Crypto Wallet Security in 2026: Hardware, Software and Common Mistakes

The threat landscape has changed

Chainalysis counted about $2.2 billion stolen in crypto hacks in 2024, across 303 incidents, and found that compromised private keys accounted for the largest share of stolen funds (43.8%). Its report for 2025 counted "over $3.4 billion in theft from January through early December 2025", with the February compromise of Bybit alone accounting for $1.5 billion, and found that personal wallet compromises made up 20% of all value stolen, with unique victims rising from 40,000 in 2022 to at least 80,000 in 2025 (Chainalysis, December 2025).

For individual holders, the attacks that get keys or logins are the familiar ones: phishing emails impersonating Ledger, MetaMask and Coinbase support; fake browser extensions; and SIM-swap attacks targeting SMS 2FA. Two newer ones skip the keys entirely: address poisoning, where you copy a look-alike address from your own history, and forgotten token approvals, where a contract you once approved spends your tokens later.

Understanding what you are actually defending against is the foundation of a security strategy.

The custody spectrum

Full self-custody (hardware wallet): You hold your private keys. Nobody can freeze, seize or lose your crypto. The risk is entirely your own: lost seed phrase = lost crypto.

Partial self-custody (software wallet): MetaMask, Trust Wallet, Phantom. Keys stored encrypted on your device. Convenient for DeFi and NFTs, but the device is online, so keep only spending money there.

Custodial (exchange): Binance, Coinbase hold the keys. Convenient, but you are trusting their security, solvency and regulatory compliance; if the company fails you are a creditor, as our guide to what happens if an exchange collapses explains. For the trade-offs in more depth, read hot wallet vs cold wallet.

Hardware wallets compared

Ledger Nano X: Bluetooth (convenient, slightly larger attack surface) and a secure element certified CC EAL5+. Ledger lists 500+ crypto assets supported in its own app, and thousands more through third-party wallets. Know its history: in July 2020 Ledger's e-commerce and marketing database was breached. Ledger's own notice says the data was "mostly the email address of our customers, approximately 1M addresses", and that for "a subset of 9500 customers" names, postal addresses and phone numbers were also exposed; it states that "crypto funds are safe" and the breach had no link to its hardware wallets (Ledger). That data still fuels phishing aimed at Ledger owners.

Trezor Safe 5: Open-source firmware, a touchscreen and, in Trezor's own description, an EAL6+ secure element; Trezor says it manages thousands of coins and tokens. Excellent for users who value auditability over convenience.

Coldcard: Bitcoin-only, air-gapped signing. For Bitcoin holders managing significant amounts who want the device never to touch a computer.

Tangem: a card or ring that you tap against your phone's NFC reader to sign; by default it backs up across several cards instead of a 12-word phrase, with a seed phrase optional (Tangem). See Tangem and compare it with the others in our best crypto wallets guide.

The seed phrase: what it protects, with the arithmetic

Your 12 or 24-word recovery phrase is the master key to every account the wallet derives. The BIP-39 standard that most wallets use maps 128 bits of randomness (plus a 4-bit checksum) to 12 words and 256 bits (plus an 8-bit checksum) to 24 words, each word being one of 2,048 (BIP-39).

Worked example. A 12-word phrase carries 128 bits of randomness, which is 2^128, about 3.4 x 10^38 possible phrases. A hypothetical attacker testing one trillion phrases a second would need about 3.4 x 10^26 seconds, roughly 10^19 years, to try them all. Guessing is not the threat. Every real loss of a properly generated phrase comes from someone seeing it, photographing it, or being persuaded to type it in.

BIP-39 also allows an optional passphrase that is mixed into the seed. The standard notes that every passphrase produces a valid wallet, so a typo does not show an error: it silently opens a different, empty wallet. If you use one, record it as carefully as the words, and stored separately from them.

Treat the phrase accordingly:

• Write it on paper in permanent ink and store it in a fireproof location
• Never store it digitally: no photos, no cloud, no email, no password manager notes
• Consider a steel backup (Cryptosteel, Bilodeau) for fire and flood resistance
• Never enter it anywhere online; a hardware wallet asks for it only on its own screen during recovery
• Never share it with anyone calling themselves "support"

The attack you are most likely to face

Fake Ledger recovery emails: "Your Ledger account has been compromised, recover your wallet here." The link leads to a site that collects your seed phrase. Ledger states that it "will never ask you for the 24 words of your recovery phrase" (Ledger). Nobody legitimate will.

The same pattern runs through every successful scam: urgency ("your funds will be frozen"), an authority you recognise, and a request to type the phrase or approve a transaction. When all three appear together, stop.

A security checklist you can finish in an afternoon

1. Move long-term holdings to a hardware wallet, starting with a small test transfer; our tutorial on setting up a crypto wallet walks through it.
2. Write the recovery phrase on paper, check it by doing a recovery on the device before you deposit anything significant, and store it away from the device.
3. Replace SMS two-factor authentication on every exchange account with an authenticator app or a hardware security key.
4. Bookmark the real sites of your exchange and wallet, and only ever arrive through the bookmark.
5. Review and revoke old token approvals on any wallet you have used for DeFi.
6. Before every send, check the first and the last several characters of the address against the source, not against your transaction history.

Frequently asked questions

What is the most common way crypto gets stolen? Chainalysis found that compromised private keys accounted for the largest share of crypto stolen in hacks in 2024 (43.8% of about $2.2 billion). For individuals, keys and logins are most often lost to phishing emails impersonating Ledger, MetaMask or Coinbase support, fake browser extensions, and SIM-swap attacks on SMS-based two-factor authentication.

How should a seed phrase be stored? Write it on paper in permanent ink and store it in a fireproof location, away from the device. Never store it digitally, such as in photos, cloud storage or email, and consider a steel backup for added fire and flood resistance.

Can someone guess my 12-word seed phrase? Not in practice. A BIP-39 12-word phrase encodes 128 bits of randomness, about 3.4 x 10^38 possibilities; even at a trillion guesses a second, trying them all would take roughly 10^19 years. Phrases are lost by being seen or typed into a fake site, not by being guessed.

What is the difference between full self-custody and a custodial wallet? With full self-custody on a hardware wallet you hold your private keys, so nobody can freeze or seize your crypto, which makes it best for long-term holdings. With a custodial exchange wallet, Coinbase or Binance hold the keys, which is convenient for trading funds but means trusting their security and solvency.

Will Ledger or any wallet company ever ask for my recovery phrase? No. Ledger states that it will never ask for the 24 words of your recovery phrase, and no legitimate wallet maker, exchange or support agent needs it. Any message that asks for it is a scam.

The bottom line

Keep long-term coins on a hardware wallet, keep the recovery phrase offline and private, and treat any request to type it or to approve an unexpected transaction as an attack. For the steps in order, follow how to move crypto to self-custody.

Capital at risk. This is general information, not financial advice.