Ledger and Coldcard Thefts Prompt Look at Five Alternatives for Storing Crypto
Hardware wallet thefts shake confidence in self-custody
More than $200 million worth of crypto was stolen in recent months from tampered Ledger devices and Coldcard devices where the seed was not truly random, according to a Cointelegraph Magazine article published October 21. A seed phrase is a list of words that can restore access to a crypto wallet.
The article says the affected holders bought their products from official sources, stored their seed phrases correctly and followed the common rule "not your keys, not your coins." They still lost funds, which the article says suggests hardware wallet users can face risks beyond their own control.
The article also points to a rise in physical attacks on crypto holders, saying there has been a $5 wrench attack in France every 2.5 days this year. A $5 wrench attack is a robbery in which someone is physically threatened to hand over crypto access.
Key points from the article
- Over $200 million in crypto was reported stolen from tampered Ledger wallets and Coldcards with non-random seed generation.
- The article lists five alternatives to hardware wallets: crypto ETFs, passkey-based wallets, multisig wallets, centralized exchanges and paper wallets.
- Each alternative has its own risks, and the article says spreading holdings across addresses and methods can limit damage if one method fails.
- 21Shares co-founder Ophelia Snyder says exchange-traded products make more sense for most people for tax, estate planning and security reasons, but notes trade-offs such as limited onchain use and exposure to the issuer.
What the five alternatives involve
Crypto ETFs are not a way to store crypto directly, the article says. Even if a holder deposits Bitcoin, it is exchanged for shares in a financial product that holds crypto through a custodian. The holder ends up with a claim on the ETF's net asset value in dollars, not in Bitcoin. The article lists risks including trusting a centralized provider, third-party custody, fees, and possible gaps between the share price and the asset's market price.
Passkey-based wallets let users access accounts with a cryptographic credential stored on a device, usually a phone through Apple or Google passkeys, often protected by a fingerprint, face scan or PIN. The article names Coinbase Wallet's Smart Wallet, Clave and Infinex as examples with differing designs and recovery options. It says losing a device or passkey can still cause problems, and users should check how backups work and whether recovery requires trusting a third party. It also recalls that in June 2024, Blockstream CEO Adam Back questioned Coinbase's Smart Wallet and said it "sounds like basically a hosted wallet with a better sales pitch."
A multisig wallet needs multiple keys to approve a transaction. In a 2-of-3 setup, three signers hold keys and any two must approve before funds move. The article says this reduces reliance on a single key or device but does not always remove the need for a hardware wallet. It cites Casa, which offers multisignature custody for individuals and families using a hardware wallet, a mobile phone and a key held by Casa. It adds that many large Ethereum projects manage treasuries through Safe wallet, an onchain smart account multisig. Drawbacks listed include the need for signers to stay available, possible vulnerabilities in smart contract code or setup, the risk that an attacker who compromises enough signers can still authorize a transaction, and slower transfers when signers are in different locations and time zones. Casa CEO Nick Neuman told Cointelegraph earlier in the month that users should spread risk across multiple providers.
Centralized exchanges take over private key management but revive the "not your keys, not your coins" concern. The article notes a history of exchange hacks and exploits, including owners taking access to user assets with them to their graves and one of the largest BTC hacks in history, with investors still waiting to recover coins 13 years later. It says exchange security has improved and many exchanges publish proof-of-reserves reports or hold emergency funds, but adds that proof of reserves does not establish a company's full financial health or its ability to meet every obligation. It also says rising reporting requirements, including the OECD's Crypto-Asset Reporting Framework, mean exchanges ask for identity, residency or tax information, and non-compliance can lead to account restrictions or suspended withdrawals.
A paper wallet is a crypto address and its private key printed on paper. The article says generating one safely can be difficult, because a compromised computer, malicious generator or weak randomness can expose the key before printing. Paper can also be lost or damaged, and spending funds can weaken security if the private key is imported into an internet-connected wallet. It describes paper wallets as an alternative to hardware wallets but not a better one for most users.
Why this matters for crypto holders
The article says there is no single ideal way to store crypto and that the choice depends on a holder's personal circumstances. It says spreading holdings across different addresses and methods can reduce the damage if one method is compromised.
Snyder told the publication that self-custody users tend to fall into two groups: long-term crypto natives with strong views on their personal security practices and everyone else. She said people outside the first group may find self-custody is not the best fit, and that holding some crypto on a centralized exchange and in an ETF can be "a really useful tool as part of a portfolio approach to holding crypto."
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.