Three 2026 Hardware Wallet Attacks Never Broke the Chip. Here's What Would Have Protected You
Coldcard, the CryptoBilis Ledgers and NGRAVE: three of this year's thefts from hardware wallet users, and not one secure chip was broken. Each attack went after the seed at a different moment of its life, and each one has a habit that covers it.
Each of these incidents arrived as its own news story: a Coldcard story, a Ledger story, an NGRAVE story. Put side by side, they read as one lesson. A secure element protects keys once they exist inside it. It has no say over how the seed was generated, who handled the device before you opened the box, or what you type into your phone when an alert tells you to hurry.
Three moments when a seed can leak
| Attack | When | What failed | Reported losses | What protects you |
|---|---|---|---|---|
| Coldcard: weak entropy | Flaw dates to March 2021; thefts from July 30, 2026 | Seed generation used a software formula instead of the chip's hardware noise, so some seeds could be guessed | About 1,806 BTC (about $143.9 million at September 7 prices), counting one still-unconfirmed vault, per Galaxy Research [1][2] | Dice-generated seed; random passphrase; multisig across vendors; if affected, a new seed |
| Ledger / CryptoBilis: implant in distribution | Losses reported from October 9, 2026 | A component added inside the case read the 24 words off the screen and sent them over a cellular network | No official figure; $86 million to $93 million across several chains, per on-chain analysts cited by CoinDesk [3][4] | Buy from the manufacturer or an authorized reseller; if the device came from CryptoBilis, a new seed on a different device |
| NGRAVE LIQUID: fake alert in the official app | Night of October 17 to 18, 2026 | With stolen access to the push provider, attackers sent a fake alert linking to a site that asked for the seed | $2.65 million from 84 wallets, $1.76 million in bitcoin, per Bitquery; NGRAVE has traced about $2.56 million [5][6] | Never enter the seed anywhere except your backup and the device itself, even if the official app asks |
Read the "What failed" column top to bottom and the device never appears in it. What went missing each time was the seed: in one case it was weak from birth, in another a spy inside the case copied it, and in the third the owner typed it in.
Generation: Coldcard's seeds were weak from the start
We covered the mechanism in detail in our breakdown of the Coldcard entropy flaw. From a March 2021 firmware release onward, some devices built seeds from a software formula instead of the chip's hardware noise source. The words looked like any other seed, and no test can tell them apart, but an attacker with enough computing power could reconstruct them.
The case is still moving. Galaxy Research reported on September 7 that the third-wave attackers had moved 97.09 BTC, about $7.7 million at that day's prices, roughly 45% of what that wave took [1][2]. Part of it crossed to Ethereum through THORChain on September 2, and the rest went into CoinJoin rounds on September 5 and 6 [1][2].
According to Galaxy Research, 82% of everything stolen in the Coldcard case was still in the attackers' original addresses on September 7 [2]. The other 18% had moved in a way the firm says looks designed to break the trail [2]. Our coverage of the laundering and the attackers tracks how the case escalated.
The defense here is to take the manufacturer out of seed generation. Dice-generated seeds sidestep the device's random number generator, a random passphrase adds entropy you control, and multisig across vendors means one weak seed can't empty the wallet on its own (the July 30 sweep hit single-signature wallets). If your seed came from an affected device and firmware, updating the firmware does not fix it. You need a new seed and a move of funds.
Delivery: the CryptoBilis Ledgers shipped with a passenger
Here the device did its job. According to Ledger Donjon, Ledger's security team, some units sold by CryptoBilis, a reseller in Southeast Asia, carried an added component inside the case that read the display [3]. When the device showed the 24 words during setup, the implant decoded them and sent them out over LTE through an eSIM [3].
Per Ledger, the implant does not modify the Secure Element or the operating system, and it does not alter transactions or signatures [3]. That is exactly why Genuine Check misses it. The check confirms the chip is authentic, and the chip was. There is still no official loss figure: Ledger says it has not confirmed the number of victims or the total value [3], while on-chain analysts cited by CoinDesk put it at $86 million to $93 million across more than 300 wallets on several chains, bitcoin included [4].
What protects you is provenance. Buying from the manufacturer or an authorized reseller cuts down the number of hands the box passes through. If your device came from CryptoBilis, Ledger says not to set it up if you haven't yet, and if you already use it, to move your funds to a new device with a new phrase and never restore any phrase on the CryptoBilis unit [3]. What has and hasn't been confirmed, with a timeline, is in our piece on the CryptoBilis implant.
Entry: NGRAVE's alert came through the official app
The third case is the most recent and needed the least technology. At around 21:30 UTC on October 17, users of LIQUID, the companion app for the NGRAVE ZERO, received this message: "Your LIQUID portfolio was synced on a new device — Pixel 9, Moscow (today, 21:30)" [5]. It arrived through the same channel as genuine notifications, because the attackers had taken over the access of the third-party provider that sends them [5].
The alert opened a copy of NGRAVE's site with a countdown and a button to deny the sync [5]. Pressing it led to a page asking for the recovery phrase or the Perfect Key, framed as the step that would lock the intruder out [5]. NGRAVE says anyone who entered either one saw their wallet drained within minutes, and anyone who only opened the link lost nothing [5].
NGRAVE says neither the app's code nor the ZERO's secrets were compromised, and that private keys never leave the device [5]. The company dates the first sign of the attackers' access to the provider to October 11 [5].
One night, two loss counts
Bitquery, an on-chain data company, puts the theft at $2.65 million from 84 wallets on six chains in about six hours [6]. Of that, $1.76 million was bitcoin, taken from 21 addresses, two of them attributed with less certainty [6]. By its tracing, the bitcoin went through Chainflip, a cross-chain swap service, and ended up in new Hyperliquid accounts as XMR1, a token that tracks Monero [6].
NGRAVE's own count is somewhat lower: about $2.56 million from roughly 70 addresses on four networks, which the company presents as a minimum [5]. Bitquery, for its part, acknowledges that a few of its 84 wallets may belong to people the same thief tricked in another scam [6]. The gap is smaller than it looks. NGRAVE counts four networks and says it is still reviewing others; Bitquery counts six.
SecuX had a similar problem a day earlier. On October 16, David Schwartz, Ripple's former chief technology officer, warned that SecuX's Android app had sent him a notification linking to a page that asked for 12 or 24 words [8]. SecuX confirmed on October 19 that someone had tampered with a banner in its app to link to fake sites [7]. The company has given no loss figure [7], and Bitquery found no on-chain link between those thefts and the NGRAVE ones [6].
The rule that covers this has no exceptions. Your words never leave your backup or your device, not even when the request comes from the official app with the usual logo. NGRAVE and SecuX both say they never ask for them [5][7], and so does Ledger [3].
Which habit covers which attack
The protections above are not interchangeable. Each one closes a specific door, and only one of them shows up in every column.
| Habit | Coldcard (generation) | CryptoBilis (delivery) | NGRAVE (entry) |
|---|---|---|---|
| Generate the seed with dice | Covers it | Doesn't address it | Doesn't address it |
| Buy from the manufacturer or an authorized reseller | Doesn't address it | Covers it | Doesn't address it |
| Never type the seed into a site or app | Doesn't address it | Doesn't address it | Covers it |
| 2-of-3 multisig with devices from different vendors | Limits the damage | Limits the damage | Limits the damage |
Multisig is the only row that helps in all three, and it doesn't prevent the leak; it just makes one leaked seed insufficient to spend. The compromised key still has to be replaced. The habit that makes the rest work is a short provenance note for each seed: which device, which firmware, which method, and where you bought it. For Coldcard and CryptoBilis owners, that note is what tells you whether you are affected at all. The same caution applies to your phone: a seed typed into Notes or photographed is exactly what DarkSword, a kit aimed at unpatched iPhones, goes looking for, and our guide to the affected iOS versions shows how to check yours. Nor does the device stop you from signing the wrong thing: in Electrum, a malicious server can slip in a fake payment for you to sign when you bump its fee, as our piece on Electrum 4.8.3 explains. More of our self-custody coverage is collected in the privacy and self-custody section.
Long-term holders were in the blast radius
As of October 18, 2026, at block 971,930, 34.21% of the bitcoin supply, about 6.88 million BTC, had not moved in more than five years, according to our node's HODL waves reading. Those are coins nobody has touched in that time; the figure says nothing about where or how they are stored.
The NGRAVE theft left a trace of that profile. According to Bitquery, twelve of the drained bitcoin addresses had never sent a coin, and some had sat untouched for more than three years [6]. That looks like long-term savings. For holders like that, the risk in these three cases was never the device in the drawer. It was three specific moments: when the seed was created, when the box arrived and when someone asked for the words.
How much NGRAVE's victims get back is still open. According to Bitquery, on October 19 the roughly $2.16 million in XMR1 bought with the stolen funds was still on Hyperliquid, neither sold nor withdrawn [6].
How many coins have sat still for years, and what share of the supply they make up, updates with every node reading in the supply age breakdown.
Sources
Labelled by type.
- Galaxy Research, Coldcard 'Wave 3' exploiter continues to move funds, September 7, 2026. Third-wave vaults, THORChain exit on September 2, CoinJoin rounds. (Primary, the firm's analysis on X)
- CoinDesk, Coldcard hacker moves $7.7 million in BTC, 45% of bitcoin stolen in third attack wave, September 7, 2026. 97.09 BTC moved, about 1,806 BTC total including the unconfirmed vault, 82% unmoved, per Galaxy Research. (Secondary, press)
- Ledger, Update from Ledger Donjon on the CryptoBilis investigation, October 13, 2026. Implant mechanism, confirmed scope, unverified figures, user guidance. (Primary, official statement)
- CoinDesk, Ledger says unauthorized implant found in at least one device sold by CryptoBilis, October 12, 2026. On-chain analysts' loss estimate. (Secondary, press)
- NGRAVE, Incident report: the fake LIQUID security alert of 17 October, October 19, 2026. How the attackers got in, alert text, timeline, the company's traced figures, user guidance. (Primary, official report)
- Bitquery, Fake NGRAVE app alerts drained $2.65M from 84 wallets, October 19, 2026. On-chain tracing of the drained wallets, the route of the funds, comparison with SecuX. (Secondary, on-chain analysis by a data company, produced with AI tools according to the firm itself)
- SecuX, Security Alert: Beware of Fake SecuX Websites, October 19, 2026. App banner tampered with to link to fake sites. (Primary, official statement)
- TokenPost, Schwartz Says SecuX App Pushed Phishing Alert as Wallet Access Problems Persist, October 17, 2026. David Schwartz's warning about the Android app notification. (Secondary, press)
Our own data: HODL waves from our node, snapshot at block 971,930 generated on October 18, 2026.
More in Privacy and self-custody
Last updated: October 20, 2026