Hardware wallet security incidents
A sourced log of incidents that matter to owners, with what to do. Severity is our label: critical = funds stolen or at risk without physical access; high = remote or user-facing risk such as phishing; medium = vendor urges an update; low = lab-only physical attack.
medium Blockstream Jade 1.0.41: 'important security updates', all users urged to upgrade
Jade firmware 1.0.41's changelog says the release contains important security updates and that all users should upgrade as soon as possible. It credits outside researchers for reported issues, adds stack protection and extra per-device entropy, and bumps the secure version to block downgrades.
What to do: Update Jade / Jade Plus to 1.0.41 or later.
Sources: Jade CHANGELOG (Blockstream, GitHub)
critical COLDCARD firmware bug produced weak seeds; funds stolen
Coinkite's advisory says COLDCARD firmware released from 2021 to July 2026 had a bug that produced poor entropy during seed generation. Attackers regenerated the affected private keys offline and stole funds; the devices themselves were not remotely accessed.
What to do: Install fixed firmware (Mk4/Mk5 5.6.0+, Q 1.5.0Q+, Mk2/Mk3 4.2.0+, Edge 6.6.0X/6.6.0QX+), then generate a NEW seed and move funds. Updating alone does not repair an existing affected seed. Coinkite's guidance has an exception for seeds made with at least 50 private, independent dice rolls.
Sources: COLDCARD Security Status (Coinkite) · Coldcard Security Advisory, Jul 30 2026 (Coinkite blog) · Firmware ChangeLog advisory (GitHub)
low Laser fault injection on TROPIC01 secure element (Trezor Safe 7)
Ledger Donjon showed that laser fault injection can bypass firmware signature checks on the TROPIC01 chip, one of the secure elements in the Trezor Safe 7. It needs physical possession, desoldering, decapsulation and lab equipment, and must be repeated on every power-up. Trezor says it does not expose the PIN or funds; Tropic Square rated it CVSS 5.7 (medium) and shipped firmware mitigations.
What to do: No user action required per Trezor. A strong passphrase adds protection if a device is stolen.
Sources: Ledger Donjon write-up · Trezor response · Tropic Square advisory
low Voltage glitch bypasses Trezor Safe 3 authenticity/firmware check
Ledger Donjon showed that the Safe 3's microcontroller can be voltage-glitched to bypass its firmware-integrity and authenticity check. It needs full physical access and repackaging; Trezor says private keys and PIN cannot be extracted this way and that Safe 5 is not affected.
What to do: Buy only from trezor.io or authorized resellers. Keep firmware current.
Sources: Trezor vulnerability page · Ledger Donjon analysis
high Ledger Connect Kit supply-chain attack (web library, not devices)
An attacker phished a former Ledger employee's NPM account and published malicious Ledger Connect Kit versions 1.1.5 to 1.1.7, which drained funds from users signing transactions on affected web dApps. Ledger says devices and Ledger Live were not affected; fixed version 1.1.8 shipped the same day.
What to do: No device action. Read what your device shows before signing; avoid blind signing.
Sources: Ledger Security Incident Report
high Ledger e-commerce and marketing database breach (customer data, ongoing phishing)
Ledger disclosed that its e-commerce and marketing database was breached, exposing customer contact details. Devices and funds were not compromised, but the leaked data still fuels phishing emails, texts and fake 'replacement device' mail.
What to do: Never type your recovery phrase anywhere a message tells you to. Ledger will never ask for it.
low Kraken Security Labs extracts encrypted seed from Trezor One / Model T by voltage glitching
Kraken Security Labs showed that with about 15 minutes of physical access and specialised equipment, the microcontroller in Trezor One and Model T can be glitched to read out the encrypted seed. It is a hardware flaw that firmware cannot fix.
What to do: Use a strong BIP-39 passphrase on these models, which protects funds even if the seed is extracted.
Sources: Kraken Security Labs · Trezor response