TL;DR. Tomorrow evening I debate Kim De Vos of the Alles voor Bitcoin podcast on whether hardware wallets deserve your trust. I sell them, so you should discount my words accordingly, which is exactly why I am publishing my position the evening before: so it cannot quietly change afterwards. The short version: nothing in Bitcoin is trustless, trust can only be minimized and made checkable; the worst hardware wallet failure in history was a seed generation bug that never touched users who supplied their own randomness; the losses outside dedicated signing devices are orders of magnitude worse; and the answer to failing vendors is open, stateless, verifiable signers, not a return to the laptop.
Start with the disaster
A seller is supposed to open with the good news. I want to open with the worst hardware wallet failure in Bitcoin's history, because if my case cannot survive it, I have no case.
On July 30, 2026, coins started leaving Coldcard wallets that had never touched the internet. The cause was a build configuration bug from March 2021: a flag check tested whether a macro was defined instead of whether it was enabled, and the firmware silently fell back from the hardware random number generator to a weak software one. Seeds that should have carried 256 bits of entropy carried a small fraction of that, cheap enough to search by brute force. The bug shipped in open source firmware and sat there, in public, for over five years. Estimates of the damage run from roughly $88 million to over $130 million, depending on whose tracing you read. The primary sources are worth your time: Coinkite's advisory, Block's root cause analysis, and Wizardsardine's deep dive.
No excuses fit here, so I will not offer any. Open source did not catch it for five years. Reproducible builds faithfully reproduced the bug. People who did everything they were told lost everything they had. If the case for signing devices rested on "the vendor is competent", the case died on July 30.
But look closely at what failed and what held, because the details carry the whole argument. What failed was seed generation: the moment where the device invents your key. What held was everything else. Users who fed the device their own entropy, dice rolls counted out on a table, were immune by Coinkite's own analysis. Multisig wallets survived untouched: not one was drained, because a quorum of devices does not fall to one device's weakness. And the root cause was public within a day of the thefts, because the code was there for anyone to read.
The lesson is not "hardware wallets failed, go back to the laptop". The lesson is: never consume vendor randomness blind, and never let a single component be fatal. Both of those are practices, and both were available, for free, to every victim. That is the uncomfortable, useful truth of the worst month this industry has had.
Nothing is trustless
The debate poster says one of us trusts too much and the other has escaped trust. That framing is wrong, and it is wrong in a way cypherpunks have understood for decades.
Nick Szabo's formulation was never "eliminate trust". It was that trusted third parties are security holes, to be minimized by careful design. Ken Thompson went further in 1984: you cannot fully trust any code you did not create yourself, down through the compiler that compiled your compiler. Reflections on Trusting Trust is three pages long and it closes every escape route: the regress does not bottom out for my signing device, and it does not bottom out for your laptop, your browser, your operating system's weekly updates, or the management engine inside your CPU.
So "don't trust, verify" cannot mean "achieve zero trust". Nobody has ever done that, and nobody ever will. It has to mean something practical: how little trust, how visible, and how checkable by you? Verification is not a purity test you pass once. It is a practice, and the only honest question about any custody setup is how much of it the practice can reach.
Put the two candidates side by side. A stateless signer like a SeedSigner runs a firmware image of a few dozen megabytes, built reproducibly from pinned sources, on commodity parts you can buy anywhere, with no radio, no persistent storage, and no company that has to stay honest or even stay alive. Your laptop runs tens of millions of lines of code across an OS, a browser and its extensions, and drivers, silently updating every week, connected to the internet by design. Neither is trustless. One of them is small enough that verification can actually get its arms around it. That asymmetry is the entire argument, and no incident of 2026 touched it.
And this is not some merchant's revision of cypherpunk history. Hal Finney built RPOW, the direct precursor of Bitcoin's ideas about verifiable money, on a dedicated tamper-resistant coprocessor running publicly attestable code, on the explicit assumption that even the machine's operator was the enemy. Dedicated, verifiable hardware is not a betrayal of the ethos. It is one of its founding moves.
What the loss data says
Zoom out from any single incident and count everything. Chainalysis puts 2025 at $3.4 billion stolen in total, with $713 million of it taken from personal wallets, overwhelmingly hot wallets on general-purpose devices. Add history's ledger: the exchanges that vaporized customer funds, from Mt. Gox to FTX; the browser extensions and fake apps; the infostealers that grep disks for wallet.dat and seed screenshots; the cloud password vaults that turned one company's breach into years of individual drainings; the clipboard malware that Microsoft found carrying over fifteen thousand substitute addresses.
And the entropy bug class that Coldcard just made famous? It is not a hardware disease. Milk Sad, Randstorm, Trust Wallet, Cake Wallet: the notorious weak-randomness disasters of the last decade were software wallets on general-purpose machines. The problem follows the practice of trusting someone else's randomness, wherever it runs. Meanwhile human-invented secrets fared worst of all: academic sweeps of brainwallets found nearly all of them drained.
Here is the detail I would put on a billboard: no research firm publishes a line item for "stolen remotely from a properly used offline signing device". Not because they are shy, but because there is almost nothing to put in it. The one mass hardware event on record was a key generation bug, and the users who followed the practice this whole post is about walked away whole.
One more number pair, because it shows the mechanism rather than the outcome. When the biggest supply-chain attack in npm's history hit packages with around two billion weekly downloads in September 2025, the total reported theft was a few hundred dollars, largely because wallets that force address confirmation on an independent screen made the payload useless. When Bybit lost $1.5 billion in February 2025, the signers were using hardware, but they approved what a poisoned web interface showed them instead of what the device could have shown them. The screen on the signer is the last pixel that host malware cannot paint. It only protects the people who look at it.
What I sell, and what I refuse to
Now the part where you should be most suspicious of me, so let me say it before anyone else does: I have a commercial interest in this debate. I run a shop that sells signing devices. Kim does not sell hardware, and he will rightly point at that difference.
So here is the honest version. I do not love selling hardware. Assembling and packaging devices is repetitive work with thin margins, and nothing about it is intellectually satisfying. I do it because people kept asking me what to buy and how to use it, and because a device you can stand behind is a necessary component of getting real people to real self-custody. If all you take from this post is "discount the seller's words and verify his claims instead", I will consider that a win, because every claim in here is checkable without trusting me.
What I actually sell is narrower than "hardware wallets". I am, if anything, a SeedSigner maximalist. It is open source, stateless, and forgets everything at power-off; it holds no secrets at rest, has no radio, takes your own dice rolls as a first-class input, and builds from reproducible sources on commodity parts. I published a step-by-step verification walkthrough, and I put the actual firmware in your browser so you can try every flow, and verify my build against upstream, before you give me or anyone else a cent. I sell it preassembled today, and DIY kits are coming for the next version, because building it yourself is the strongest form of the argument. There are other devices I respect: Foundation's Passport, and Trezor's latest with its open-source secure element, a chip that has already survived public adversarial lab attacks precisely because it could be attacked openly. Where a device piles on features, my interest drops; a signer should sign.
And the other side of curation: I used to be an official reseller of BitBox, Keystone and the budget Jade, and I stopped carrying all three. They are not scams, but they repeatedly fell short of the bar I want to defend in public, and a shop that cannot fire products is doing marketing, not curation. When something I sell fails, as Coldcard's users just experienced from their vendor, you should expect me to say so by name, in a post like this one.
It is not the tools, it is how you use them
It is not about owning the right tools. It is about using them correctly.
That sentence is the center of my position, and July 30 proved both halves of it at nine-figure scale. Owning a Coldcard did not save the people who let it invent their seed. Using the same device correctly, with private dice entropy or inside a multi-vendor quorum, saved everyone who did it. The practice, in order of effort:
- Bring your own entropy. Dice or cards on your own table, fed into an open signer. Never trust a black box, mine included, to invent your key, and never type entropy into a website or an app.
- Verify what you run. Reproducible builds exist so that a stranger's firmware can be checked against public source. My walkthrough takes an afternoon. You do it once per firmware, and you never have to believe me again.
- Verify what you sign. Every address, on the device's own screen, every time. This is the habit that turns the independent screen from a spec-sheet feature into an actual defense.
- Above a serious amount, remove single points of failure. Multi-vendor multisig is the same engineering that keeps airliners in the sky: dissimilar components, so no single bug is fatal. It is my core offer for serious holdings, and I will also say plainly: it is not for everyone. It demands understanding, and a badly run multisig is worse than a well run single signer. It has also become dramatically easier than its reputation, which was earned years ago and has not been updated since.
Does the DIY path add its own failure modes? Yes: wrong image downloaded, unverified SD card, plain user error. That is not an argument against verification; it is the reason verification tooling and guidance have to exist. It is why I run the walkthrough, the simulator, and a private test network where mistakes cost nothing. The alternative to a hard practice is not an easy practice. It is no practice, on a laptop, with the base rates above.
AI arms both sides. It arms open code more.
Looking forward, both halves of this fight get AI. The attack half is already here: model-written phishing, deepfaked support calls, drainer kits sold as subscriptions, malware that adapts. Every one of those lands first and hardest on general-purpose, connected devices, because that is where the surface is.
The defense half is newer, and it points the other way. This month the Bitcoin Red Team ran AI-assisted audits across roughly 390 open-source Bitcoin repositories in a weekend and surfaced thousands of raw findings. Two things about that matter here. Dedicated signing devices came out with among the lowest shares of serious findings of any category they scanned. And the sweep was only possible at all because the code was open. AI auditors, like human ones, can only defend what they can read. Closed firmware donates the attack half of AI to its enemies and gets nothing back. Open, reproducible firmware gets both halves. That gap will keep widening, and it widens in favor of exactly the devices this post defends.
Come disagree with me
Kim and I agree on more than the debate format suggests. He insists that verification must be something you can do personally, with your own eyes and hands, and he is right. He distrusts vendor promises, and after 2026, so should everyone. Where we differ is what follows from that: I think the trust-minimizing move available to a normal human is a small, open, verifiable signing device used correctly, and I think the loss data of the last decade is on my side of the table.
The debate is tomorrow evening, at a Bitcoin meetup, unrecorded, first speaker by coin toss. This post is the position I will defend, published beforehand on purpose. If I lose an argument on the night, the honest fix will be a visible update here, not a quiet edit.
Published August 20, 2026, the evening before the debate. Every factual claim above links to a source that does not depend on me. If you find an error, in the numbers or the reasoning, tell me: being corrected in public is the practice this whole post is about.