Crypto wallet hacks: which wallets lost user funds, and which never did
Most stolen crypto is lost to phishing: a fake app, a forged support message, a malicious approval. This is the other list, the thefts where the wallet itself failed: a firmware bug, a poisoned update, a breached vendor, keys generated badly. 2026 added the two largest hardware-wallet losses on record, one from a firmware bug and one from tampered devices in the supply chain, and neither from anything the victims did.
What is the safest type of crypto wallet?
A multi-signature wallet whose keys sit on devices from different makers, such as two hardware wallets and a desktop app in a 2-of-3. No single device, firmware bug or supplier can then move the funds. For a single key, a hardware wallet bought directly from its maker, with every transaction checked on its own screen.
Two kinds of failure are counted here, and they are not the same harm. Funds lost means user money moved because of the maker's own fault: its firmware or app, a library or update it shipped, a server or vendor it relied on, or weak key generation. Data leaked means the company or one of its vendors exposed customer records; the coins stay put, but names, emails and postal addresses end up in the hands of people who target crypto holders. Phishing, fake apps, users approving malicious transactions and lab-only attacks that need the stolen device are not counted. The list started from a chart circulating on X (@eskoropisov), and every entry was checked against the maker's own disclosure or reporting on it; several of the chart's figures are corrected below.
Hardware wallets: hacks and data leaks compared
| Wallet | Funds lost (maker's failure) | Repaid | Customer data leaked | Firmware · multisig |
|---|---|---|---|---|
 Coldcard | 2026: weak seed generation in firmware; $115M+ (Galaxy Research), up to $130M+ (other trackers) | None | None found | Source-available Multisig: yes |
 Ledger | 2023: poisoned Connect Kit library, ~$0.6M 2026: spy implant in devices sold by CryptoBilis, up to $93M (on-chain researchers); under investigation | 2023: pledged 2026: none announced | 2020: ~1M emails, ~272K with names, postal addresses and phones 2026: payment processor Global-e | Closed (apps open) Multisig: yes |
| None found | — | 2022: Mailchimp newsletter list 2024: support portal, up to 66K 2026: fulfilment provider, ~14K + ~67K US 2026: email provider Brevo, 347K addresses | Open Multisig: yes | |
| None found | — | 2026: 39,798 order records (names, addresses, phones) | Closed Multisig: not documented | |
 Jade | None found | — | 2023: shipping provider, emails (count not disclosed) | Open Multisig: yes |
 Tangem | None found (2024 key-logging bug fixed, no losses) | — | None found | App open, card closed Multisig: not documented |
 BitBox02 | None found | — | None found | Open Multisig: yes |
 OneKey | None found | — | None found | Open Multisig: yes |
| None found | — | None found | Open Multisig: yes | |
 Foundation Passport | None found | — | None found | Open Multisig: yes |
 Ellipal | None found | — | None found | Closed Multisig: not documented |
As of 13 October 2026. Each name links to the maker's official site; type or bookmark it rather than following a search ad, since cloned wallet sites are a common way to lose funds. Loss figures are on-chain estimates unless the maker published one; neither Coinkite nor Ledger has. "None found" is a search result, not a guarantee. "Multisig" means the device can sign as one key of a multi-signature wallet with coordinator software such as Sparrow, Nunchuk, Electrum or Specter.
Coldcard: keys that could be guessed
On 30 July 2026 Coinkite warned that a firmware bug had weakened seed generation on Coldcard devices. Seeds made on the Mk4, Mk5 and Q before the fixed releases carry about 72 bits of entropy instead of 128, and the Mk2 and Mk3 on firmware 4.0.1 to 4.1.9 are worse. Nothing was hacked remotely: attackers regenerated the weak keys offline and swept the coins. Galaxy Research put the losses above $115 million by mid-August, from more than 200 victims it spoke to; other trackers count over $130 million. Coinkite has published no loss figure and offered no compensation. A seed mixed with at least 50 private dice rolls is not affected; every other seed made on an affected version should be moved to a new one, and updating the firmware does not repair an existing seed.
Ledger: a library, a database, and an implant
Ledger appears three times. In December 2023 a former employee's phished account was used to publish a poisoned version of the Connect Kit library that dapps load; about $600,000 was drained before it was pulled, and Ledger pledged to repay the victims. In 2020 its e-commerce database leaked: about a million email addresses and some 272,000 records with names, postal addresses and phone numbers, which still feed phishing letters and threats at holders' doors. And in October 2026 Ledger confirmed that devices sold through CryptoBilis, a reseller in Southeast Asia, carried an added implant that read the seed phrase off the screen and sent it out over a mobile network. On-chain researchers count up to $93 million taken from more than 300 wallets; Ledger calls the affected volume limited and has not said where in the distribution chain the devices were opened. Its genuineness check cannot detect such an implant, which is the practical lesson: buy a hardware wallet from its maker, not from the cheapest listing.
Trezor and SafePal: leaks without losses
No Trezor has lost funds through a Trezor fault, but its customer lists have leaked four times, each through a vendor: a newsletter service in 2022, a support portal in 2024, a fulfilment provider and an email platform in 2026. The September 2026 email-platform breach exported 347,149 newsletter addresses, and the attacker used the same account to send customers a fake "entropy vulnerability" alert. SafePal's 2026 leak exposed the orders of 39,798 customers, postal addresses included. The sets overlap and are not a count of unique people; the chart's "494K records" adds them as if they were.
Software wallets: hacks and data leaks compared
| Wallet | Funds lost (maker's failure) | Repaid | Customer data leaked | Code · multisig |
|---|---|---|---|---|
| 2025: tampered web front-end drained Bybit's own Safe multisig, ~$1.5B | Bybit covered its customers; Safe paid nothing | None found | Open Multisig: it is one | |
 Atomic Wallet | 2023: wallets drained, root cause never published; $100M+ (Elliptic), 5,500+ wallets | None; US class action dismissed 2024 | None found | Closed Multisig: no |
| 2018–2020: rogue servers pushed fake update pop-ups; ~2,200 BTC, ~$25M at 2020 prices | None | None found | Open Multisig: yes | |
| 2022: key-generation bug in the extension, ~$170K 2025: backdoored extension v2.68, ~$7–8.5M | 2022: pledged 2025: payouts began Jan 2026, completion not confirmed | 2025: the backdoored build also collected personal data (scope unknown) | Core library open Multisig: no | |
 Bitget Wallet | 2022 (as BitKeep): swap exploit ~$1M, hijacked Android download ~$8M | Pledged; completion not confirmed | None found | Closed Multisig: not documented |
| Slope | 2022: seed phrases sent to its own logging server; $4.5–8M, about 8,000–9,200 wallets | None | Seed phrases, via the same logs | Closed Multisig: no |
| 2023: leaked admin key of its DEX aggregator contract; $0.37M (OKX) to $2.7M (PeckShield) | $0.37M pledged | None found | Mostly closed Multisig: not documented | |
 Rabby | 2022: Rabby Swap contract bug, ~$0.2M | Reported repaid (no statement from Rabby) | None found | Open Multisig: signs for Safe |
| 2018: DNS hijack of Amazon Route 53, ~$150K | None | None found | Open Multisig: no | |
 Edge | 2023: ~2,000 Bitcoin keys written to uploadable logs; "low five figures" | Not stated | Private keys, via the same logs | Open Multisig: no |
| 2019: desktop recovery box sent seeds to a spell-checker; one disputed claim | None | — | Closed Multisig: no | |
| None found (Sept 2026 infrastructure incident open; no evidence of losses) | — | 2023: support-ticket vendor, ~7,000 people | Source-available Multisig: no (Safe signer) | |
 imToken | None found | — | 2018: beta server reached via a reset AWS password; device data, count not disclosed | Closed Multisig: no |
* Borderline: the attack ran through infrastructure the maker did not fully control (Safe's hosting, Electrum's public servers, Amazon's DNS) or through a product beside the wallet app (OKX's swap aggregator). Wallets with nothing on record are listed below.
Atomic Wallet: the largest unexplained loss
In June 2023 more than 5,500 Atomic Wallet users found their wallets emptied. Elliptic attributed the theft to North Korea's Lazarus Group and put it above $100 million. Atomic never published a root cause, its terms cap its liability at $50 per user, and the US class action was dismissed in September 2024 for lack of jurisdiction. Nobody has been repaid.
Updates and logs: how software wallets fail
The software losses share a shape: something the maker shipped or ran handed keys to an attacker.
Trust Wallet's Chrome extension was replaced in December 2025 by a build that sent seed phrases
away, after a leaked publishing key; its 2022 key-generation bug had cost about $170,000 before.
BitKeep's own website served a hijacked Android app in 2022. Slope sent seed phrases to its own
error-logging service, and Edge wrote private keys into logs users could upload. Electrum's old
ability to show formatted server messages let rogue servers prompt fake updates for two years.
Safe{Wallet} and Bybit: a multisig that failed
The single largest loss on either list did not come from a weak wallet. In February 2025 North Korean attackers compromised a Safe developer's computer and planted code in Safe's web interface that activated only for Bybit's cold-wallet multisig. Each signer saw an ordinary transfer on screen while their hardware wallets signed a different, unreadable instruction; about $1.5 billion in ETH left. The Safe contracts worked as written. What failed was that every signer trusted the same interface and approved what they could not read.
Wallets that have never been hacked
Against the losses, a longer list of wallets has none on record: no user funds lost through a fault of the maker's and no customer data leaked, as far as public disclosures and reporting go. Several have fixed vulnerabilities that researchers reported to them, which is the system working rather than a mark against them; none of those was exploited.
Hardware
- BitBox02 (Switzerland) — open source; firmware fixes in 2026 for flaws nobody exploited.
Keystone — open-source firmware, air-gapped through QR codes; no incident found.
- Foundation Passport (US) — open source and audited; not affected by the Coldcard seed bug.
- OneKey — a 2023 lab extraction on the OneKey Mini needed the device in hand; patched, no user affected.
- Tangem (Switzerland) — a 2024 app bug that logged keys was fixed with no funds lost; a 2026 laser attack needs the card itself.
- Ellipal — air-gapped; 2019 lab findings fixed, no losses.
Software
Electron Cash — open-source Bitcoin Cash wallet with built-in multisig.
Phantom — Solana, Ethereum and Bitcoin; a 2022 browser flaw was fixed before any loss.Exodus — desktop and mobile, multi-chain.
Zengo — no seed phrase: the key is split between the phone and Zengo's server.
Coinbase Wallet — the self-custody wallet; the 2025 customer-data breach was at the Coinbase exchange.Solflare — Solana; unaffected by the 2022 Slope drain.
TokenPocket — multi-chain mobile wallet.Bitcoin.com Wallet — Bitcoin, Bitcoin Cash and Ethereum.
A clean record describes the past, and for closed-source wallets it is all a reader can check. It is the strongest argument for the next section: a setup that stays safe even when one of these wallets becomes the next entry in the tables.
The safest setup: a multi-signature wallet
Read the two tables for what they have in common and nearly every loss is a single point of failure: one firmware's random number generator, one tampered device, one update channel, one company's servers. A multi-signature wallet removes that point. It is a category of its own rather than a kind of device: the coins sit at an address that needs, say, two signatures out of three keys, and each key can live on any device a wallet runs on, a hardware wallet, a desktop app or a phone. Hardware and software wallets alike support it. A Coldcard with a guessable seed, an implanted Ledger or a backdoored app then holds one key of three, and one key moves nothing.
It is not only for companies. One person can run a multisig to hold a large balance, with the keys on, for example, a hardware wallet, a desktop wallet and a phone from three different makers, and keep a small single-key wallet for everyday spending.
Bybit shows the condition that makes it work: the signers have to be independent in more than name.
- Different makers. Keys on devices or apps from two or three manufacturers, so one firmware bug, one poisoned update or one compromised supply chain cannot reach a quorum.
- Read every transaction on the device. Each signer checks the address and amount on its own screen and refuses anything it cannot read, including contract calls nobody expected.
- A second route for at least one signer. A different app, or a self-hosted copy of the interface, so one compromised website cannot show every signer the same lie.
- Back up the wallet's setup, not only the seeds. A multisig needs its descriptor (the list of keys and the quorum) to be restored; keep it with each seed backup.
- Buy from the maker. The CryptoBilis implants were sold at nearly half price through a reseller.
Setting one up
For Bitcoin, Sparrow, Nunchuk, Electrum and Specter coordinate a multisig whose keys sit on hardware wallets, desktops or phones from different makers; Casa and Unchained sell the same setup with the company holding one backup key. For Bitcoin Cash, Electron Cash builds m-of-n wallets natively. On Ethereum and other EVM chains, Safe is the standard, with hardware or software wallets as its signers. The wallets directory marks which wallets can sign as part of a multisig.
Questions
Has Ledger ever been hacked?
Ledger devices have not been broken remotely, but users have lost funds twice through Ledger's side of the chain. In December 2023 a poisoned version of its Connect Kit library drained about $600,000; Ledger pledged repayment. In October 2026 devices sold through the reseller CryptoBilis were found to carry an added implant that captured seed phrases; researchers estimate up to $93 million stolen, and the investigation is open. Ledger's 2020 customer database leak exposed about a million emails and some 272,000 postal addresses.
Has Trezor ever been hacked?
No Trezor user has lost funds through a Trezor firmware or software fault. Its customer data has leaked through vendors four times, in 2022, 2024 and twice in 2026, and those lists have been used for phishing. Lab attacks that extract a seed need the physical device.
What happened to Coldcard in 2026?
A firmware bug weakened seed generation: seeds made on affected versions have about 72 bits of entropy instead of 128, or less on older models. Attackers guessed the keys offline. Losses are estimated above $115 million. Coinkite fixed the firmware but has offered no compensation; seeds made on affected versions without at least 50 dice rolls should be moved to a new seed.
Which crypto wallet has never been hacked?
Among hardware wallets, BitBox02, Keystone, Foundation Passport, OneKey, Tangem and Ellipal have no recorded loss through the maker's fault and no customer-data leak, though several have fixed disclosed vulnerabilities. Among software wallets, Electron Cash, Phantom, Exodus, Zengo, Coinbase Wallet, Solflare, TokenPocket and Bitcoin.com Wallet have none on record. A clean record is not a guarantee; a multisig across different makers does not depend on any one of them staying clean.
What is the safest type of crypto wallet?
A multi-signature wallet with its keys on devices from different makers, for example two hardware wallets and a desktop app in a 2-of-3. Every large loss in the record came from one point failing: one firmware, one tampered device, one update channel, one company's servers. With a multisig, that one point holds a single key and cannot move the funds. For a single-key wallet, a hardware wallet bought directly from its maker, with every transaction checked on its own screen.
Is a multisig wallet safer than a hardware wallet?
A multisig wallet is a separate kind of wallet, not a kind of hardware: an address that needs several keys to spend, where each key can sit on a hardware wallet, a desktop app or a phone. Hardware and software wallets both support it, and one person can run one to protect a large balance. It is safer than any single wallet because no single device, firmware or supplier can move the funds alone, provided the keys are independent: different makers, every transaction checked on each signer's own screen, and at least one signer using a different app or interface.
Did Atomic Wallet repay its users?
No. More than $100 million was taken from over 5,500 wallets in June 2023. Atomic has not published a root cause, caps its liability at $50 per user in its terms, and a US class action was dismissed in September 2024 for lack of jurisdiction.
Sources
The maker's own disclosure first where there is one, then the reporting the figures come from. Loss totals that no maker has confirmed are attributed to their source in the text.
- Coldcard — Coinkite security advisory, 30 July 2026; Galaxy Research loss estimate, via PYMNTS
- Ledger — Ledger: Connect Kit incident report, December 2023; Ledger: the July 2020 e-commerce data breach; BleepingComputer: Ledger confirms the hardware implant; CoinDesk: the CryptoBilis devices and loss estimates; The Block: the Global-e payment-processor leak
- Trezor — Trezor: the Brevo email-provider incident; BleepingComputer: the 2026 fulfilment-provider breach; ForkLog: the 2024 support-portal breach; Engadget: the 2022 Mailchimp breach
- SafePal — SafePal: security update on the order-data incident
- Jade — No Bullshit Bitcoin: the Blockstream shipping-provider leak
- Tangem — Tangem: the 2024 log issue
- Safe{Wallet} — SlowMist: the tampered Safe front-end in the Bybit theft; BleepingComputer: the breached Safe developer machine
- Atomic Wallet — The Record: the June 2023 theft; Cointelegraph: the US class action dismissed
- Electrum — Malwarebytes: the fake-update campaign; ForkLog: the running total to 2020
- Trust Wallet — The Block: the 2022 key-generation bug; SecurityWeek: the 2025 backdoored extension; The Block: the compensation process
- Bitget Wallet (BitKeep) — BleepingComputer: the hijacked Android download; The Block: the BitKeep Swap exploit
- Slope — The Block: seed phrases saved in plain text
- OKX Wallet — The Block: the DEX aggregator admin-key exploit
- Rabby — The Block: the Rabby Swap exploit
- MyEtherWallet — BleepingComputer: the DNS hijack
- Edge — crypto.news: private keys in uploaded logs
- Coinomi — Decrypt: the disputed spell-check claim
- MetaMask — Consensys: the support-ticket vendor incident; BleepingComputer: the 2026 infrastructure incident
- imToken — imToken: disclosure of the 2018 incident