Ledger vs Trezor vs Tangem: The Supply Chain Is the Weak Link

On October 9, 2026, wallets started emptying. Within about an hour, a single thief swept more than a hundred million dollars in crypto off hardware wallets across six blockchains. The victims had done almost everything right: they held their coins in self-custody, on Ledger devices, with the recovery phrase written down and the hardware in a drawer. What they had not done, and could not reasonably have known to do, was distrust the box their wallet arrived in. Every confirmed victim had bought from one authorized reseller, and at least one of those devices hid an unauthorized circuit board behind its screen, according to CoinDesk and on-chain investigators at Bitquery.

That incident is the sharpest reminder in years that the hardest question in a hardware wallet comparison is not which chip is strongest. It is whether the device in your hand is the device the manufacturer built, and whether the company behind it can keep both your keys and your personal data out of the wrong hands. With Bitcoin trading near $83,000 in mid-October, per Yahoo Finance, and a hardware wallet being only as useful as the long-term position it protects (often a multi-year Bitcoin hold), the stakes of getting self-custody right have rarely been higher.

Ledger, Trezor, and Tangem are the three most recognizable names in consumer cold storage, and they answer those questions in very different ways. This is a comparison written after a year that stress-tested all of them: what each device is, what it costs, how its security model actually works, and where each one is strong and weak once you stop looking only at the secure element.

Three wallets, three philosophies

Ledger, founded in France in 2014 and the maker of millions of devices sold worldwide, is the sealed-and-certified camp. Its firmware, called BOLOS, is closed-source and runs on a bank-card-grade secure element from the ST33 family, certified to Common Criteria EAL5+ or EAL6+. You cannot read the code; you trust Ledger’s certifications and its in-house attack lab, Donjon.

Trezor, built by SatoshiLabs in the Czech Republic, shipped the first hardware wallet back in 2014 and sits at the opposite pole: open. Its firmware is open-source, and with the Safe 7 (launched in October 2025) the company introduced TROPIC01, which it bills as the first fully auditable secure element in any wallet. The pitch is that you should not have to trust the company, you should be able to check it.

Tangem, based in Switzerland, took the most radical route: seedless. The wallet is a contactless card. Keys are generated on an EAL6+ secure element inside the card and never leave it, and there is no 24-word phrase to write down, type, or display. Backup means buying a set of two or three cards that share the key during setup. No screen, no battery, no firmware updates. These are not cosmetic differences; they lead to opposite answers on the questions that matter in 2026.

The lineups, and what they cost

Ledger’s range runs from the keychain-sized Nano S Plus (around $79) and the Bluetooth Nano X (around $149) up to the Nano Gen5 ($179), launched in October 2025 with an E Ink touchscreen and wireless connectivity, the Flex ($249), and the premium Stax ($399). Critically, every model uses the same ST33-series secure element; as The Block noted around the Gen5 launch, the extra money buys a bigger screen and nicer materials, not a stronger chip.

Trezor’s current line is the entry Safe 3 ($59), the color-touchscreen Safe 5 ($129), and the flagship Safe 7 ($249), which a CryptoSlate review describes as running two independent secure elements, including the auditable TROPIC01. The older Model One and Model T are still sold but were built without a dedicated secure element, so the Safe series is the relevant comparison today.

Tangem is the cheapest to enter: a two-card set runs about $54.90, a three-card set about $69.90, and the Tangem Ring roughly $160. You are not buying a screen or a battery; you are buying two or three identical cards and the phone app that talks to them over NFC. For many first-time buyers, that price and simplicity are the whole appeal.

The secure element, and why it was never the weak link

A secure element is a small tamper-resistant chip, the same class of component used in passports and bank cards. It keeps the private key physically isolated, resists probing and side-channel analysis, and is certified by independent labs to Common Criteria levels such as EAL5+ or EAL6+. For years this was the headline specification that separated a real hardware wallet from a USB stick, and it is the number marketing pages shout about.

All three brands now ship one. Ledger always has; Trezor added a dedicated secure element with the Safe 3, Safe 5, and Safe 7; and Tangem’s entire product is a secure-element card. On that axis, none of the three is clearly the weakest. If the comparison stopped at the chip, it would be close to a tie.

But the secure element protects the key only while it sits on the chip. It does not protect what appears on the screen, what you actually sign, the logic of the firmware around it, the personal data the company stores about you, or the integrity of the device before you ever power it on. Every serious loss in 2026 came through one of those gaps rather than through a broken chip. The most expensive one came through the last gap on that list.

October’s wake-up call: a tampered Ledger and a nine-figure drain

On October 9, reports of drained Ledger wallets began to surface, and they had one thing in common: the owners had all bought their devices from CryptoBilis, an authorized Ledger reseller serving Indonesia, Malaysia, and the Philippines. The reseller suspended all hardware-wallet sales while the investigation ran. A day later, as CoinDesk reported, Ledger Support said plainly: “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.”

The implant was a hidden circuit board tucked behind the device’s display, carrying its own microcontroller and a cellular modem wired to the screen’s internal data lines. During setup, a Ledger shows your 24 recovery words on its own screen so you can write them down. The implant simply read those words as they were drawn on the display and texted them out over a mobile network, never touching the victim’s computer or phone. The secure element was never cracked; it did not need to be.

The scale was industrial. On-chain analysts at Bitquery traced more than $100 million drained from 324 wallets across six blockchains by October 12 (earlier public counts ran from roughly $86 million to $93 million as the tally grew). Around $79 million of it was Tether on Tron, with about 204 BTC and smaller amounts on Ethereum, BNB Chain, Polygon, and Solana. After a two-week testing phase, the main sweep ran for roughly 47 minutes on October 9: Bitquery found 25 wallets signing the same approval within three seconds and $29 million pulled out in six, the signature of one actor holding every key rather than a scattered phishing campaign. By October 12 about $82 million was still traceable and Tether had frozen roughly $10 million in USDT.

The uncomfortable detail is that Ledger’s Genuine Check did its job and still missed the implant. The check verifies that the secure element is authentic, but Ledger’s own documentation, as CryptoSlate highlighted, says it cannot detect unauthorized physical modifications such as spying implants when the chip itself is intact. The genuine chip sat next to a malicious board, passed its attestation, and happily displayed the seed the implant was waiting to read.

Ledger stressed that its own systems and direct sales channels were not compromised, and told CryptoBilis buyers not to initialize unused devices and to move any funds to a fresh seed on a device bought from Ledger directly. The lesson is bigger than one reseller: the strongest chip in the world does nothing if the device is modified before it reaches you. That is a chain-of-custody failure, and it is the single most important lens for comparing these three brands in 2026.

Open or sealed: what you can actually verify

Ledger’s answer to the trust problem is certification plus secrecy. BOLOS is closed, and the company argues that a general-purpose computer can never be trusted with secrets, so a sealed, certified device backed by a professional attack lab is the only honest option. Chairman and CEO Pascal Gauthier has put it bluntly on the Ledger blog: “Everything that is in software is close to impossible to protect,” and “You cannot ask a general-purpose phone or laptop to protect your most sensitive secrets.”

There is an awkward irony in reading those lines the week of the CryptoBilis disclosure. Gauthier is right that software is hard to protect, but the attack that cost users nine figures was not software at all; it was a soldered board that the certified chip never noticed. The same blog post where he argues “The safest place to store value is Bitcoin on a Ledger” also concedes that “hackers are winning,” and October made the second half of that sentence feel more current than the first.

Trezor’s answer is the opposite: radical openness. CEO Matej Žák told DL News, “We are the most secure because we are the most open-source,” and explained the switch away from secret silicon: “In the past, we used chips under NDA, and if we found a problem, we couldn’t warn anyone.” The Safe 7 is the clearest expression of that stance, pairing the auditable TROPIC01 with a second EAL6+ chip so that design files, down to transistor-level logic, can be examined by outsiders.

The tension is genuine. Open source lets independent researchers, and even Ledger’s own Donjon team, find and openly discuss flaws, which is how most of this year’s vulnerabilities became public. A sealed model can hide a flaw from everyone, including you, until it is exploited. The counterargument is that open firmware also publishes the attack surface for free. As the next section shows, neither philosophy spared its device from a laser.

The seedless bet: Tangem without a seed phrase

Tangem made a bet that the 24-word recovery phrase is itself the problem. There is no seed to write down by default. When you first tap a card, its secure element generates the private key on the chip and copies it only to the other cards in your set, so the key exists on two or three identical cards and nowhere else. There is no phrase to phish, no phrase to mistype, and, relevant to October, no phrase ever shown on a screen for an implant to read.

That last point is the strongest thing you can say for the seedless model right now. The CryptoBilis implant worked by reading words off a display; a Tangem card has no display and never renders a phrase, so that exact exfiltration path has nothing to capture. The simplicity also helps at the start of the journey, where most self-custody disasters actually begin, with confused setups and abandoned backups rather than exotic exploits (our look at the wallet onboarding funnel found that the drop-off happens long before any attacker shows up). Tangem points to independent reviews by Kudelski Security in 2018 and Riscure in 2023, as summarized by KuCoin, and no Tangem card has lost funds in the wild.

The costs of the bet are real, though. The cards take no firmware updates, so any flaw found in the card logic can never be patched; there is no passphrase-style decoy wallet for plausible deniability; and the key lives entirely on your cards, so losing every card means losing the funds with no phrase to restore from elsewhere. Seedless trades one class of risk for another, and whether that trade is worth it depends on which risks you actually face.

The laser in the lab: Ledger’s Donjon vs the rivals

In 2026 Ledger’s Donjon lab pointed its lasers at both competitors. Against the Tangem card, built on a Samsung S3D232A secure element, a single nanosecond laser pulse faults one firmware check in the routine that sets the card’s access code, letting an attacker reset that code without the old one or a backup card and then drain the wallet. Donjon disclosed it to Tangem on February 10 and published on July 9. As The Hacker News and the Donjon writeup detail, it needs physical possession of the card, roughly $250,000 of laboratory equipment, and about two hours per card, and because Tangem cards accept no firmware updates, it can never be patched. No user has lost funds to it.

Tangem co-founder Andrey Kurennykh pushed back in a company response, arguing that “LFI attacks are not scalable, and for everyday users, the practical risk is virtually non-existent,” noting that there have been no real-world losses from laser fault injection on any hardware wallet, and framing the non-updatable card as a deliberate trade-off rather than an oversight. A seedless card, he argues, cannot risk the false-positive lockouts that a self-destruct feature would introduce.

Trezor did not escape either. Donjon published a laser fault-injection attack on the Safe 7’s TROPIC01 in June, bypassing signature verification and running unauthorized firmware on chip samples, but it defeated only one of the device’s independent layers. Žák’s response, reported by crypto.news, leaned on exactly that design: “Because the Trezor Safe 7 was built with multiple independent security layers, a vulnerability in TROPIC01 does not put user funds at risk.” The open model also meant the whole exchange happened in public.

The honest reading is that these are world-class attacks that require your physical device inside a well-funded lab. For almost everyone, they are a smaller danger than a $30 phishing kit or a tampered box from a reseller. But they make the same point as CryptoBilis from the other direction: once an attacker has your device in hand, the secure element is a speed bump, not a wall. Physical access is the real adversary, and a tampered supply chain is simply the cheapest way to get it at scale.

The screen you have to trust: blind and clear signing

Strip away the jargon and a hardware wallet’s security rests on one thing: a trusted display. You approve what the device shows you, and the key never leaves to sign anything you did not approve. The implant attack is devastating because it breaks that assumption without breaking the chip. If the screen can be read by a hidden board, or if the transaction on it is an unreadable blob, the isolation of the key is beside the point.

That is the long-running fight over blind signing: approving a payload you cannot read in plain language, a habit blamed for enormous losses, including the Bybit theft. The fix is clear signing, which renders a transaction in human terms on the device so you can see what you are authorizing. Ledger co-developed the ERC-7730 clear-signing standard and handed its stewardship to the Ethereum Foundation in May 2026. On this axis Ledger and Trezor both show transaction details on their own screens, while Tangem leans on the paired phone app’s display together with on-card signing, a reasonable model until the phone is the compromised part.

The problem is getting harder, not easier, as wallets add delegation and automation. Once a device can pre-authorize a session key or let a smart account act on your behalf, the question of what you are really approving gets slipperier, a shift we traced in how wallets now spend without you. The durable rule survives all of it: verify on the device’s own screen, and treat a device you did not buy directly as a screen that might not be telling you the truth.

The other supply chain: your leaked data

The second thing a secure element cannot protect is the company’s database of you, and 2026 was a brutal year for that database. A hardware wallet maker knows your name, your email, your phone number, and the address where it shipped a device you only buy if you own crypto. When that list leaks, it becomes a targeting list.

Trezor learned this through a fulfillment partner. A breach at its shipping vendor eventually reached about 81,000 customers, exposing names, emails, phone numbers, and shipping addresses, as tracked by BleepingComputer. SafePal, a rival hardware wallet, disclosed in August that an authorization flaw in an order-tracking plugin exposed personal data on nearly 40,000 customers who ordered between March 2025 and April 2026, per The Block. Neither breach touched seed phrases, but both handed attackers a who-owns-what map.

Ledger has the longest history here. Its 2020 breach exposed roughly 270,000 physical addresses, and in August 2026 the company was hit with a class action seeking at least $500 million, as crypto.news reported, alleging that breach data was used to impersonate Ledger and steal from users. Set that lawsuit beside the CryptoBilis implant and a pattern emerges: Ledger’s cryptography has held, but the human and logistical layers around it keep failing.

Why it matters is direct. A leaked shipping address tells a thief that you own a hardware wallet and exactly where you sleep. That feeds phishing, it feeds SIM-swaps that hijack the phone number guarding your account recovery (a trap we have documented in detail), and it feeds the in-person attacks covered below. It can even tell criminals which reseller’s customers are worth slipping a tampered device to. A fair comparison therefore has to grade a vendor’s data hygiene, not only its chip. Trezor’s one bright spot is a 90-day data-retention policy that limited how much old order data was there to steal.

Backup, recovery, and inheritance

For ordinary owners, the recovery model matters more day to day than the chip, because the most common way to lose crypto is still to lose the backup, not to be hacked. This is where the three diverge sharply.

Trezor offers the standard 12 or 24-word seed plus optional Shamir Backup (SLIP-39), which splits the secret into shares with a threshold, so you might need any 3 of 5 shares to restore, and a Super Shamir mode for multi-group schemes. That is genuinely useful for spreading risk across locations and for inheritance, where you can hand shares to different trusted people without any single one holding the keys.

Ledger uses a 24-word seed and offers the optional, paid Ledger Recover service, which encrypts and shards your seed across three custodians with identity verification. The very idea that a seed could leave the device drew fierce criticism when it was announced in 2023, as CoinDesk covered at the time; it remains optional, and it is a recovery product, not an inheritance plan with triggers or heir notification.

Tangem’s backup is physical: set up two or three cards and, if you like, hand one to an heir. It is the simplest model to explain to a non-technical family member, but it has no threshold, no quorum, and no time delay, so a found card plus the access code is the entire wallet. And the October incident adds a hard rule for everyone: if your recovery phrase was ever shown on a device you cannot fully trust, generating a new wallet and moving the funds is the only safe fix, because reusing that phrase on a brand-new device leaves anyone who captured it still holding your keys.

The $5 wrench: when the attacker is in the room

No secure element, open or sealed or seedless, stops a wrench. The physical-coercion threat grew sharply this year: Chainalysis counted about $30 million stolen across 46 known violent incidents in the first half of 2026, with kidnappings figuring in 52% of incidents and home invasions climbing toward 37%, and France emerging as a hotspot. As the firm put it, “Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form.”

The three brands offer different answers to coercion. Trezor and Ledger both support a passphrase, an extra secret beyond the seed that unlocks a separate hidden wallet, so you can hand over a decoy balance under duress while the real funds stay invisible. Tangem’s seedless model has no passphrase decoy, although an access code is still required to use a card. None of this makes you safe if someone is willing to keep hurting you, which is the uncomfortable ceiling on every technical defense.

Leaked address lists make all of this worse by handing attackers a ready-made target map, which is why the data breaches above and the wrench statistics here are really one story. The defense is operational rather than cryptographic: buy direct, keep your holdings off social media, use a passphrase or decoy, and consider spreading backups across locations. This is the point where the which-chip debate stops mattering and your own threat model takes over.

Which wallet is right for you

There is no single winner, because the right choice depends on what you hold, how much, and who might come looking for it. The table below maps the most common buyer profiles to a sensible default, with the trade-off to keep in mind.

One rule overrides every row in that table. Buy directly from the manufacturer or a verified first-party channel, inspect the packaging and tamper evidence before you power anything on, and run the device’s genuine or authenticity check during setup, while remembering the hard lesson of October: that check validates the chip, not the whole board, so anything odd during setup is a reason to stop and call official support.

It is also worth noticing what the CryptoBilis thief actually took. The largest slice was not Bitcoin but Tether, the dollar stablecoin so many holders now self-custody for yield and payments. If stablecoins are a big part of what you store cold, the custody question and the stablecoin yield-rules question travel together, because the same device protects both the asset and whatever return you are chasing on it.

Where the SEC fits, and where it does not

Self-custody sits largely outside the reach of the SEC, which is both the appeal and the catch. The agency regulates exchanges, broker-dealers, and issuers; a hardware wallet maker that never holds your keys is not your custodian, and SEC staff said in 2026 that software enabling self-custodial transactions is not acting as a broker, per CoinDesk. The SEC’s own investor-education arm has published custody basics urging retail investors to understand exactly who holds their keys.

The flip side of that freedom is that there is no clawback and no deposit insurance. If a tampered device leaks your seed, no regulator makes you whole. The roughly $10 million in Tether frozen in the CryptoBilis case was a stablecoin issuer’s commercial decision, not a government rescue, and the Bitcoin among the stolen funds cannot be frozen by anyone at all.

In the European Union, MiCA and comparable regimes elsewhere regulate service providers, not the self-custody wallet in your pocket. For a US reader the practical translation is simple and a little daunting: in self-custody you are the compliance department, the insurance policy, and the security team at once. The device you choose is only as strong as the habits you wrap around it, and 2026 spent the whole year proving that the chip was never the part most likely to fail.

Frequently Asked Questions

Is Ledger still safe to use after the CryptoBilis hack?

The CryptoBilis losses trace to devices sold by one reseller that were physically tampered with before buyers received them, not to a flaw in Ledger’s chip or its own systems. A Ledger bought directly from the manufacturer, and set up on a device whose packaging you verified, remains a strong option. The lesson is about where you buy, not about abandoning the brand.

Which is more secure, Ledger, Trezor, or Tangem?

All three use a certified EAL6+ class secure element, so none is clearly weakest on the chip alone. Trezor is the most transparent because its firmware, and on the Safe 7 its secure element, are open to audit. Ledger offers the widest asset support and a strong in-house attack lab. Tangem removes the seed phrase entirely, which closes some attack paths and opens others. The most secure choice is the one that matches your threat model and is bought directly from the maker.

Does Tangem being seedless make it safer than Ledger and Trezor?

Seedless means there is no 24-word phrase to phish, display, or write down, which neutralizes the screen-reading implant used in the CryptoBilis attack. The trade-offs are that Tangem cards cannot receive firmware updates, carry no passphrase decoy, and depend entirely on your backup cards, so losing them all means losing access. It is safer against some attacks and weaker against others.

How do I avoid buying a tampered hardware wallet?

Buy directly from the manufacturer’s official store or a verified first-party channel rather than third-party resellers or marketplaces, inspect the packaging and tamper evidence, and run the device’s genuine or authenticity check during setup. Remember that the authenticity check validates the secure element, not every component, so unusual behavior during setup is a reason to stop and contact official support.

What should I do if I think my recovery phrase was exposed?

Treat the funds as at risk immediately. Set up a brand-new wallet on a device you trust, generate a fresh recovery phrase, and move your assets to the new addresses right away. Do not reuse the old phrase on a new device, because anyone who captured it can still reach the original wallet.

Yuki Tanaka covers wallets, custody, and self-custody security for HOGE Wire.