Two recent hardware wallet incidents in the industry have drawn everyone's attention:
One is Coldcard, a long-established Bitcoin wallet, and the other is Ledger, which has the highest market share.
The former had a firmware vulnerability in its seed generation process, while the latter had its supply chain quietly tampered with.
Combined, the losses from the two incidents amount to hundreds of millions of US dollars.
But I want to state a conclusion first: neither of these two incidents involved a breach of the BIP protocols themselves.
The so-called BIPs are a set of technical standards established by the Bitcoin community, and virtually all hardware wallets operate in accordance with them.
The protocols were not breached, which means the problem lies elsewhere, and where exactly the problem lies determines one thing: whether your losses should be borne by yourself or whether you can assert claims against the manufacturer.
I. First, let us understand the underlying chain of derivation
Hardware wallets on the market are almost all HD (hierarchical deterministic) wallets, and their core logic is:
A single set of mnemonic words derives all of your private keys and addresses.
The complete asset derivation chain:
Mnemonic words → seed → master extended private key (xprv) → Key tree → child private key → child public key → address
A mnemonic phrase is the only material that an ordinary user can back up and safeguard. A hardware wallet first generates raw random entropy internally and then converts it into a mnemonic phrase; when restoring a wallet, the seed is derived in reverse from the mnemonic phrase to reconstruct the entire key tree.
Therefore, once the mnemonic phrase is leaked, all assets are at risk unless an additional Passphrase is set.
However, the BIP standards carry a risk: a parent extended public key plus any ordinarily derived child private key can be used to reverse-calculate the parent extended private key, which means all of your assets are at risk of theft.
Accordingly, compliant hardware wallets apply hardened derivation at the account level, coin level and purpose level (to prevent reverse calculation of the parent private key), thereby isolating the risk.
II. Which link in the recent hardware wallet incidents went wrong
Coldcard: Is your mnemonic phrase really generated "randomly"?
In March 2021, a code migration by Coldcard introduced a bug:
The condition in the program for determining whether the hardware random number generator was enabled was written incorrectly; the configuration text remained, but the hardware true random source had in fact been disabled, and the system instead used a predictable software pseudorandom number generator to generate the seed.
This caused a substantial drop in the entropy security level: an attacker who obtained the device chip identifier could, using an ordinary computer, exhaustively enumerate all possible seeds within a short time, without any need to come into contact with your hardware device and without any need to induce you to click a link.
This flaw lay dormant in the code for five years, until it was exploited on a large scale by hackers on July 30, 2026.
However, publicly available information indicates that two categories of users were largely unaffected: users who generated their own high-entropy mnemonic phrases using dice and users who additionally configured a strong Passphrase.
Ledger: The device had already been tampered with before it reached your hands
In this incident, the Ledger security chip itself was not compromised, and there is no evidence-level vulnerability in the cryptographic design. The real risk came from the distribution channel: authorized resellers listed on the official website modified devices without authorization.
In October 2026, Ledger announced and confirmed that some devices originating from the Southeast Asian authorized reseller CryptoBilis had been implanted with an unauthorized hardware module. The function of this module was simple:
When the user initialized the wallet and the screen displayed the mnemonic phrase in plaintext for the user to copy down, it read the mnemonic phrase and transmitted it externally via a cellular network.
The mnemonic phrase needs to be displayed in plaintext on the screen for the user to copy down; this is a necessary process under BIP and is not a design defect. The security chip can protect key storage, but it cannot prevent the mnemonic phrase displayed on the screen from being stolen by external hardware.
According to estimates by on-chain analysis firms, the losses in this incident were approximately USD 86 million to USD 93 million, with hundreds of wallets affected, spanning multiple public blockchains including BTC, ETH and TRON.
In the vast majority of coin losses, the problem lies in the user's custody practices
In reality, the vast majority of asset losses are in fact unrelated to manufacturer vulnerabilities.
The mnemonic phrase is photographed and stored in a mobile phone, then synced and uploaded to iCloud;
The mnemonic phrase and the Passphrase are written on the same metal card and stored together;
When setting the Passphrase, extra spaces are mistakenly entered, and upon restoring the wallet the user sees an empty address and mistakenly believes the assets have been stolen...
In this type of incident, there is no external hacker breaching the device.
In self-custody mode, key material is controlled by the user; losses caused by improper safekeeping are, in principle, borne by the user, which is inherent in the definition of self-custody itself.
With respect to firmware vulnerabilities and supply-chain tampering, there is room for discussion regarding claims against the manufacturer; whereas where losses result from safekeeping errors, the consequences are primarily borne by the user.
III. Passphrase: The Second-Layer Password — Who Bears the Risk?
A Passphrase, commonly known as the "25th word," is not part of the original 12/24 mnemonic words; it is a second-layer password that the user additionally sets on a customized basis.
The same set of mnemonic words, paired with different Passphrases, will generate two completely isolated and mutually unrelated wallet accounts.
Capitalization and spaces are all case- and character-sensitive; if a single character is wrong, what opens is an entirely new empty wallet. Many users encounter this for the first time and their first reaction is that their assets have been stolen; only after investigation do they discover that Caps Lock was on when they enabled the Passphrase back then, or that they typed an extra space.
Safekeeping responsibility rests with the user: the Passphrase is set and kept by the user, the manufacturer does not store it and has no way to help you recover it; once forgotten, the loss is borne by the user.
The manufacturer's statutory obligation is to provide adequate risk disclosure and must clearly warn that "forgetting it will make it impossible to recover the assets."
If a product gives no warning at all about the risks of this function, there is in theory room to assess it as having disclosure defects.
IV. How to Determine When a Problem Arises with a Hardware Wallet
When you encounter a loss of assets in a hardware wallet, do not rush to blame any one party; proceed in four steps:
1. Identify the stage at which the failure occurred: Distinguish whether the problem lies in the protocol, seed generation, mnemonic display, key derivation, or user key custody. The Coldcard incident is a seed-generation defect; the Ledger modification incident is a leak at the mnemonic display stage; a photograph backup of the mnemonic is a custody problem. If the stage is misidentified, the subsequent liability analysis will inevitably be wrong as well. 2. Verify whether the wallet complies with prevailing BIP industry standards Focus on whether the account layer is hardened, as this is the basis for determining whether the manufacturer has fulfilled its duty of care. 3. Verify whether the risk-disclosure obligation has been adequately fulfilled In particular, risks relating to the Passphrase and key derivation must not be buried deep in a lengthy manual.4. Assess whether you yourself were at fault in key custody
V. Practical Recommendations
First, purchase through official channels as a priority.
Avoid second-hand purchases and purchasing through agents as far as possible;
The lesson from this incident: even an authorized dealer does not equate to absolute safety.
Second, inspect the device's condition upon unboxing.
Any device that has been pre-initialized and comes out of the box with a printed mnemonic phrase should be returned directly and must never be used.
Third, store the mnemonic phrase and the Passphrase separately in physical locations; do not photograph them, do not upload them to the cloud, and do not enter them into any webpage or software.
Fourth, think carefully before enabling a Passphrase.
If forgotten, it can never be recovered. If you do not have the conditions for long-term secure safekeeping, it is not advisable to enable it rashly; it can defend against attackers, but it can equally lock you out.
Fifth, focus on two points when selecting a model:
whether the firmware update mechanism is open and transparent, and supply chain security control measures.
