Wallet and exchange security watch

Verdict

Advanced users only, new seeds only

Minimum firmware

Current 5.6.3 / 1.5.3Q (fix first shipped in 5.6.0 / 1.5.0Q)

Last checked

Oct 17, 2026

• A firmware RNG integration error produced weak seeds; affected seeds were brute-forced offline and thefts began July 30, 2026. The devices were not remotely hacked.
• Galaxy Research's latest count (Oct 16, 2026): more than 1,830 BTC has been swept from more than 9,000 addresses. Earlier counts: 1,778.84 BTC from 8,600+ addresses (Aug 14) and about 1,789 BTC from 8,865 addresses (Aug 25).
• Updating firmware does not repair an existing seed. Make a new seed on fixed firmware and move funds.
• Oct 11, 2026: an unauthorized phishing post appeared on COLDCARD's official X account and was deleted. COLDCARD warned on X not to visit or interact with the link, said its only official website is coldcard.com, and asked X to investigate. Never "migrate" funds through a link in a post.
• Mk2/Mk3: final firmware 4.2.0; not recommended for new use.

Coinkite advisoryCOLDCARD security statusCOLDCARD migrationCOLDCARD downloadsGalaxy Research (Oct 16, 2026)Galaxy Research (Aug 14, 2026)Cointelegraph (Aug 25, 2026)BlockSec analysisCointelegraph: X phishing post (Oct 11, 2026)COLDCARD on X (@COLDCARDwallet)

Verdict

We don't recommend Ledger for bitcoin-only self-custody right now. If you use one anyway, buy only direct from ledger.com, treat any device that arrives already set up or with a printed seed as compromised, never restore an existing seed onto a device you didn't buy direct, and update only through the official Ledger Wallet app

Minimum firmware

Latest firmware

Last checked

Oct 17, 2026

• Oct 2026: criminals fitted cellular implants into genuine Ledger devices to capture seeds during setup. Galaxy Research says they were sold through CryptoBilis, which Ledger's own site listed as an authorized reseller for Indonesia, Malaysia and the Philippines; even authorized resellers can be compromised. Ledger says the secure element, OS and servers were not compromised.
• Oct 15, 2026: Ledger asked sellers across Asia, including Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, to halt sales during the investigation.
• Oct 13, 2026: MediaMarkt pulled Ledger devices in Germany as a precaution.
• Anyone who set up a device bought through an affected channel should move funds to a new device and a new seed.
• Oct 15, 2026: Ledger said devices spot-bought from stores in Germany and samples from warehouses were all clean. New partner rules: no Ledger products on shelves or as display stock, and returned devices can never be resold.
• Oct 16, 2026: SlowMist warned of fake firmware-update phishing pages mimicking Genuine Check and Update Now to steal recovery phrases. Update only in the official Ledger Wallet app; never enter your seed on a website.
• Oct 16, 2026: Galaxy Research counted roughly $91 million taken from 474 victim addresses across bitcoin, Ethereum, Arbitrum, Polygon and TRON, including 213 BTC from 279 bitcoin addresses. Galaxy calls its count a floor (a minimum estimate); Ledger has not published loss totals and describes the volume as "limited." Independent teardowns have found at least three generations of the implant. Some victim addresses date to 2021, consistent with existing seeds being restored onto tampered devices: restoring an old seed onto a tampered device exposes it too.

Ledger response (Oct 15, 2026)Galaxy Research (Oct 16, 2026)Ledger Wallet app (official)BleepingComputer: Asia sales haltBleepingComputer: implant confirmedCoinDesk (Oct 13, 2026)Cointelegraph: MediaMarktSlowMist on X (Oct 16, 2026)The Crypto Times: fake update pages

Verdict

Recommended, PIN always set

Minimum firmware

2.12.5+

Last checked

Oct 17, 2026

• Several 2025–26 issues (a BIP-39 side channel on unlocked devices, a multisig verification bug, an SD-protect lock bypass) are resolved in current firmware per Trezor's disclosures and changelog.
• Model One is not recommended for new buyers.
• Oct 2026: as a preventive step, Trezor is ending reseller authorizations effective Jan 1, 2027. Trezor says there is no evidence its devices were compromised. Buy direct from trezor.io.
• Sep 9, 2026: an attacker used Trezor's account at Brevo, its third-party newsletter provider, to send a phishing email with the subject "Critical Security Alert: STM32 Entropy Vulnerability" that pushed an app asking for the wallet backup. Brevo confirmed 347,149 newsletter email addresses were exported. Trezor says no Trezor product, wallet or account system was affected, and that it will never ask for your wallet backup.

Trezor firmware changelogTrezor: multisig verification bugTrezor: lock bypassENISA EUVD-2026-46400Decrypt: Trezor cuts resellersTrezor: Brevo incident (Sep 10, 2026; updated Sep 17)

Verdict

Recommended (Bitcoin-only edition preferred)

Minimum firmware

9.26.5+

Last checked

Oct 16, 2026

• 9.26.5 fixed a bootloader issue, a memory-corruption issue on unconfigured Multi editions, and a Silent Payments flaw. BitBox reports no exploitation.

BitBox02 firmware 9.26.5 releaseBitBox blogcrypto.news

Verdict

Recommended

Minimum firmware

1.0.41 (1.0.38 absolute minimum)

Last checked

Oct 16, 2026

• A 2025 stack overflow was fixed in 1.0.37 with anti-rollback in 1.0.38.
• Blockstream states Jade is not affected by the COLDCARD RNG issue.

Blockstream: Jade security disclosureBlockstream: Jade unaffectedJade changelog

Verdict

Recommended desktop coordinator

Minimum firmware

2.5.5+

Last checked

Oct 16, 2026

• 2.5.4 and 2.5.5 shipped review-driven hardening fixes. Verify the signed manifest before installing.

Sparrow releasesDecrypt

Verdict

Recommended for merchants on current version

Minimum firmware

2.4.5+

Last checked

Oct 16, 2026

• Versions before 2.4.2 let unauthenticated attackers fetch LND macaroons; this was exploited. On-chain wallets were not affected.
• Do not expose the LND API. If you ran LND before 2.4.2, rotate macaroons.

BTCPay advisory 2.4.2BTCPay 2.4.4BTCPay 2.4.5The Defiant