for users who don’t interact with affected dApps during the incident window.

🟡 Ledger Recover. Firmware-level seed exfiltration controversy

Ledger announced an optional paid recovery service that splits an encrypted copy of the seed phrase across three third-party custodians for users who pass ID verification. The backlash was immediate: critics argued that the firmware capability to extract the seed should not exist at all on a hardware wallet, even if the user has to opt in. A class-action lawsuit followed in 2024. The service launched but remains opt-in.

Why it still matters: Recover did not change the technical security of users who don’t enable it. But it set a precedent that the firmware can exfiltrate seed material under user instruction. Bitcoin-first buyers who treat that capability as disqualifying continue to choose Trezor, BitBox or Foundation instead.

🟡 Trezor support-portal phishing. Twice

In January 2024, a third-party ticket portal that Trezor used for support was breached, exposing names and email addresses of approximately 66,000 users. No seed material was extracted (the seed never leaves the device). In June 2025, attackers found a way to abuse Trezor’s ticket auto-reply system to send phishing emails *from* [email protected], prompting users to “verify” their seed via a malicious form. The hardware was untouched; the social-engineering surface is the lesson.

Why Trezor is still #2: The wallet itself is fully open source with an EAL6+ secure element. Support-portal hygiene is a vendor operations issue, not a security architecture issue. Trezor pushed transparent post-mortems and migrated off the affected portal.

🟡 Cypherock GEEKCON 2025. Supply-chain compromise demo

Security research collective DARKNAVY chained multiple vulnerabilities to simulate a supply-chain attack against the Cypherock X1: firmware tampering plus secure-boot bypass to capture mnemonics generated on a compromised device. Cypherock pushed patches to GitHub silently rather than issuing a coordinated disclosure. The security community publicly criticized Cypherock’s response, not the underlying patch quality.

Why Cypherock is still on the list (at #9): The distributed-key Shamir model remains a legitimate technical contribution. The patches landed. But the response damaged trust with security researchers, and that matters for a category where the threat model is “vendor competence under attack.” Score reflects it.

🟡 Ledger Nano X. $214,000 retail-fraud drain

A user purchased a Ledger Nano X from a fake “Ledger Thailand” Lazada storefront. The device was pre-configured with an attacker-controlled seed. The user funded the wallet and the attacker drained it. Ledger’s hardware design was correct; the failure was that the user did not buy direct from the vendor. The incident underscores a rule that applies to every wallet on this list: buy from the vendor’s own website, never from a third-party marketplace.

Why it still affects the score: Ledger’s distribution channels remain a known attack vector that the company has done less than Trezor and Foundation to lock down. Box-seal integrity, Genuine Check at first boot, and direct-only distribution all matter.

🟢 The other 7. No material incidents in 24 months

NGRAVE Zero, BitBox02, Tangem, COLDCARD Q, Foundation Passport Core, Keystone 3 Pro, Blockstream Jade Plus. All have clean records across the 24-month scoring window. Two technical disclosures a useful note: Ledger Donjon disclosed a Trezor Safe 3 vulnerability in March 2025 (patched promptly, no theft); and snail-mail phishing campaigns in 2025 targeted Trezor and Ledger customers by name (customer-data weaponization, not hardware compromise).