https://walletinsights.io/en/security-incidents/ Sourced record of hardware wallet vulnerabilities, chip attacks, tampered devices and vendor data breaches, with severity, fix status and reported losses. en Fri, 30 Oct 2026 12:00:00 GMT https://walletinsights.io/en/security-incidents/trezor-cryptobilis-implant-report-2026/ https://walletinsights.io/en/security-incidents/trezor-cryptobilis-implant-report-2026/ Fri, 30 Oct 2026 12:00:00 GMT Supply chain One reported unit, not yet examined by Trezor at the time of writing. The report concerns how a device reached a buyer, not the device design. https://walletinsights.io/en/security-incidents/foundation-passport-phishing-backend-breach-2026/ https://walletinsights.io/en/security-incidents/foundation-passport-phishing-backend-breach-2026/ Mon, 26 Oct 2026 12:00:00 GMT Vendor infrastructure compromise Thousands of Passport customers and other contacts received convincing phishing from Foundation's own domains, and about 5,600 addresses and 5,200 phone numbers are treated as exposed. Foundation states devices and funds on Passport were not compromised. https://walletinsights.io/en/security-incidents/keystone-website-breach-2026/ https://walletinsights.io/en/security-incidents/keystone-website-breach-2026/ Tue, 20 Oct 2026 12:00:00 GMT Customer data breach Buyers' names, addresses and order details are in attackers' hands, which invites targeted phishing. The stolen authentication key means the online authenticity check can no longer rule out counterfeits made with the old key. https://walletinsights.io/en/security-incidents/ngrave-liquid-push-notification-phishing-2026/ https://walletinsights.io/en/security-incidents/ngrave-liquid-push-notification-phishing-2026/ Mon, 19 Oct 2026 12:00:00 GMT Vendor infrastructure compromise LIQUID users who followed the fake alert and entered their recovery phrase or Perfect Key lost funds, about $2.56 million by NGRAVE's count; app usage data of other users was also exposed. NGRAVE states its ZERO devices and their keys were not compromised. https://walletinsights.io/en/security-incidents/ledger-cryptobilis-hardware-implant-2026/ https://walletinsights.io/en/security-incidents/ledger-cryptobilis-hardware-implant-2026/ Tue, 13 Oct 2026 12:00:00 GMT Supply chain Buyers of tampered units lost their recovery phrases at setup and, with them, their funds. The device design is not affected; the risk is in how the devices reached buyers. https://walletinsights.io/en/security-incidents/ledger-ethereum-app-clear-signing-array-truncation-2026/ https://walletinsights.io/en/security-incidents/ledger-ethereum-app-clear-signing-array-truncation-2026/ Thu, 27 Aug 2026 12:00:00 GMT Firmware vulnerability Users of Ledger Ethereum app 1.19.0 to 1.22.2 signing through a compromised host could approve a batch of more than 255 operations while seeing only one. Ledger describes exploitation as difficult and fixed the flaw in Ethereum app 1.22.3. https://walletinsights.io/en/security-incidents/ledger-ethereum-app-swap-approval-substitution-2026/ https://walletinsights.io/en/security-incidents/ledger-ethereum-app-swap-approval-substitution-2026/ Thu, 27 Aug 2026 12:00:00 GMT Firmware vulnerability Users swapping tokens through Ledger's Exchange app with Ethereum app 1.20.0 to 1.22.2 could, via a hostile swap provider, sign a token approval for the agreed amount to the swap's deposit address instead of a payment. Ledger states the permission moves no funds by itself and found no evidence of exploitation. https://walletinsights.io/en/security-incidents/ledger-secure-sdk-review-signature-desync-2026/ https://walletinsights.io/en/security-incidents/ledger-secure-sdk-review-signature-desync-2026/ Thu, 27 Aug 2026 12:00:00 GMT Firmware vulnerability Users of Ledger device apps built on Secure SDK releases from August 2025 through v26.6.0 could, if a compromised host or web page controlled the connection, approve an operation shown correctly on screen and sign different parameters. Ledger states it has no evidence of exploitation against users. https://walletinsights.io/en/security-incidents/bitbox02-dixence-firmware-flaws-2026/ https://walletinsights.io/en/security-incidents/bitbox02-dixence-firmware-flaws-2026/ Mon, 17 Aug 2026 12:00:00 GMT Firmware vulnerability BitBox02 owners on older firmware could have malicious firmware installed after being phished into using a fake app, and un-set-up Multi devices were exposed to a malicious computer. BitBox reports no exploitation or stolen funds and states seeds were not affected. https://walletinsights.io/en/security-incidents/safepal-customer-order-data-breach-2026/ https://walletinsights.io/en/security-incidents/safepal-customer-order-data-breach-2026/ Sun, 16 Aug 2026 12:00:00 GMT Customer data breach Names, contact details and shipping addresses of about 39,798 SafePal customers were exposed, and some were then targeted with phishing. SafePal states wallets and funds were not compromised by the breach itself. https://walletinsights.io/en/security-incidents/trezor-shipmonk-customer-data-breach-2026/ https://walletinsights.io/en/security-incidents/trezor-shipmonk-customer-data-breach-2026/ Thu, 13 Aug 2026 12:00:00 GMT Customer data breach Names, contact details and shipping addresses of up to 80,689 Trezor customers were exposed through ShipMonk, raising the risk of targeted phishing. Trezor states its systems and devices were not affected. https://walletinsights.io/en/security-incidents/bitkey-relationship-enrollment-weak-randomness-2026/ https://walletinsights.io/en/security-incidents/bitkey-relationship-enrollment-weak-randomness-2026/ Sun, 02 Aug 2026 12:00:00 GMT Software vulnerability Second-generation Bitkey users who enrolled Recovery Contacts or inheritance beneficiaries used secrets generated with a predictable random generator. Bitkey states the bug could not on its own give access to funds and that no customer was exploited. https://walletinsights.io/en/security-incidents/coldcard-weak-seed-generation-2026/ https://walletinsights.io/en/security-incidents/coldcard-weak-seed-generation-2026/ Thu, 30 Jul 2026 12:00:00 GMT Firmware vulnerability Funds on seeds generated with the affected firmware can be found and swept remotely. Current firmware is fixed, but the risk remains for funds still held on old seeds. https://walletinsights.io/en/security-incidents/tangem-laser-fault-injection-2026/ https://walletinsights.io/en/security-incidents/tangem-laser-fault-injection-2026/ Thu, 09 Jul 2026 12:00:00 GMT Hardware attack Someone who steals a card and has laboratory equipment can sign transactions without the access code. Cards already sold cannot be patched. https://walletinsights.io/en/security-incidents/keystone-3-pro-usb-sdk-code-execution-2026/ https://walletinsights.io/en/security-incidents/keystone-3-pro-usb-sdk-code-execution-2026/ Fri, 03 Jul 2026 12:00:00 GMT Firmware vulnerability Someone holding a Keystone 3 Pro on firmware older than 2.4.0, knowing its PIN and approving a USB connection on it could run code on its microcontroller; ANZEN says this led to the recovery phrase. Keystone reports no exploitation. https://walletinsights.io/en/security-incidents/ledger-monero-app-keccak-state-key-recovery-2026/ https://walletinsights.io/en/security-incidents/ledger-monero-app-keccak-state-key-recovery-2026/ Thu, 04 Jun 2026 12:00:00 GMT Firmware vulnerability Monero holders using a Ledger Monero app older than 2.1.4 on a compromised computer could have their secret view and spend keys extracted without any prompt on the device while the app was open. Ledger states the issue is fixed in Monero app 2.1.4 and that the prerequisites considerably limit practical exploitability. https://walletinsights.io/en/security-incidents/tropic01-laser-fault-injection-trezor-safe-7-2026/ https://walletinsights.io/en/security-incidents/tropic01-laser-fault-injection-trezor-safe-7-2026/ Wed, 03 Jun 2026 12:00:00 GMT Hardware attack A lab attacker holding a Trezor Safe 7 can run arbitrary firmware on its TROPIC01 secure element and, per Tropic Square and Ledger, compromise its MAC-and-Destroy protection. Trezor states this alone does not expose the PIN, funds or wallet backup and that no user action is needed. https://walletinsights.io/en/security-incidents/fake-ledger-live-apple-app-store-2026/ https://walletinsights.io/en/security-incidents/fake-ledger-live-apple-app-store-2026/ Tue, 14 Apr 2026 12:00:00 GMT Targeted phishing Mac users who installed the fake app and entered their recovery phrase lost about $9.5 million in total, according to ZachXBT. Ledger states it never asks for the recovery phrase. https://walletinsights.io/en/security-incidents/ledger-global-e-order-data-breach-2026/ https://walletinsights.io/en/security-incidents/ledger-global-e-order-data-breach-2026/ Mon, 05 Jan 2026 12:00:00 GMT Customer data breach Names, contact details, postal addresses and order details of an undisclosed number of Ledger.com customers who bought through Global-e were exposed, raising the risk of targeted phishing. Ledger states its systems, devices and customers' crypto assets were not affected. https://walletinsights.io/en/security-incidents/blockstream-jade-register-descriptor-memory-corruption-2025/ https://walletinsights.io/en/security-incidents/blockstream-jade-register-descriptor-memory-corruption-2025/ Fri, 05 Dec 2025 12:00:00 GMT Firmware vulnerability A Jade on firmware 1.0.24–1.0.36, unlocked and connected to a compromised computer or phone or to a malicious web page, could be crashed or made to run limited code. Blockstream states users of its own app on a clean device were not at immediate risk and no users are known to be affected. https://walletinsights.io/en/security-incidents/ledger-donjon-trezor-safe-3-glitching-2025/ https://walletinsights.io/en/security-incidents/ledger-donjon-trezor-safe-3-glitching-2025/ Wed, 12 Mar 2025 12:00:00 GMT Hardware attack An attacker with lab equipment could turn a Safe 3 into a device running malicious firmware that still passes authenticity checks, then sell it to a victim. Devices bought from official sources and the Safe 5 are not affected, according to Trezor. https://walletinsights.io/en/security-incidents/ledger-mcu-update-reset-handler-bricking-2025/ https://walletinsights.io/en/security-incidents/ledger-mcu-update-reset-handler-bricking-2025/ Fri, 10 Jan 2025 12:00:00 GMT Firmware vulnerability A Ledger Nano X, Flex or Stax on firmware older than 2.4.2, 1.2.2 or 1.6.2 respectively could be made permanently unusable through a crafted MCU firmware update. Ledger states the impact is limited to device operability and funds were never at risk. https://walletinsights.io/en/security-incidents/tangem-app-seed-phrase-logging-bug-2024/ https://walletinsights.io/en/security-incidents/tangem-app-seed-phrase-logging-bug-2024/ Mon, 30 Dec 2024 12:00:00 GMT Software vulnerability Users who activated a seed-phrase wallet and contacted Tangem support through the app within 7 days had their private key included in the logs sent to support. Tangem states fewer than 0.1% of users were affected, the logs were deleted and no funds were lost. https://walletinsights.io/en/security-incidents/eucleak-infineon-side-channel-trezor-safe-2024/ https://walletinsights.io/en/security-incidents/eucleak-infineon-side-channel-trezor-safe-2024/ Tue, 03 Sep 2024 12:00:00 GMT Hardware attack An attacker with physical access and laboratory equipment could, per NinjaLab, extract ECDSA keys from the OPTIGA Trust M chip used in the Trezor Safe 3 and Safe 5. Trezor states the recovery seed and funds are not at risk because that cryptography does not protect the wallet backup. https://walletinsights.io/en/security-incidents/trezor-support-portal-data-breach-2024/ https://walletinsights.io/en/security-incidents/trezor-support-portal-data-breach-2024/ Wed, 17 Jan 2024 12:00:00 GMT Customer data breach Names and email addresses of up to 66,000 support contacts were exposed, and some then received emails asking for their recovery seed. Trezor states no funds were compromised and the devices were unaffected. https://walletinsights.io/en/security-incidents/ledger-connect-kit-supply-chain-attack-2023/ https://walletinsights.io/en/security-incidents/ledger-connect-kit-supply-chain-attack-2023/ Thu, 14 Dec 2023 12:00:00 GMT Supply chain Users of dApps that loaded the compromised library, with any wallet, could be drained by approving malicious transactions during a window of under two hours. Ledger devices and Ledger Live were not compromised, according to Ledger. https://walletinsights.io/en/security-incidents/fake-ledger-live-microsoft-store-2023/ https://walletinsights.io/en/security-incidents/fake-ledger-live-microsoft-store-2023/ Sun, 05 Nov 2023 12:00:00 GMT Targeted phishing Windows users who installed the fake app from the Microsoft Store lost about $768,000–$770,000 in total, according to press reports citing ZachXBT. https://walletinsights.io/en/security-incidents/counterfeit-trezor-model-t-preset-seeds-2023/ https://walletinsights.io/en/security-incidents/counterfeit-trezor-model-t-preset-seeds-2023/ Wed, 10 May 2023 12:00:00 GMT Supply chain Anyone who set up a wallet on such a counterfeit used a seed the attacker already knew. Owners of genuine devices bought through official channels are not affected. https://walletinsights.io/en/security-incidents/onekey-mini-secure-element-bus-interception-2023/ https://walletinsights.io/en/security-incidents/onekey-mini-secure-element-bus-interception-2023/ Fri, 10 Feb 2023 12:00:00 GMT Hardware attack An attacker with an affected device in hand and lab equipment could extract the seed phrase. OneKey states the issue is patched and no users were affected. https://walletinsights.io/en/security-incidents/trezor-mailchimp-newsletter-phishing-2022/ https://walletinsights.io/en/security-incidents/trezor-mailchimp-newsletter-phishing-2022/ Sun, 03 Apr 2022 12:00:00 GMT Vendor infrastructure compromise Owners who installed the fake Trezor Suite and entered their recovery phrase gave attackers control of their funds. Subscribers' email addresses and, in some cases, names and IP addresses were exposed, according to Trezor, which invites further targeted phishing. https://walletinsights.io/en/security-incidents/fake-ledger-devices-mailed-to-breach-victims-2021/ https://walletinsights.io/en/security-incidents/fake-ledger-devices-mailed-to-breach-victims-2021/ Wed, 16 Jun 2021 12:00:00 GMT Targeted phishing Owners whose addresses were in the leaked database could receive a convincing counterfeit built to collect their recovery phrase. Anyone who followed the instructions would hand attackers control of their funds. https://walletinsights.io/en/security-incidents/kraken-safepal-s1-tamper-detection-bypass-2021/ https://walletinsights.io/en/security-incidents/kraken-safepal-s1-tamper-detection-bypass-2021/ Tue, 16 Feb 2021 12:00:00 GMT Hardware attack Someone with physical access could open an S1 without triggering its tamper response and roll back its firmware, but Kraken did not reach keys or funds. SafePal states the findings are not exploitable and patched the downgrade in firmware 1.0.24. https://walletinsights.io/en/security-incidents/coldcard-multisig-xpub-substitution-2021/ https://walletinsights.io/en/security-incidents/coldcard-multisig-xpub-substitution-2021/ Tue, 09 Feb 2021 12:00:00 GMT Firmware vulnerability Users who registered a multisig wallet on a Coldcard on firmware 3.1.9 or earlier through a compromised computer could end up with a wallet the attacker controls or can hold to ransom. Coinkite disputes that this is a remote attack, since it requires a compromised computer at wallet creation. https://walletinsights.io/en/security-incidents/coldcard-testnet-isolation-bypass-2020/ https://walletinsights.io/en/security-incidents/coldcard-testnet-isolation-bypass-2020/ Tue, 24 Nov 2020 12:00:00 GMT Firmware vulnerability A Coldcard owner on firmware 3.1.9 or earlier persuaded to switch the device to testnet and sign an attacker-supplied transaction could lose real bitcoin. Coinkite considers the attack unrealistic because switching to testnet requires explicit action on the device. https://walletinsights.io/en/security-incidents/ledger-customer-database-breach-2020/ https://walletinsights.io/en/security-incidents/ledger-customer-database-breach-2020/ Wed, 29 Jul 2020 12:00:00 GMT Customer data breach Names, postal addresses, phone numbers and email addresses of Ledger buyers became public, which identifies them as crypto holders. No device or seed compromise was reported, but the data was later used for phishing, including fake devices sent by mail. https://walletinsights.io/en/security-incidents/ledger-nano-x-debug-interface-supply-chain-attacks-2020/ https://walletinsights.io/en/security-incidents/ledger-nano-x-debug-interface-supply-chain-attacks-2020/ Wed, 08 Jul 2020 12:00:00 GMT Hardware attack A Nano X tampered with before first use could act as a keyboard on the owner's computer or hide transactions from the screen. Ledger states the Secure Element and user secrets were not affected and that firmware 1.2.4-2 fixes the issue. https://walletinsights.io/en/security-incidents/ledger-bitcoin-app-segwit-fee-overpayment-2020/ https://walletinsights.io/en/security-incidents/ledger-bitcoin-app-segwit-fee-overpayment-2020/ Wed, 03 Jun 2020 12:00:00 GMT Firmware vulnerability Users of the Ledger Bitcoin app and SegWit-capable forks before version 1.4.0 could lose funds to inflated fees if their computer's wallet software was compromised and they signed the same transaction twice. Ledger states the issue is fixed in Bitcoin app 1.4.0. https://walletinsights.io/en/security-incidents/trezor-segwit-double-signing-fee-2020/ https://walletinsights.io/en/security-incidents/trezor-segwit-double-signing-fee-2020/ Wed, 03 Jun 2020 12:00:00 GMT Firmware vulnerability A Trezor user signing on a compromised computer could be led to sign twice and lose most of the transaction's inputs to fees. Trezor lists the issue as fixed in Trezor One 1.9.1 and Model T 2.3.1. https://walletinsights.io/en/security-incidents/ledger-monero-app-spend-key-extraction-2020/ https://walletinsights.io/en/security-incidents/ledger-monero-app-spend-key-extraction-2020/ Sat, 25 Apr 2020 12:00:00 GMT Firmware vulnerability Monero holders using Ledger Monero app versions before 1.5.1 with a malicious or compromised Monero client could have their spend key extracted without any sign on the device. Ledger states the issue is fixed in Monero app 1.5.1. https://walletinsights.io/en/security-incidents/kraken-coolwallet-s-app-seed-pin-exposure-2020/ https://walletinsights.io/en/security-incidents/kraken-coolwallet-s-app-seed-pin-exposure-2020/ Fri, 03 Apr 2020 12:00:00 GMT Software vulnerability CoolWallet S owners whose phone was stolen or infected could have their seed, PIN and pairing password exposed by the Android app. CoolWallet states the risk was limited and that the logging, screen-capture and bypass issues were fixed in its next app release. https://walletinsights.io/en/security-incidents/kraken-trezor-voltage-glitch-seed-extraction-2020/ https://walletinsights.io/en/security-incidents/kraken-trezor-voltage-glitch-seed-extraction-2020/ Fri, 31 Jan 2020 12:00:00 GMT Hardware attack Someone holding a Trezor One or Model T without a passphrase could recover its seed with specialised equipment in about 15 minutes. A device protected by a BIP39 passphrase is not exposed, according to both Kraken and Trezor. https://walletinsights.io/en/security-incidents/ledger-donjon-trezor-seed-extraction-2019/ https://walletinsights.io/en/security-incidents/ledger-donjon-trezor-seed-extraction-2019/ Mon, 01 Jul 2019 12:00:00 GMT Hardware attack Anyone holding a Trezor One or Model T without a strong passphrase could, according to Ledger, extract its seed in minutes with inexpensive equipment. Trezor states a passphrase fully mitigates the attack and disputes that it was disclosed to the company. https://walletinsights.io/en/security-incidents/ledger-donjon-ellipal-ec01-flash-dump-2019/ https://walletinsights.io/en/security-incidents/ledger-donjon-ellipal-ec01-flash-dump-2019/ Tue, 25 Jun 2019 12:00:00 GMT Hardware attack Someone with physical access to an EC01 and lab tools could dump its encrypted keys and, if the password was weak, brute-force them, or backdoor the device. Ellipal states that no seeds were extracted and that firmware v2.0 and the Titan redesign address the findings. https://walletinsights.io/en/security-incidents/trezor-one-glitching-memory-readout-fixes-2019/ https://walletinsights.io/en/security-incidents/trezor-one-glitching-memory-readout-fixes-2019/ Wed, 06 Mar 2019 12:00:00 GMT Hardware attack An attacker with physical access to a Trezor One on firmware older than 1.8.0 could read the seed from memory unless a passphrase was set. Trezor fixed them in Trezor One firmware 1.8.0; the Model T was not directly affected and received the same protections in 2.1.0. https://walletinsights.io/en/security-incidents/ledger-wallet-fail-35c3-nano-s-blue-attacks-2018/ https://walletinsights.io/en/security-incidents/ledger-wallet-fail-35c3-nano-s-blue-attacks-2018/ Thu, 27 Dec 2018 12:00:00 GMT Hardware attack An attacker with physical access to a Nano S, combined with malware on the owner's computer, or one positioned within close radio range of a Ledger Blue during PIN entry, could undermine the device's protections in lab conditions. Ledger states the findings showed no practical vulnerability and that no seed or PIN was extracted from a stolen device. https://walletinsights.io/en/security-incidents/ledger-nano-s-mcu-verification-bypass-2018/ https://walletinsights.io/en/security-incidents/ledger-nano-s-mcu-verification-bypass-2018/ Tue, 20 Mar 2018 12:00:00 GMT Firmware vulnerability An attacker who handled a Nano S on firmware 1.3.1 or earlier, before delivery or after setup, could install firmware that controlled or captured the recovery seed. Devices on firmware 1.4.1 are not affected, according to Ledger. https://walletinsights.io/en/security-incidents/trezor-one-sram-seed-extraction-2017/ https://walletinsights.io/en/security-incidents/trezor-one-sram-seed-extraction-2017/ Thu, 17 Aug 2017 12:00:00 GMT Firmware vulnerability Someone with physical access to an opened Trezor One running firmware older than 1.5.2 could read its seed and PIN from RAM; passphrase-protected wallets were not exposed, according to the researcher's write-up. Trezor states the issue was fixed in 2017.