None of us are safe in crypto anymore 👨‍💻 One morning, we could wake up to find that hackers have stolen everything we own. Previously, people would say, “Just buy a hardware wallet (usually Ledger) and you’re fine.” But now, even those aren’t trustworthy. Here are two major hardware wallet attacks that occurred in 2026: 1. Coldcard Firmware Vulnerability ($130M hack) - This was the biggest technical disaster in the hardware wallet space. Attackers didn’t touch the device or know the seed—because the seed was predictable from the start. - A coding flaw introduced in firmware 4.0.1 in March 2021 caused devices to use MicroPython’s weak software PRNG, called Yasmarang, instead of a true hardware RNG. All seeds generated between March 2021 and July 2026 were at risk. 2. Ledger / CryptoBilis: Supply Chain Implant ($90M hack) - CryptoBilis, an authorized distributor based in Malaysia, was sold in March 2026 to a Chinese buyer, who forced the previous owner to sign an NDA. - The new owners modified Nano X devices by secretly embedding a hidden card beneath the screen, containing an LTE modem and eSIM. The displayed seed was exfiltrated via cellular data. Ledger’s authenticity checks failed because the chip was genuine. - Former Mt. Gox CEO Mark Karpelès exposed the incident by publishing photos of the implant.