A hardware wallet is a dedicated device whose only job is to hold private keys offline and sign transactions without exposing those keys to a general-purpose computer — a "user interface for the seed phrase," in Unchained's framing. Physical destruction of the device is not a loss event as long as the seed backup is intact; loss of the seed backup is catastrophic regardless of device security. The 2026 mainstream landscape spans roughly seven devices, each fitted to different operational profiles: Coldcard Q, Foundation Passport, Trezor Safe 5, BitBox02 BTC-only, Blockstream Jade, Bitkey, and Ledger (treated separately given the 2023 Recover controversy — see Ledger considerations and tradeoffs). There is no "best" device, only fit-to-purpose, and for multisig setups the consensus rule is vendor diversity — devices from different manufacturers, so no single-vendor failure can compromise more than one key. The framework-level treatment lives here; per-device notes assess specific products.
Why this note matters
Hardware wallets are the operational endpoint of most self-custody decisions. The choice of which device to buy is sometimes treated as a brand-loyalty question (Coldcard vs Trezor partisans exist) when it should be a fit-to-purpose question. This note establishes the framework — the criteria the device should be evaluated against — and the comparative landscape as of 2026.
The note matters because:
- It corrects the “best hardware wallet” framing. There is no best device; there are devices that fit specific operational profiles. Evaluating against a checklist of criteria rather than against vendor reputation produces better decisions.
- It establishes vendor diversity as cheap insurance for multisig. A 2-of-3 or 3-of-5 multisig built with three identical Coldcards is structurally exposed to a single-vendor failure. Diversifying across vendors is the cheapest meaningful improvement available to a multisig setup.
- It anchors the per-device notes (Coldcard, Trezor, BitBox, Foundation Passport, Blockstream Jade, Bitkey, Ledger considerations and tradeoffs) — each of which assesses a specific product against the criteria established here.
What this is
A hardware wallet (more precisely: a hardware signing device) is a small dedicated computer that:
- Generates and stores BIP-39 seed phrases on internal secure storage
- Derives keys from the seed using BIP-32 (and BIP-39 passphrase if used)
- Receives unsigned or partially-signed transactions (typically as PSBTs)
- Displays transaction details (recipient address, amount, fee) on its own screen
- Asks the holder to confirm via physical buttons or touchscreen
- Signs the transaction internally and returns the signed result
- Never exposes the private keys to a network-connected machine
The structural value: the private keys exist only on the hardware wallet’s internal storage. Even if the host computer (phone, laptop) is fully compromised, the attacker cannot extract the keys — they can only attempt to deceive the holder into signing a malicious transaction. The hardware wallet’s screen and confirmation mechanism is the last line of defence against that deception.
”User interface for your seed phrase”
Unchained’s framing captures the right mental model: the hardware wallet is not the wallet. The seed phrase is the wallet. The hardware wallet is a tool that:
- Stores the seed securely (so the holder doesn’t have to keep it in a digital file)
- Signs transactions with the keys derived from the seed
- Provides a trusted display and confirmation surface
If the hardware wallet is lost, stolen, broken, or rendered obsolete: buy a new compatible device, restore from the seed backup, continue. The hardware wallet is replaceable. The seed phrase is not.
This framing has practical implications:
- Loss of the device alone is inconvenient, not catastrophic. As long as the seed is backed up, recovery is straightforward.
- The seed backup is the load-bearing artifact. The hardware wallet is scaffolding around it.
- Vendor lock-in is mostly avoidable. A seed generated on one device can typically be restored on another (subject to BIP-39 compatibility and the same passphrase, if any).
The exception: some vendor-specific configurations (Ledger’s Recovery service, vendor-specific multisig formats, proprietary derivation paths) introduce lock-in. Standard BIP-39 + BIP-84/86 setups avoid this.
When to use this
The hardware-wallet decision applies to anyone who has moved past Tier 0 phone-wallet usage. The relevant questions:
- For a first hardware wallet — the priorities are operational simplicity, learning the basics of seed handling and verification, and not being overwhelmed by features
- For an additional hardware wallet in a single-sig setup — typically for backup signing or for an air-gapped second device
- For multisig — vendor diversity becomes a primary criterion; the device must work with the chosen coordinator software
- For specific use cases (Lightning node signing, multi-account management, BIP-85 child wallets) — vendor support for the specific feature becomes the constraint
The synthesis recommendation: don’t optimize for the most-secure device on paper; optimize for the device whose features you will actually use and whose UX you can sustain.
The 2026 device landscape
| Device | MSRP | Connectivity | Best for |
|---|---|---|---|
| Coldcard Q | $249 | USB-C, NFC, QR (camera), MicroSD | Power users; strong multisig + BIP-85; full QWERTY keyboard. (Cheaper keypad Coldcard Mk5, ~$170, drops the keyboard/QR-scanner but keeps dual SE + MicroSD air-gap.) |
| Foundation Passport Prime | $349 | QR, microSD, NFC, Bluetooth (QuantumLink) | Multi-function security platform (Bitcoin + 2FA + passkeys + files, KeyOS apps); big touchscreen + keyboard; audited (Keylabs); 2-of-3 SLIP-39 keycard backup + BIP-39 export. Not strictly air-gapped (adds BT/NFC); reproducible builds not yet available. The classic $199 Passport (“Passport Core”) is discontinued — Prime is Foundation’s only current device. See Foundation Passport. |
| Trezor Safe 5 | $129 | USB-C, NFC | Native SLIP-39; colour touchscreen; mainstream UX. Line spans Safe 3 (129, touchscreen), Safe 7 ($249 flagship — dual SE incl. the auditable TROPIC01 chip + Bluetooth). See Trezor. |
| BitBox02 (BTC-only) | $137 | USB-C | Swiss engineering, open-source, minimalist; multi-vendor multisig |
| Blockstream Jade Core | $79 | USB-C, Bluetooth | Budget-conscious; good multisig; Unchained integration. No on-device camera (connects by USB/BT, not air-gapped QR). “Blind oracle” — no physical secure element. Premium metal Jade Plus ($149) adds a camera + battery. See Blockstream Jade. |
| Bitkey | $250 | NFC, USB-C (charging) | Non-technical, mobile-first; 2026 version adds an on-device touchscreen (verify transactions on-device — the original was screenless); fingerprint unlock; built-in 2-of-3 recovery |
| Ledger Nano family | 399 | USB-C, Bluetooth (some models) | Wide ecosystem support (Nano S Plus → Nano Gen5 → touchscreen Flex/Stax); see Ledger considerations and tradeoffs for the 2023 Recover controversy and its implications |
Prices and specs re-verified 2026-07-15 (Foundation row re-verified 2026-07-17) against each vendor’s own site. The landscape evolves; verify current details before purchasing. Notable 2026 changes: Foundation discontinued the classic 349 Passport Prime, a multi-function security platform (see Foundation Passport); Bitkey shipped a screened hardware revision; Blockstream refreshed the Jade line (added Jade Plus); Ledger added the Nano Gen5 and the touchscreen Flex/Stax.
The synthesis’s framing across these: each has a legitimate place; none is universally correct. Coldcard for the power user; Passport for the disciplined air-gap holder; Trezor for the holder who wants SLIP-39; BitBox for the multi-vendor multisig component; Jade for the budget-conscious or for the Unchained user; Bitkey for the non-technical holder who wants mobile-first; Ledger for the holder who already owns one and has read the considerations.
What to actually look for
Rather than chasing “the best,” evaluate candidates against criteria drawn from Lopp’s multisig performance testing, Blockchain Commons’ Smart Custody criteria, and practitioner consensus.
Air-gap capability
Can the device sign transactions without ever touching a network-connected machine? The spectrum:
- Strict air-gap (QR-only or SD-only) — Foundation Passport, Coldcard Q in air-gap mode, Coldcard Mk4 with MicroSD. The device never speaks to a network-connected machine; PSBTs travel via QR code or SD card.
- USB-connected functionally cold — BitBox02, Trezor, Ledger. The device is plugged into a computer for signing but the keys never leave the device. Security relies on the firmware’s discipline rather than physical separation.
- NFC or Bluetooth — Bitkey, some Trezor and Ledger configurations. Convenience at the cost of additional attack surface.
For most holders, USB-connected functionally-cold is structurally sufficient. Strict air-gap is appropriate for Tier 2+ holdings where the marginal protection is worth the workflow friction.
Open-source firmware
Can independent researchers audit the code? The Bitcoin-only open-source landscape:
- Fully open-source — BitBox02 BTC-only, Blockstream Jade, Trezor (entirely open-source firmware and hardware)
- Source-available — Coldcard (the firmware is published; the licence is non-OSI but the code is auditable)
- Closed-source — Ledger (the firmware and secure-element interface are not auditable)
Open-source firmware is structurally safer against undisclosed vulnerabilities — independent researchers can find and disclose flaws. Closed-source firmware requires trusting the vendor’s internal security practices. The synthesis treats open-source as a meaningful criterion but not a deal-breaker — Ledger remains in wide use despite the closed-source firmware.
Multisig support quality
Not all devices handle multisig equally. Lopp’s 2024 Multisig Hardware Signing Performance Report found that for 100-input transactions:
- Some devices fail entirely
- Some take nearly two hours to sign
- Others handle the same workload in seconds
For holders doing significant multisig signing (regular spending from a multisig wallet), signing performance matters. For holders who touch their multisig setup rarely, the difference is less critical.
The synthesis’s read: Coldcard, BitBox02, and Foundation Passport handle multisig well; Trezor handles it adequately; Jade handles it adequately with some quirks; Bitkey’s multisig support is limited; Ledger handles it well from a signing-speed perspective but the broader vendor considerations apply.
PSBT and descriptor support
Modern multisig requires PSBT (BIP-174) at minimum and ideally native descriptor (BIP-380) support. Devices that implement these well are easier to use across different coordinator software (Sparrow, Specter, Nunchuk, Casa, Unchained, Bitcoin Core).
All mainstream 2026 devices support PSBT well. Descriptor support is more variable — Coldcard, BitBox02, and Foundation Passport have the strongest implementations.
Vendor track record
How has the vendor handled past vulnerabilities? How quickly do they patch? Do they publish security advisories? Specific incidents to engage:
- Ledger 2020 customer-data leak — 270,000+ customers’ names, addresses, and phone numbers were exposed. This is a privacy event, not a wallet-compromise event, but it created a population of identifiable hardware-wallet holders that has fed downstream physical-attack risk.
- Ledger 2023 Recover controversy — the Recover service allows seed-phrase backup via Coincover, Onfido, and Ledger. The implementation requires firmware support for seed exfiltration that critics argue undermines the device’s “keys never leave” guarantee. See Ledger considerations and tradeoffs for full treatment.
- Trezor 2018 hardware vulnerability — a physical-attack vulnerability was discovered and patched.
- Various coordinator/wallet-software bugs — multiple incidents over the years involving how coordinators present multisig transactions to hardware wallets.
The synthesis’s read: vendor track records are uneven; every vendor has had incidents. The relevant question is how the vendor responds — speed of patching, transparency of disclosure, learning from the incident.
Progress indicators during signing
A small detail Lopp specifically cites: does the device show a progress indicator during long signing operations? For 50-input PSBTs (common in multisig contexts), some devices appear frozen, leading holders to power-cycle them mid-signature. Coldcard and Trezor handle this well; some other devices do not.
Physical durability
For devices that travel or are stored in challenging environments: battery type (removable vs sealed), physical robustness, water resistance. Most hardware wallets are reasonably durable; the seed backup is the artifact that needs environmental protection, not the device.
UX for the specific user
The device must be one the holder will actually use comfortably. A Coldcard Q with full QWERTY is excellent for passphrase-heavy workflows; a Bitkey with no screen at all is excellent for non-technical mobile-first use. The mismatch is dangerous — a holder who finds their device painful to use will avoid using it, and an avoided wallet is an under-tested wallet.
On vendor diversity in multisig
Vendor diversity is cheap insurance
If you are running a multisig setup, use hardware wallets from different manufacturers for different keys. A firmware bug, a supply-chain compromise, or an undisclosed vulnerability in any single vendor should not be able to compromise more than one of your keys. This is cheap insurance against correlated failure, and every major practitioner — Lopp, Casa, Unchained, Blockchain Commons — recommends it.
The structural argument: three identical Coldcards in a 2-of-3 multisig are exposed to a single failure mode — anything that compromises Coldcard globally (firmware bug, supply-chain attack, undisclosed vulnerability) compromises all three keys simultaneously, defeating the multisig’s protection entirely.
Three different devices (e.g., Coldcard, BitBox02, Foundation Passport) means a single-vendor failure compromises at most one key. The 2-of-3 multisig’s protection survives.
This is what Lopp calls “correlation risk” between keys. The recommendation is universal across practitioners; the cost is modest (you buy three different devices instead of three of the same); the benefit against a real class of attacks is meaningful.
For 3-of-5 setups, the same principle applies, distributed more broadly. A typical 3-of-5 might use Coldcard, BitBox02, Foundation Passport, Trezor, and a Blockstream Jade — five different vendors, no single-vendor failure compromising more than one key.
The constraint: the coordinator software must support all the chosen devices. Modern coordinators (Sparrow, Specter, Nunchuk) support all mainstream devices, so this is rarely a practical limit.
Tradeoffs and considerations
Brand loyalty is misleading
Hardware-wallet communities sometimes generate strong brand loyalty (Coldcard partisans, Trezor advocates, BitBox enthusiasts). The synthesis’s read: the loyalty is often misplaced. Each device has strengths and weaknesses; the right device depends on the use case, not on which brand the holder identifies with.
A useful test: can you articulate why the device you chose fits your specific use case better than two alternatives? If not, the choice is brand-driven rather than fit-driven.
Open-source firmware is a real advantage but not a binary
The open-vs-closed spectrum:
- Fully open-source (Trezor, BitBox02, Jade, Bitkey) — firmware is auditable; security depends on review quality and patch speed
- Source-available (Coldcard) — firmware is published but not OSI-licensed; auditability is high but distribution restrictions exist
- Closed-source (Ledger) — must trust the vendor; security depends on vendor practices
Open-source is structurally preferable but the gap is narrower than the strongest open-source advocates suggest. Open-source code is still secure only if it has been reviewed competently and frequently. Closed-source code can be reasonably secure if the vendor’s practices are mature.
The synthesis’s read: prefer open-source where the option exists; treat closed-source devices with somewhat more caution but not as automatic disqualifications.
Secure elements vs general-purpose microcontrollers
Some devices use dedicated secure elements (specialized chips designed to resist physical attack): Ledger, Foundation Passport, Bitkey, Coldcard. Some use general-purpose microcontrollers with open-source firmware: Trezor, BitBox02 (which uses a secure element for some operations).
The trade:
- Secure element — better resistance to physical attack (chip-decapping, fault injection); typically requires proprietary firmware interface; auditability lower
- General-purpose MCU — fully open-source possible; lower physical-attack resistance; security depends entirely on firmware
For most holders, physical-attack resistance is not the dominant threat. For Tier 2+ holders facing local-physical-attacker threats (per Threat modeling for self-custody), the secure element matters more.
Supply-chain integrity
A hardware wallet shipped with tampered firmware or hardware is structurally compromised regardless of how good the device is. Mitigations:
- Buy directly from the manufacturer or authorized resellers
- Verify tamper-evident packaging on arrival
- Initialize the device yourself (generate a new seed; don’t trust pre-generated seeds)
- For high-value setups, consider buying multiple devices from different sources and comparing
The Ledger 2020 customer-data leak is particularly relevant here: the leaked customer database includes home addresses, which informs physical-attack targeting. Holders concerned about this risk should avoid having hardware-wallet purchases shipped to their primary residence.
Air-gap workflow ergonomics
Strict air-gap signing (QR-only) is more secure but is operationally heavier:
- Each PSBT must be converted to a QR code (which may require multiple QR frames for large PSBTs)
- The holder scans the QR with the device camera
- The signing device displays the signed PSBT as a QR code
- The coordinator scans it back
For routine spending, this is more steps than USB-connected signing. For deep-cold-storage signing (rare), the friction is acceptable. For an active operational wallet, USB-connected signing is often preferred even by holders who use air-gap for their cold storage.
Lightning operation
Lightning Network operation requires hot keys — the node must sign quickly and without manual confirmation for each routing payment. Hardware wallets are generally not suitable for Lightning hot keys.
The compatible pattern: hardware wallet for the on-chain cold wallet; separate hot wallet (mobile or node-resident) for the Lightning operational keys. Some setups use BIP-85 to derive the Lightning hot keys from the cold-wallet master, simplifying the backup discipline.
Comparison with alternatives
The principal alternatives to dedicated hardware wallets:
| Approach | Security level | Cost | Operational friction | Suitable for |
|---|---|---|---|---|
| Mobile hot wallet | Lower — continuous remote attack exposure | Free | Low | Small balances, daily spending |
| Desktop hot wallet (Sparrow, Electrum) | Lower — but with hardware-wallet co-signing, comparable to hardware-only | Free | Medium | Active multi-account use |
| Dedicated hardware wallet | Higher — keys isolated from network | 200 | Medium | Most self-custody beyond Tier 0 |
| Air-gapped general-purpose computer | High — if discipline is sustained | $100+ | High | Specific bespoke threat models |
| Multi-sig with hardware wallets | Highest — distributed across devices and locations | 800 | Higher | Tier 2+ holdings |
| Custodial service (BitGo, Anchorage, etc.) | Variable — counterparty risk | Varies | Lowest | Institutional or partially-custodial setups |
For the operational holder, dedicated hardware wallets are the default for any holding past trivial scale. The alternative for advanced users — air-gapped general-purpose computers running Bitcoin Core or Sparrow — is operationally heavier and rarely worth the friction.
Tiered recommendations
Tier 0: Hardware wallet not strictly necessary. Mobile hot wallet is fine for the scale.
Tier 1 (50K): One hardware wallet is sufficient. Reasonable choices: BitBox02 (249, full QWERTY for passphrase-heavy workflows) or Trezor Safe 5 (79) is genuinely good.
Tier 2 (1M+): Multiple hardware wallets, typically three for 2-of-3 multisig. Vendor diversity becomes important — common combination: Coldcard + BitBox02 + Foundation Passport (or Trezor). For collaborative custody, the partner typically holds one device, leaving two for the holder to manage.
Tier 3 (>$1M): Five devices for 3-of-5 multisig where the configuration is right. Vendor diversity across all five: Coldcard + BitBox02 + Foundation Passport + Trezor + Blockstream Jade (or similar). Plus separate devices for operational tiers (a different hardware wallet for the active spending cold wallet).
In all tiers, the operational principle is: the device matters less than the discipline. A well-managed BitBox02 is structurally safer than a poorly-managed Coldcard.
Common pitfalls
Buying for brand rather than fit. Coldcard, Trezor, BitBox, and Foundation Passport partisans exist. The partisan framing often misses what the holder actually needs.
Buying three identical devices for multisig. Eliminates vendor diversity and exposes the multisig to single-vendor failure. The standard recommendation: three different vendors.
Initializing with a vendor-provided seed. Some sketchy resellers ship pre-initialized devices to “make it easier.” Initialize yourself — generate a new seed on the device.
Skipping tamper-evident packaging verification. The check is fast and catches some categories of supply-chain attacks.
Buying via a marketplace that tracks the purchase to the holder. Hardware-wallet purchases on Amazon, eBay, or other identifiable marketplaces create a public record of “this person owns a hardware wallet.” Direct manufacturer purchases are cleaner; for the highly-privacy-conscious, shipping to a non-residence address adds another layer.
Treating the device as the wallet. The seed is the wallet. The device is replaceable. A holder who loses sleep over device theft but does not adequately back up the seed has the framing backwards.
Not testing the device with a small balance before funding. The wipe-and-restore verification with a small test balance catches many setup-time errors. The synthesis is direct: trust nothing you have not tested.
Mixing legacy and modern derivation paths. Standard BIP-84 (native SegWit) or BIP-86 (Taproot) paths are universally supported. Holders who chose legacy paths years ago may find recovery to a modern wallet requires explicit path specification.
Ledger purchased after 2023 without engaging the Recover controversy. The 2023 firmware change introduced a service that critics argue undermines the “keys never leave” guarantee. See Ledger considerations and tradeoffs for the substantive engagement.
Tooling and resources
The synthesis document (canonical for the section):
- Bitcoin Self-Custody & Security: A Synthesis of Contemporary Best Practices, LegacyCipher discussion, April 2026 — the 2026 device table and the criteria framework.
Primary practitioner sources:
- Jameson Lopp — Multisig Hardware Signing Performance Reports (2020, 2024); ongoing essays at lopp.net. See Jameson Lopp.
- Blockchain Commons — Smart Custody Book; the device-evaluation criteria framework.
- Casa — published policies on which devices their multi-key plans support.
- Unchained — Bitcoin Hardware Wallets Compared (periodic update); collaborative-custody device support documentation.
Vendor documentation (varies by device):
- Coldcard — coldcard.com; detailed documentation; source-available firmware
- Foundation Devices — foundationdevices.com; open-source firmware
- Trezor — trezor.io; comprehensive support; open-source firmware
- BitBox — bitbox.swiss; Swiss-based; open-source BTC-only firmware
- Blockstream — blockstream.com/jade; open-source; budget-positioned
- Bitkey (Block, Inc.) — bitkey.world; open-source; mobile-first; no-screen
- Ledger — ledger.com; market leader by units; closed-source firmware (engaged separately)
As of 2026-07-15: the device specifications, pricing, and feature sets reflect a re-verification against vendor sites (prior snapshot 2026-05-14). Firmware updates and new product releases may shift the picture. Verify current details against vendor sources before purchasing.
Open questions for further development
- The 2026 device landscape is settling around the seven mainstream choices listed. Emerging configurations — MPC (multi-party computation) wallets, embedded-in-mobile-device secure-element setups — may shift the landscape over the next few years. How should the framework engage these?
- The vendor-diversity recommendation is universal across practitioners but has practical limits. For Tier 1 holders running single-sig, there is no diversity to maintain — the device choice is one decision. Should the framework distinguish single-sig device selection from multisig device selection more explicitly?
- Open-source firmware is treated as a meaningful but not decisive criterion. Should the framework take a stronger stance? Or is the current pragmatic position right — preferring open-source while accepting closed-source devices for holders who already use them?
- The Ledger considerations note treats the Recover controversy substantively. Does the framework need a similar note for any other vendor’s specific incidents? Casa and Trezor have had their own controversies but at lower magnitudes.
- Hardware-wallet purchasing patterns affect physical-attack risk via the KYC-data-leak pipeline. Should the framework include explicit recommendations on purchase channels (direct vendor, marketplace, anonymous shipping)?
Related notes
The framing lenses:
- Loss vs exposure failure modes — hardware wallets trade exposure protection for new operational complexity
- Threat modeling for self-custody — device choice depends on threat profile
- Self-custody configuration ladder — the device is the operational substrate for every rung above the hot wallet
Storage and key concepts:
- Seed phrases and BIP-39 — what hardware wallets actually protect
- Passphrases and the 25th word — passphrase entry UX matters for device choice
- BIP-85 child seeds — supported well by some devices (Coldcard especially)
- SLIP-39 and Shamir Secret Sharing — supported natively by Trezor
- PSBT and wallet descriptors — the universal infrastructure all hardware wallets use
- Hot vs cold storage — hardware wallets occupy the cold spectrum
The per-device notes:
- Coldcard — power user; full QWERTY; multisig + BIP-85 strong
- Trezor — native SLIP-39; mainstream UX
- BitBox — Swiss minimalist; multi-vendor multisig friendly
- Foundation Passport — strict air-gap; pleasant UX
- Blockstream Jade — budget; Unchained integration
- Bitkey — non-technical, mobile-first
- Ledger considerations and tradeoffs — the 2023 Recover controversy and its implications
Custody configurations:
- Multisig setups — vendor diversity context
- Collaborative custody services — partner device support considerations
Operational discipline:
- Backup strategies for seeds — what to do with the seed the device generates
- Recovery rehearsal practice — wipe-and-restore as device verification
- Common attack vectors — supply-chain and device-specific attacks
- Common failure modes in self-custody — device-related failure modes
The principal practitioner:
The sub-MOC home: