crackthe.net
Do you need a hardware wallet? What it protects against
What a hardware wallet protects against and what it does not, what Ledger's data leak and the Connect Kit attack showed, and how to use one safely.
Key points
- A hardware wallet keeps the keys to your cryptocurrency on a separate device. You confirm every transfer on its own screen.
- Malware on your computer cannot sign a transfer on its own. You can still be tricked into confirming one, or into giving away your recovery phrase.
- Coins you leave on an exchange depend on the exchange’s security. Coins in your own wallet are not touched when an exchange is hacked.
What a hardware wallet does
Whoever holds the private keys controls the coins. On an exchange, the exchange holds them for you. In a wallet app, the keys sit on a phone or computer that is online and can catch malware. A hardware wallet keeps them on a small device of its own. It signs transfers there, and you check the details on its screen before you confirm.
Ledger says the screen of its devices always shows the address a transfer really goes to: “what you see is what you sign.” BitBox tells users to compare the full address and the amount on the device screen with the payment they intend to make.
The two makers build their devices differently. Ledger stores the keys in a Secure Element chip. It says its operating system is only partly open to review, because its contract with the chip maker bars it from publishing the code that talks to the chip. BitBox runs open-source firmware on a microcontroller and adds a separate secure chip that, it says, never receives the keys. Anyone can build its firmware from the published source and compare the result with the official release. BitBox adds that open source does not guarantee that every flaw is found.
What it does not protect against
Most thefts do not break the device. They trick its owner. Two cases from Ledger show how.
The customer data leak of 2020. In June 2020, an intruder got into Ledger’s e-commerce and marketing database. Ledger first counted about one million email addresses, and for 9,500 customers also names, postal addresses, and phone numbers. After the data was dumped on a forum in December 2020, Ledger said the details of about 272,000 customers had leaked. According to Ledger, the leak did not affect its devices or customers’ funds. It did lead to phishing by email and text message, and in 2021 to fake letters in Ledger’s name, mailed with a Ledger device and a fake guide that asked for the 24 recovery words.
The Connect Kit attack of December 2023. An attacker phished a former Ledger employee whose access to the npm code registry had never been revoked. On December 14, 2023, Ledger found that malicious versions of Ledger Connect Kit, a code library that crypto websites load, had been published there. Ledger says it released a fixed version within 40 minutes of noticing, and that funds were drained for less than two hours. On X, Ledger put the loss at about $600,000, taken from users who blind-signed: they approved transactions that the device could not show in readable form. Ledger says its devices and its Ledger Live app were not affected.
The rule both makers repeat: never type your recovery phrase into a computer, phone, or website. Ledger says there is never a good reason to type it into a computer. BitBox shows the words only on the device, never in its app.
CVE entries of Ledger and BitBox
A CVE entry is a public record of a security flaw. This archive counted the entries in the US National Vulnerability Database (NVD) that concern each maker’s own devices and software and were published since 2021:
| Tool | Own CVE entries since 2021 | Newest entry |
|---|---|---|
| Ledger | 3 | May 2026 |
| BitBox | 0 | – |
Do you need one?
It depends on where you keep your coins. A hardware wallet helps when you hold coins yourself and want the keys off devices that are online. It does not help with coins you leave on an exchange: there, the exchange’s security decides. Among the biggest attacks on this site are exchange thefts such as Bybit in 2025 and Binance in 2026.
How to use one safely
- Buy from the maker or one of its official resellers, and set the device up yourself.
- Write the recovery phrase on paper and keep it offline. Never type it anywhere but on the device itself.
- Check every transfer on the device screen: the full address and the amount. Approve only transfers you started yourself.
- Do not blind-sign. If the device cannot show what you are approving, stop. Ledger says blind signing is off by default but can be switched on.
- Ignore calls, texts, and letters that ask for your recovery phrase. Ledger says it never asks for the 24 words and never contacts customers by text message or phone call.
Next step
The page Hardware wallets compared shows Ledger and BitBox with the company and its country, open source status, the devices they work with, and their CVE entries.
The figures in this guide come from the archive and change with every data update. As of November 8, 2026.
Check it with the archive's data
Read next: Is a password manager safe? What protects your vaultAll guides