{ "publisher": "VaultRubric", "url": "https://vaultrubric.com", "generated": "2026-10-11", "license": "Free to use, quote and cite with attribution: 'Source: VaultRubric (vaultrubric.com)' and a link to the relevant vaultrubric.com page. Facts carry their original source URL and as-of date; scores are VaultRubric's methodology (https://vaultrubric.com/methodology). Not investment advice.", "methodology": "https://vaultrubric.com/methodology", "attribution": "Source: VaultRubric (vaultrubric.com)", "category": "Hardware wallet", "slug": "hardware-wallets", "criteria": { "price": "Price", "security": "Security", "coins": "Supported coins", "ease_of_use": "Ease of use", "support": "Support", "backup": "Backup/recovery" }, "scoring": "Equal weights across the whole category; scores are relative to the products in this file (head-to-head pages compare only the listed products, so numbers differ).", "category_pick": null, "too_close_to_call": [ "Trezor", "Trezor Safe 3" ], "products": [ { "name": "Trezor", "category": "Hardware wallet", "vaultrubric_score_pct": 84.8, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2024-01", "type": "data breach" }, { "date": "2025-09", "type": "firmware vulnerability (physical access only; informational, not scored)" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 8.5, "imputed_score": null, "basis": "from $59 (models: {'Safe 3': 59, 'Safe 5': 129, 'Safe 7': 249}) vs cheapest $49.99", "sources": [ "https://homecryptoinvest.com/articles/trezor-vs-ledger.html" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 9.2, "imputed_score": null, "basis": "base 7, +1.5 secure element, +1 fully open-source firmware, −0.25 data breach (2024-01), 0 firmware vulnerability (2025-09, physical access only, informational)", "sources": [ "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "https://www.referralplug.co.uk/blog/best-crypto-hardware-wallet-ledger-vs-trezor" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 7.2, "imputed_score": null, "basis": "1,000 assets (1,000+ (vendor count)); log-scaled vs max 15,000", "sources": [ "https://www.referralplug.co.uk/blog/best-crypto-hardware-wallet-ledger-vs-trezor" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Simple setup, intuitive interface, touchscreen on premium models", "sources": [ "https://cryptorunner.com/reviews/trezor" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Trustpilot aggregate for trezor.io: 4.6/5 TrustScore from 2,022 reviews; replied to 96% of negative reviews (checked 2026-10-11, company-wide support). Score = 10×(4.6−1)/4 = 9.0. Note: email/ticket + chatbot only, no phone support (trezor.io/support).", "sources": [ "https://www.trustpilot.com/review/trezor.io", "https://trezor.io/support" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Shamir Backup provides advanced multi-share seed recovery options", "sources": [ "https://www.nerdwallet.com/investing/learn/trezor-crypto-wallet-review?msockid=11b07946cadb6f8823336f91cb576ec4" ] } ], "score_math": "0.167×8.5 + 0.167×9.2 + 0.167×7.2 + 0.167×8.0 + 0.167×9.0 + 0.167×9.0 = 8.49 → 84.8%", "facts": { "incidents": [ { "date": "2024-01", "type": "data_breach", "summary": "Third-party support portal breach: names/emails of up to 66k support contacts; no seeds/funds", "sources": [ { "url": "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "type": "official" } ] }, { "date": "2025-09", "type": "firmware_vulnerability", "summary": "Trezor advisory / CVE-2025-69893: BIP-39 mnemonic processing side channel (physical access); affects Model One and Model T/Safe 3/Safe 5 on universal firmware with BIP-39 backup; fixed in firmware; no funds loss reported", "sources": [ { "url": "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "type": "official", "as_of": "2026-10-11" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69893", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" } ], "fees_notes": null, "price": { "value": 59, "models": { "Safe 3": 59, "Safe 5": 129, "Safe 7": 249 }, "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-05", "says": "official prices on trezor.io checked Oct 5, 2026" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Trezor Safe 3", "category": "Hardware wallet", "vaultrubric_score_pct": 84.8, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2024-01", "type": "data breach" }, { "date": "2025-09", "type": "firmware vulnerability (physical access only; informational, not scored)" }, { "date": "2024-11", "type": "firmware vulnerability (physical access only; informational, not scored)" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 8.5, "imputed_score": null, "basis": "from $59 (models: None) vs cheapest $49.99", "sources": [ "https://homecryptoinvest.com/articles/trezor-vs-ledger.html" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 9.2, "imputed_score": null, "basis": "base 7, +1.5 secure element, +1 fully open-source firmware, −0.25 data breach (2024-01), 0 firmware vulnerability (2025-09, physical access only, informational), 0 firmware vulnerability (2024-11, physical access only, informational)", "sources": [ "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "https://www.referralplug.co.uk/blog/best-crypto-hardware-wallet-ledger-vs-trezor" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 7.2, "imputed_score": null, "basis": "1,000 assets (1,000+ (vendor count)); log-scaled vs max 15,000", "sources": [ "https://www.referralplug.co.uk/blog/best-crypto-hardware-wallet-ledger-vs-trezor" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Straightforward setup, intuitive interface, and easy to use per multiple reviews", "sources": [ "https://cryptorunner.com/reviews/trezor" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Trustpilot aggregate for trezor.io: 4.6/5 TrustScore from 2,022 reviews; replied to 96% of negative reviews (checked 2026-10-11, company-wide support). Score = 10×(4.6−1)/4 = 9.0. Note: email/ticket + chatbot only, no phone support (trezor.io/support).", "sources": [ "https://www.trustpilot.com/review/trezor.io", "https://trezor.io/support" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Shamir Backup provides enhanced seed phrase security with multiple shares", "sources": [ "https://www.nerdwallet.com/investing/learn/trezor-crypto-wallet-review?msockid=11b07946cadb6f8823336f91cb576ec4" ] } ], "score_math": "0.167×8.5 + 0.167×9.2 + 0.167×7.2 + 0.167×8.0 + 0.167×9.0 + 0.167×9.0 = 8.49 → 84.8%", "facts": { "incidents": [ { "date": "2024-01", "type": "data_breach", "summary": "Third-party support portal breach: names/emails of up to 66k support contacts; no seeds/funds", "sources": [ { "url": "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "type": "official" } ] }, { "date": "2025-09", "type": "firmware_vulnerability", "summary": "Trezor advisory / CVE-2025-69893: BIP-39 mnemonic processing side channel (physical access); affects Model One and Model T/Safe 3/Safe 5 on universal firmware with BIP-39 backup; fixed in firmware; no funds loss reported", "sources": [ { "url": "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "type": "official", "as_of": "2026-10-11" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69893", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" }, { "date": "2024-11", "type": "firmware_vulnerability", "summary": "Ledger Donjon showed Trezor Safe 3 supply-chain countermeasures could be bypassed (physical access); Trezor Safe 5 not affected", "sources": [ { "url": "https://trezor.io/vulnerability/donjon-s-trezor-safe-3-evaluation", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" } ], "fees_notes": null, "price": { "value": 59, "models": null, "notes": null, "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-05", "says": "official prices checked on trezor.io Oct 5, 2026" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Trezor Safe 5", "category": "Hardware wallet", "vaultrubric_score_pct": 77.2, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2024-01", "type": "data breach" }, { "date": "2025-09", "type": "firmware vulnerability (physical access only; informational, not scored)" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 3.9, "imputed_score": null, "basis": "from $129 (models: None) vs cheapest $49.99", "sources": [ "https://homecryptoinvest.com/articles/trezor-vs-ledger.html" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 9.2, "imputed_score": null, "basis": "base 7, +1.5 secure element, +1 fully open-source firmware, −0.25 data breach (2024-01), 0 firmware vulnerability (2025-09, physical access only, informational)", "sources": [ "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "https://www.referralplug.co.uk/blog/best-crypto-hardware-wallet-ledger-vs-trezor" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 7.2, "imputed_score": null, "basis": "1,000 assets (1,000+ (vendor count)); log-scaled vs max 15,000", "sources": [ "https://www.referralplug.co.uk/blog/best-crypto-hardware-wallet-ledger-vs-trezor" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Straightforward setup, intuitive interface, and touchscreen praised in multiple reviews.", "sources": [ "https://www.techradar.com/reviews/trezor-model-t-cryptocurrency-wallet" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Trustpilot aggregate for trezor.io: 4.6/5 TrustScore from 2,022 reviews; replied to 96% of negative reviews (checked 2026-10-11, company-wide support). Score = 10×(4.6−1)/4 = 9.0. Note: email/ticket + chatbot only, no phone support (trezor.io/support).", "sources": [ "https://www.trustpilot.com/review/trezor.io", "https://trezor.io/support" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Shamir Backup highlighted as strong security feature across independent reviews for seed recovery.", "sources": [ "https://www.nerdwallet.com/investing/learn/trezor-crypto-wallet-review?msockid=11b07946cadb6f8823336f91cb576ec4" ] } ], "score_math": "0.167×3.9 + 0.167×9.2 + 0.167×7.2 + 0.167×8.0 + 0.167×9.0 + 0.167×9.0 = 7.72 → 77.2%", "facts": { "incidents": [ { "date": "2024-01", "type": "data_breach", "summary": "Third-party support portal breach: names/emails of up to 66k support contacts; no seeds/funds", "sources": [ { "url": "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "type": "official" } ] }, { "date": "2025-09", "type": "firmware_vulnerability", "summary": "Trezor advisory / CVE-2025-69893: BIP-39 mnemonic processing side channel (physical access); affects Model One and Model T/Safe 3/Safe 5 on universal firmware with BIP-39 backup; fixed in firmware; no funds loss reported", "sources": [ { "url": "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "type": "official", "as_of": "2026-10-11" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69893", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" } ], "fees_notes": null, "price": { "value": 129, "models": null, "notes": null, "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-05", "says": "official prices checked on trezor.io Oct 5, 2026" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Tangem", "category": "Hardware wallet", "vaultrubric_score_pct": 76.3, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2026-07", "type": "firmware vulnerability (physical access only; informational, not scored)" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 9.1, "imputed_score": null, "basis": "from $54.9 (models: 2-card set) vs cheapest $49.99", "sources": [ "https://tangem.com/en/blog/post/tangem-mobile-wallet-vs-safepal/" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "base 7, +1.5 secure element, +0.5 partially open-source, 0 firmware vulnerability (2026-07, physical access only, informational)", "sources": [ "https://donjon.ledger.com/blog/bypassing-tangem-card-security-with-laser-attack/", "https://tangem.com/en/blog/post/lfi-response/", "https://tangem.com/en/blog/post/tangem-mobile-wallet-vs-safepal/" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 4.7, "imputed_score": null, "basis": "90 assets (90+ blockchains (chains, not coins)); log-scaled vs max 15,000", "sources": [ "https://tangem.com/en/blog/post/tangem-mobile-wallet-vs-safepal/" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Users praise intuitive design and NFC tap simplicity; some connection complaints noted.", "sources": [ "https://uk.trustpilot.com/review/tangem.com?page=2" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Mixed user feedback on connection issues; limited independent support details available.", "sources": [ "https://www.trustpilot.com/review/tangem.com?page=2" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Patented seedless multi-card backup technology highlighted positively in independent review.", "sources": [ "https://www.benzinga.com/markets/cryptocurrency/25/02/43534945/tangem-secures-us-patent-for-seedless-crypto-wallet-backup-technology" ] } ], "score_math": "0.167×9.1 + 0.167×9.0 + 0.167×4.7 + 0.167×8.0 + 0.167×6.0 + 0.167×9.0 = 7.63 → 76.3%", "facts": { "incidents": [ { "date": "2026-07", "type": "firmware_vulnerability", "summary": "Ledger Donjon laser fault-injection attack resets a Tangem card's access code (physical access + ~$250K lab equipment); cards can't be patched; Tangem disputes practicality; no real-world losses known", "sources": [ { "url": "https://donjon.ledger.com/blog/bypassing-tangem-card-security-with-laser-attack/", "type": "third_party", "as_of": "2026-10-11" }, { "url": "https://tangem.com/en/blog/post/lfi-response/", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" } ], "fees_notes": null, "price": { "value": 54.9, "models": null, "notes": "2-card set", "sources": [ { "url": "https://tangem.com/en/blog/post/tangem-mobile-wallet-vs-safepal/", "type": "official (Tangem blog; competitor for SafePal facts)", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Ledger", "category": "Hardware wallet", "vaultrubric_score_pct": 71.5, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2020-07", "type": "data breach" }, { "date": "2023-12", "type": "hacked, Ledger committed to reimburse" }, { "date": "2026-08", "type": "firmware vulnerability" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 6.4, "imputed_score": null, "basis": "from $79 (models: {'Nano S Plus': 79, 'Nano X': 149}) vs cheapest $49.99", "sources": [ "https://homecryptoinvest.com/articles/trezor-vs-ledger.html" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 5.5, "imputed_score": null, "basis": "base 7, +1.5 secure element, +0.5 partially open-source, 0 data breach (2020-07, >48 months, no customer funds lost), −3 customer funds loss (2023-12), −0.5 firmware vulnerability (2026-08)", "sources": [ "https://www.ledger.com/message-ledgers-ceo-data-leak", "https://www.ledger.com/blog/security-incident-report", "https://shop.ledger.com/products/ledger-nano-s-plus" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 10.0, "imputed_score": null, "basis": "15,000 assets (15,000+ coins/tokens (vendor count; 500+ natively in Ledger Wallet app)); log-scaled vs max 15,000", "sources": [ "https://shop.ledger.com/products/ledger-nano-s-plus" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Apps are simple with clean interface but device navigation feels clumsy without touchscreen.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Broad asset support and Ledger Live enable staking, NFTs, DeFi but some UI complaints and third-party needs.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Standard seed phrase required but optional paid recovery service raises trust concerns.", "sources": [ "https://cncintel.com/is-ledger-wallet-safe" ] } ], "score_math": "0.167×6.4 + 0.167×5.5 + 0.167×10.0 + 0.167×8.0 + 0.167×7.0 + 0.167×6.0 = 7.15 → 71.5%", "facts": { "incidents": [ { "date": "2020-07", "type": "data_breach", "summary": "E-commerce DB breach: ~1M emails, ~272k detailed customer records leaked; devices/funds unaffected", "sources": [ { "url": "https://www.ledger.com/message-ledgers-ceo-data-leak", "type": "official" } ] }, { "date": "2023-12", "type": "customer_funds_loss", "customers_reimbursed": true, "summary": "Ledger Connect Kit supply-chain attack: malicious library version drained ~$600K from users blind-signing on EVM dApps; Ledger committed to make victims whole via a claims process (by Feb 2024)", "sources": [ { "url": "https://www.ledger.com/blog/security-incident-report", "type": "official", "as_of": "2026-10-11" }, { "url": "https://support.ledger.com/article/15580506579101-zd", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.theblock.co/news/business/2023-12-20-ledger-to-remove-blind-sign-after-connect-kit-exploit-promises-to-return-funds-268627", "type": "third_party", "as_of": "2026-10-11" } ], "reimbursement_status": "Ledger committed to reimburse" }, { "date": "2026-08", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletins 023 and 025: Secure SDK command-interleaving flaw (fixed SDK v26.6.1) and Ethereum app swap flow that could sign a token approval without display (fixed in app 1.22.3); device OS unaffected; no funds loss reported", "sources": [ { "url": "https://donjon.ledger.com/lsb/025/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://donjon.ledger.com/lsb/023/", "type": "official", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" } ], "fees_notes": null, "price": { "value": 79, "models": { "Nano S Plus": 79, "Nano X": 149 }, "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-03" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Ledger Nano S Plus", "category": "Hardware wallet", "vaultrubric_score_pct": 71.5, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2020-07", "type": "data breach" }, { "date": "2023-12", "type": "hacked, Ledger committed to reimburse" }, { "date": "2026-08", "type": "firmware vulnerability" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 6.4, "imputed_score": null, "basis": "from $79 (models: None) vs cheapest $49.99", "sources": [ "https://homecryptoinvest.com/articles/trezor-vs-ledger.html" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 5.5, "imputed_score": null, "basis": "base 7, +1.5 secure element, +0.5 partially open-source, 0 data breach (2020-07, >48 months, no customer funds lost), −3 customer funds loss (2023-12), −0.5 firmware vulnerability (2026-08)", "sources": [ "https://www.ledger.com/message-ledgers-ceo-data-leak", "https://www.ledger.com/blog/security-incident-report", "https://shop.ledger.com/products/ledger-nano-s-plus" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 10.0, "imputed_score": null, "basis": "15,000 assets (15,000+ coins/tokens (vendor count)); log-scaled vs max 15,000", "sources": [ "https://shop.ledger.com/products/ledger-nano-s-plus" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Straightforward setup and clean interface, though navigation can feel clumsy.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Broad asset support and Ledger Live app praised, with good staking and third-party options.", "sources": [ "https://www.finder.com/cryptocurrency/wallets/best-cryptocurrency-hardware-wallets" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Relies on 24-word recovery phrase but optional paid service raises security concerns.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] } ], "score_math": "0.167×6.4 + 0.167×5.5 + 0.167×10.0 + 0.167×8.0 + 0.167×7.0 + 0.167×6.0 = 7.15 → 71.5%", "facts": { "incidents": [ { "date": "2020-07", "type": "data_breach", "summary": "E-commerce DB breach: ~1M emails, ~272k detailed customer records leaked; devices/funds unaffected", "sources": [ { "url": "https://www.ledger.com/message-ledgers-ceo-data-leak", "type": "official" } ] }, { "date": "2023-12", "type": "customer_funds_loss", "customers_reimbursed": true, "summary": "Ledger Connect Kit supply-chain attack: malicious library version drained ~$600K from users blind-signing on EVM dApps; Ledger committed to make victims whole via a claims process (by Feb 2024)", "sources": [ { "url": "https://www.ledger.com/blog/security-incident-report", "type": "official", "as_of": "2026-10-11" }, { "url": "https://support.ledger.com/article/15580506579101-zd", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.theblock.co/news/business/2023-12-20-ledger-to-remove-blind-sign-after-connect-kit-exploit-promises-to-return-funds-268627", "type": "third_party", "as_of": "2026-10-11" } ], "reimbursement_status": "Ledger committed to reimburse" }, { "date": "2026-08", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletins 023 and 025: Secure SDK command-interleaving flaw (fixed SDK v26.6.1) and Ethereum app swap flow that could sign a token approval without display (fixed in app 1.22.3); device OS unaffected; no funds loss reported", "sources": [ { "url": "https://donjon.ledger.com/lsb/025/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://donjon.ledger.com/lsb/023/", "type": "official", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" } ], "fees_notes": null, "price": { "value": 79, "models": null, "notes": null, "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-05", "says": "official prices checked on trezor.io Oct 5, 2026" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "NGRAVE ZERO", "category": "Hardware wallet", "vaultrubric_score_pct": 69.3, "data_coverage_pct": 83, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 1.3, "imputed_score": null, "basis": "from $398 (models: None) vs cheapest $49.99", "sources": [ "https://walletinsights.io/en/compare/bitbox02-vs-ngrave-zero/" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 8.5, "imputed_score": null, "basis": "3,500 assets ('+3 500 coins and tokens' per NGRAVE); log-scaled vs max 15,000", "sources": [ "https://www.ngrave.io/en/zero" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.8, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. ", "sources": [ "https://www.finder.com/ngrave-review", "https://www.finder.com/cryptocurrency/wallets/ngrave-review", "https://www.trustpilot.com/review/ngrave.io" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Multiple user reviews praise responsive and excellent customer service", "sources": [ "https://www.trustpilot.com/review/ngrave.io?page=3" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "GRAPHENE stainless steel backup praised as secure and recoverable", "sources": [ "https://www.finder.com/ngrave-review" ] } ], "score_math": "0.167×1.3 + 0.167×5.0* + 0.167×8.5 + 0.167×8.8 + 0.167×9.0 + 0.167×9.0 = 6.93 → 69.3% (* unknown, imputed)", "facts": { "incidents": [], "fees_notes": null, "price": { "value": 398, "models": null, "notes": null, "sources": [ { "url": "https://walletinsights.io/en/compare/bitbox02-vs-ngrave-zero/", "type": "third_party", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "SafePal S1", "category": "Hardware wallet", "vaultrubric_score_pct": 69.2, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2026-08", "type": "data breach" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 10.0, "imputed_score": null, "basis": "from $49.99 (models: None) vs cheapest $49.99", "sources": [ "https://safepal.com/en/store/s1pro" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "base 7, +1.5 secure element, −0.5 data breach (2026-08)", "sources": [ "https://www.coindesk.com/tech/2026/08/16/crypto-wallet-safepal-reveals-a-data-breach-exposing-nearly-40-000-customers-order-info", "https://tangem.com/en/blog/post/tangem-mobile-wallet-vs-safepal/" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 5.5, "imputed_score": null, "basis": "200 assets (200+ blockchains (per Tangem blog)); log-scaled vs max 15,000", "sources": [ "https://tangem.com/en/blog/post/tangem-mobile-wallet-vs-safepal/" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Users find it easy to use with broad support, though DApp QR scanning can be cumbersome.", "sources": [ "https://www.reddit.com/r/safePal/comments/1daq7bb/can_the_safepal_x1_be_used_with_browser_extension" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 3.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Frequent complaints of slow or inadequate responses, with users encountering delays and scams.", "sources": [ "https://www.trustpilot.com/review/safepal.com" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Standard seed phrase setup with optional secure physical backup board mentioned positively.", "sources": [ "https://www.benzinga.com/money/safepal-review" ] } ], "score_math": "0.167×10.0 + 0.167×8.0 + 0.167×5.5 + 0.167×7.0 + 0.167×3.0 + 0.167×8.0 = 6.92 → 69.2%", "facts": { "incidents": [ { "date": "2026-08", "type": "data_breach", "summary": "SafePal order-tracking plug-in authorization flaw exposed names, addresses and contact details of 39,798 customers (orders Mar 2025–Apr 2026); SafePal: no seeds, keys or funds affected", "sources": [ { "url": "https://www.coindesk.com/tech/2026/08/16/crypto-wallet-safepal-reveals-a-data-breach-exposing-nearly-40-000-customers-order-info", "type": "third_party", "as_of": "2026-10-11" } ] } ], "fees_notes": null, "price": { "value": 49.99, "models": null, "notes": null, "sources": [ { "url": "https://safepal.com/en/store/s1pro", "type": "official", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "BitBox02", "category": "Hardware wallet", "vaultrubric_score_pct": 69.0, "data_coverage_pct": 83, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2026-07", "type": "firmware vulnerability" }, { "date": "2026-08", "type": "firmware vulnerability" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 2.9, "imputed_score": null, "basis": "from $174 (models: Official shop pages showed $174 and $167 on 2026-10-10 (possible promo); Nova model $204) vs cheapest $49.99", "sources": [ "https://shop.bitbox.swiss/en/products/collection/products-1/" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 8.5, "imputed_score": null, "basis": "base 7, +1.5 secure element, +1 fully open-source firmware, −0.5 firmware vulnerability (2026-07), −0.5 firmware vulnerability (2026-08)", "sources": [ "https://cryptonews.net/news/security/33358025/", "https://crypto.news/bitbox-patches-wallet-flaws-that-could-install-malicious-firmware/", "https://walletinsights.io/en/hardware-wallets/bitbox02/" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Users praise straightforward setup and use, though some note passphrase complexity.", "sources": [ "https://ca.trustpilot.com/review/bitbox.swiss?page=7" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Multiple reviews highlight fast, professional, and helpful customer support.", "sources": [ "https://ca.trustpilot.com/review/bitbox.swiss?page=7" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "MicroSD card backup during setup is simple and allows seed management.", "sources": [ "https://cryptomaan.eu/wallet/bitbox02-review" ] } ], "score_math": "0.167×2.9 + 0.167×8.5 + 0.167×5.0* + 0.167×8.0 + 0.167×9.0 + 0.167×8.0 = 6.90 → 69.0% (* unknown, imputed)", "facts": { "incidents": [ { "date": "2026-07", "type": "firmware_vulnerability", "summary": "BitBox02 USB HID out-of-bounds write (reported by CertiK) fixed in July 'Oeschinen' firmware update; no exploitation reported", "sources": [ { "url": "https://cryptonews.net/news/security/33358025/", "type": "third_party", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" }, { "date": "2026-08", "type": "firmware_vulnerability", "summary": "BitBox disclosed two severe flaws (memory corruption on unconfigured Multi editions enabling malicious firmware; Silent Payments flaw that could lock BTC to an unintended address); fixed; BitBox: not exploited, no funds lost", "sources": [ { "url": "https://crypto.news/bitbox-patches-wallet-flaws-that-could-install-malicious-firmware/", "type": "third_party", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" } ], "fees_notes": null, "price": { "value": 174, "models": null, "notes": "Official shop pages showed $174 and $167 on 2026-10-10 (possible promo); Nova model $204", "sources": [ { "url": "https://shop.bitbox.swiss/en/products/collection/products-1/", "type": "official", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": "Switzerland", "us": null, "us_note": null, "regions": null } }, { "name": "Trezor Model One", "category": "Hardware wallet", "vaultrubric_score_pct": 67.7, "data_coverage_pct": 67, "limited_data": true, "eligible_for_pick": false, "customer_funds_hack": null, "incident_notes": [ { "date": "2024-01", "type": "data breach" }, { "date": "2025-09", "type": "firmware vulnerability (physical access only; informational, not scored)" }, { "date": "2026-02", "type": "firmware vulnerability" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 3.4, "basis": "not found", "sources": [] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 6.2, "imputed_score": null, "basis": "base 7, −0.25 data breach (2024-01), 0 firmware vulnerability (2025-09, physical access only, informational), −0.5 firmware vulnerability (2026-02)", "sources": [ "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Straightforward setup, intuitive interface, touchscreen aids PIN entry", "sources": [ "https://www.finder.com/cryptocurrency/wallets/trezor-model-t-wallet-review" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Trustpilot aggregate for trezor.io: 4.6/5 TrustScore from 2,022 reviews; replied to 96% of negative reviews (checked 2026-10-11, company-wide support). Score = 10×(4.6−1)/4 = 9.0. Note: email/ticket + chatbot only, no phone support (trezor.io/support).", "sources": [ "https://www.trustpilot.com/review/trezor.io", "https://trezor.io/support" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Shamir Backup provides advanced multi-share recovery superior to standard seed phrases", "sources": [ "https://www.nerdwallet.com/investing/learn/trezor-crypto-wallet-review?msockid=11b07946cadb6f8823336f91cb576ec4" ] } ], "score_math": "0.167×3.4* + 0.167×6.2 + 0.167×5.0* + 0.167×8.0 + 0.167×9.0 + 0.167×9.0 = 6.77 → 67.7% (* unknown, imputed)", "facts": { "incidents": [ { "date": "2024-01", "type": "data_breach", "summary": "Third-party support portal breach: names/emails of up to 66k support contacts; no seeds/funds", "sources": [ { "url": "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "type": "official" } ] }, { "date": "2025-09", "type": "firmware_vulnerability", "summary": "Trezor advisory / CVE-2025-69893: BIP-39 mnemonic processing side channel (physical access); affects Model One and Model T/Safe 3/Safe 5 on universal firmware with BIP-39 backup; fixed in firmware; no funds loss reported", "sources": [ { "url": "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "type": "official", "as_of": "2026-10-11" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69893", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" }, { "date": "2026-02", "type": "firmware_vulnerability", "summary": "Trezor Model One recovery-flow padding weakness for 12/18-word seeds (repeated checks reveal fake words); mitigated by disabling Standard Recovery for 12/18 words", "sources": [ { "url": "https://trezor.io/vulnerability/recovery-flow-padding-weakness-on-model-one-with-12-18-words", "type": "official", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" } ], "fees_notes": null, "price": { "value": null, "models": null, "notes": "Discontinued Jan 8, 2026 (still supported); no current official price", "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-05", "says": "official prices checked on trezor.io Oct 5, 2026" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Ledger Nano X", "category": "Hardware wallet", "vaultrubric_score_pct": 66.5, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2020-07", "type": "data breach" }, { "date": "2023-12", "type": "hacked, Ledger committed to reimburse" }, { "date": "2025-01", "type": "firmware vulnerability (physical access only; informational, not scored)" }, { "date": "2026-08", "type": "firmware vulnerability" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 3.4, "imputed_score": null, "basis": "from $149 (models: None) vs cheapest $49.99", "sources": [ "https://homecryptoinvest.com/articles/trezor-vs-ledger.html" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 5.5, "imputed_score": null, "basis": "base 7, +1.5 secure element, +0.5 partially open-source, 0 data breach (2020-07, >48 months, no customer funds lost), −3 customer funds loss (2023-12), 0 firmware vulnerability (2025-01, physical access only, informational), −0.5 firmware vulnerability (2026-08)", "sources": [ "https://www.ledger.com/message-ledgers-ceo-data-leak", "https://www.ledger.com/blog/security-incident-report", "https://www.referralplug.co.uk/blog/best-crypto-hardware-wallet-ledger-vs-trezor" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 10.0, "imputed_score": null, "basis": "15,000 assets (15,000+ coins/tokens (vendor count)); log-scaled vs max 15,000", "sources": [ "https://shop.ledger.com/products/ledger-nano-s-plus" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Straightforward with clean apps but navigation feels clumsy without touchscreen.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Broad asset support, staking, DeFi, NFTs and strong app ecosystem noted in reviews.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Standard seed phrase required but optional paid recovery service raises trust concerns.", "sources": [ "https://www.coindesk.com/tech/2023/05/16/ledger-bats-back-criticism-of-new-wallet-recovery-service" ] } ], "score_math": "0.167×3.4 + 0.167×5.5 + 0.167×10.0 + 0.167×7.0 + 0.167×8.0 + 0.167×6.0 = 6.65 → 66.5%", "facts": { "incidents": [ { "date": "2020-07", "type": "data_breach", "summary": "E-commerce DB breach: ~1M emails, ~272k detailed customer records leaked; devices/funds unaffected", "sources": [ { "url": "https://www.ledger.com/message-ledgers-ceo-data-leak", "type": "official" } ] }, { "date": "2023-12", "type": "customer_funds_loss", "customers_reimbursed": true, "summary": "Ledger Connect Kit supply-chain attack: malicious library version drained ~$600K from users blind-signing on EVM dApps; Ledger committed to make victims whole via a claims process (by Feb 2024)", "sources": [ { "url": "https://www.ledger.com/blog/security-incident-report", "type": "official", "as_of": "2026-10-11" }, { "url": "https://support.ledger.com/article/15580506579101-zd", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.theblock.co/news/business/2023-12-20-ledger-to-remove-blind-sign-after-connect-kit-exploit-promises-to-return-funds-268627", "type": "third_party", "as_of": "2026-10-11" } ], "reimbursement_status": "Ledger committed to reimburse" }, { "date": "2025-01", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletin 021 / CVE-2025-15645: missing validation in MCU firmware update could brick Nano X, Flex, Stax; fixed (Nano X 2.4.2, Flex 1.2.2, Stax 1.6.2); Ledger: client funds never at risk", "sources": [ { "url": "https://donjon.ledger.com/lsb/021/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15645", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" }, { "date": "2026-08", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletins 023 and 025: Secure SDK command-interleaving flaw (fixed SDK v26.6.1) and Ethereum app swap flow that could sign a token approval without display (fixed in app 1.22.3); device OS unaffected; no funds loss reported", "sources": [ { "url": "https://donjon.ledger.com/lsb/025/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://donjon.ledger.com/lsb/023/", "type": "official", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" } ], "fees_notes": null, "price": { "value": 149, "models": null, "notes": null, "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-05", "says": "official prices checked on trezor.io Oct 5, 2026" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Trezor Model T", "category": "Hardware wallet", "vaultrubric_score_pct": 66.0, "data_coverage_pct": 67, "limited_data": true, "eligible_for_pick": false, "customer_funds_hack": null, "incident_notes": [ { "date": "2024-01", "type": "data breach" }, { "date": "2025-09", "type": "firmware vulnerability (physical access only; informational, not scored)" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 3.4, "basis": "not found", "sources": [] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 5.2, "imputed_score": null, "basis": "base 7, −1.5 hot wallet (no secure element), −0.25 data breach (2024-01), 0 firmware vulnerability (2025-09, physical access only, informational)", "sources": [ "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "https://walletinsights.io/en/hardware-wallets/bitbox02/" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Touchscreen, intuitive interface, straightforward setup praised in multiple reviews", "sources": [ "https://www.techradar.com/reviews/trezor-model-t-cryptocurrency-wallet" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Trustpilot aggregate for trezor.io: 4.6/5 TrustScore from 2,022 reviews; replied to 96% of negative reviews (checked 2026-10-11, company-wide support). Score = 10×(4.6−1)/4 = 9.0. Note: email/ticket + chatbot only, no phone support (trezor.io/support).", "sources": [ "https://www.trustpilot.com/review/trezor.io", "https://trezor.io/support" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Shamir Backup provides advanced multi-share recovery, sets it apart from competitors", "sources": [ "https://money.com/trezor-crypto-wallet-review" ] } ], "score_math": "0.167×3.4* + 0.167×5.2 + 0.167×5.0* + 0.167×8.0 + 0.167×9.0 + 0.167×9.0 = 6.60 → 66.0% (* unknown, imputed)", "facts": { "incidents": [ { "date": "2024-01", "type": "data_breach", "summary": "Third-party support portal breach: names/emails of up to 66k support contacts; no seeds/funds", "sources": [ { "url": "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "type": "official" } ] }, { "date": "2025-09", "type": "firmware_vulnerability", "summary": "Trezor advisory / CVE-2025-69893: BIP-39 mnemonic processing side channel (physical access); affects Model One and Model T/Safe 3/Safe 5 on universal firmware with BIP-39 backup; fixed in firmware; no funds loss reported", "sources": [ { "url": "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "type": "official", "as_of": "2026-10-11" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69893", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" } ], "fees_notes": null, "price": { "value": null, "models": null, "notes": "Discontinued Jan 8, 2026 (still supported); no current official price", "sources": [ { "url": "https://homecryptoinvest.com/articles/trezor-vs-ledger.html", "type": "third_party", "as_of": "2026-10-05", "says": "official prices checked on trezor.io Oct 5, 2026" }, { "url": "https://walletinsights.io/en/hardware-wallets/bitbox02/", "type": "third_party", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Keystone 3 Pro", "category": "Hardware wallet", "vaultrubric_score_pct": 63.2, "data_coverage_pct": 83, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2026-04", "type": "firmware vulnerability (physical access only; informational, not scored)" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 3.4, "imputed_score": null, "basis": "from $149 (models: None) vs cheapest $49.99", "sources": [ "https://keyst.one/shop/products/keystone-3-pro" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 8.5, "imputed_score": null, "basis": "base 7, +1.5 secure element, 0 firmware vulnerability (2026-04, physical access only, informational)", "sources": [ "https://onekey.so/blog/learn/usb-sdk-vulnerability-hardware-wallet-seed-extraction/", "https://keyst.one/shop/products/keystone-3-pro" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Users praise intuitive touchscreen, easy setup and navigation over button-mashing wallets.", "sources": [ "https://ca.trustpilot.com/review/keyst.one?page=2" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Mixed experiences with timely resolutions but also reports of delayed email responses.", "sources": [ "https://www.trustpilot.com/review/keyst.one?page=2" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Shamir backup offered but criticized as misleading and not matching industry-standard SLIP-0039.", "sources": [ "https://ca.trustpilot.com/review/keyst.one?page=6" ] } ], "score_math": "0.167×3.4 + 0.167×8.5 + 0.167×5.0* + 0.167×8.0 + 0.167×7.0 + 0.167×6.0 = 6.32 → 63.2% (* unknown, imputed)", "facts": { "incidents": [ { "date": "2026-04", "type": "firmware_vulnerability", "summary": "Keystone 3 Pro USB SDK flaw allowing seed extraction (requires physical possession, PIN and malicious host); fixed in firmware v2.4.0 (2026-04-01); no exploitation found", "sources": [ { "url": "https://onekey.so/blog/learn/usb-sdk-vulnerability-hardware-wallet-seed-extraction/", "type": "third_party", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" } ], "fees_notes": null, "price": { "value": 149, "models": null, "notes": null, "sources": [ { "url": "https://keyst.one/shop/products/keystone-3-pro", "type": "official", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Ellipal Titan 2.0", "category": "Hardware wallet", "vaultrubric_score_pct": 62.5, "data_coverage_pct": 83, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 3.0, "imputed_score": null, "basis": "from $169 (models: None) vs cheapest $49.99", "sources": [ "https://www.ellipal.com/products/ellipal-titan" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 8.5, "imputed_score": null, "basis": "base 7, +1.5 secure element", "sources": [ "https://www.ellipal.com/products/ellipal-titan-2-0" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Setup is straightforward with intuitive interface and QR code usage, though some users report connection and network errors.", "sources": [ "https://cointelegraph.com/learn/articles/ellipal-titan-2-0-review" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Mixed user experiences with some quick helpful responses but frequent complaints of unresponsiveness and poor handling of issues.", "sources": [ "https://ie.trustpilot.com/review/ellipal.com?page=6" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Strong emphasis on secure offline seed phrase storage with recommended metal backup accessory and clear warnings.", "sources": [ "https://cointelegraph.com/learn/articles/ellipal-titan-2-0-review" ] } ], "score_math": "0.167×3.0 + 0.167×8.5 + 0.167×5.0* + 0.167×7.0 + 0.167×6.0 + 0.167×8.0 = 6.25 → 62.5% (* unknown, imputed)", "facts": { "incidents": [], "fees_notes": null, "price": { "value": 169, "models": null, "notes": null, "sources": [ { "url": "https://www.ellipal.com/products/ellipal-titan", "type": "official", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": "Ships to 140+ countries" } }, { "name": "Foundation Passport", "category": "Hardware wallet", "vaultrubric_score_pct": 60.8, "data_coverage_pct": 67, "limited_data": true, "eligible_for_pick": false, "customer_funds_hack": null, "incident_notes": [], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 1.5, "imputed_score": null, "basis": "from $349 (models: Passport Prime price per WalletInsights) vs cheapest $49.99", "sources": [ "https://walletinsights.io/en/hardware-wallets/bitbox02/" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Intuitive interface praised in reviews despite air-gapped friction", "sources": [ "https://www.bitcoinproducts.com/blog/foundation-passport-review-six-months-daily-use" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer service consistently quick and helpful per user feedback", "sources": [ "https://cryptolinks.com/2215/passport" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Secure 24-word seed phrase enables easy recovery on compatible wallets", "sources": [ "https://www.thecryptomerchant.com/blogs/resources/the-ultimate-guide-to-the-foundation-passport-hardware-wallet-a-secure-solution-for-your-bitcoin" ] } ], "score_math": "0.167×1.5 + 0.167×5.0* + 0.167×5.0* + 0.167×8.0 + 0.167×9.0 + 0.167×8.0 = 6.08 → 60.8% (* unknown, imputed)", "facts": { "incidents": [], "fees_notes": null, "price": { "value": 349, "models": null, "notes": "Passport Prime price per WalletInsights", "sources": [ { "url": "https://walletinsights.io/en/hardware-wallets/bitbox02/", "type": "third_party", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Ledger Flex", "category": "Hardware wallet", "vaultrubric_score_pct": 52.5, "data_coverage_pct": 83, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2020-07", "type": "data breach" }, { "date": "2023-12", "type": "hacked, Ledger committed to reimburse" }, { "date": "2025-01", "type": "firmware vulnerability (physical access only; informational, not scored)" }, { "date": "2026-08", "type": "firmware vulnerability" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 2.0, "imputed_score": null, "basis": "from $249 (models: None) vs cheapest $49.99", "sources": [ "https://shop.ledger.com/pages/ledger-flex" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 3.5, "imputed_score": null, "basis": "base 7, 0 data breach (2020-07, >48 months, no customer funds lost), −3 customer funds loss (2023-12), 0 firmware vulnerability (2025-01, physical access only, informational), −0.5 firmware vulnerability (2026-08)", "sources": [ "https://www.ledger.com/message-ledgers-ceo-data-leak", "https://www.ledger.com/blog/security-incident-report" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Generally straightforward with clean apps but navigation can feel clumsy without touchscreen.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Ledger Live app is well-regarded for managing assets, staking, and broad usability across platforms.", "sources": [ "https://www.finder.com/cryptocurrency/wallets/best-cryptocurrency-hardware-wallets" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Relies on 24-word seed phrase with optional paid recovery service that has drawn criticism and trust concerns.", "sources": [ "https://www.coindesk.com/tech/2023/05/16/ledger-bats-back-criticism-of-new-wallet-recovery-service" ] } ], "score_math": "0.167×2.0 + 0.167×3.5 + 0.167×5.0* + 0.167×7.0 + 0.167×8.0 + 0.167×6.0 = 5.25 → 52.5% (* unknown, imputed)", "facts": { "incidents": [ { "date": "2020-07", "type": "data_breach", "summary": "E-commerce DB breach: ~1M emails, ~272k detailed customer records leaked; devices/funds unaffected", "sources": [ { "url": "https://www.ledger.com/message-ledgers-ceo-data-leak", "type": "official" } ] }, { "date": "2023-12", "type": "customer_funds_loss", "customers_reimbursed": true, "summary": "Ledger Connect Kit supply-chain attack: malicious library version drained ~$600K from users blind-signing on EVM dApps; Ledger committed to make victims whole via a claims process (by Feb 2024)", "sources": [ { "url": "https://www.ledger.com/blog/security-incident-report", "type": "official", "as_of": "2026-10-11" }, { "url": "https://support.ledger.com/article/15580506579101-zd", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.theblock.co/news/business/2023-12-20-ledger-to-remove-blind-sign-after-connect-kit-exploit-promises-to-return-funds-268627", "type": "third_party", "as_of": "2026-10-11" } ], "reimbursement_status": "Ledger committed to reimburse" }, { "date": "2025-01", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletin 021 / CVE-2025-15645: missing validation in MCU firmware update could brick Nano X, Flex, Stax; fixed (Nano X 2.4.2, Flex 1.2.2, Stax 1.6.2); Ledger: client funds never at risk", "sources": [ { "url": "https://donjon.ledger.com/lsb/021/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15645", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" }, { "date": "2026-08", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletins 023 and 025: Secure SDK command-interleaving flaw (fixed SDK v26.6.1) and Ethereum app swap flow that could sign a token approval without display (fixed in app 1.22.3); device OS unaffected; no funds loss reported", "sources": [ { "url": "https://donjon.ledger.com/lsb/025/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://donjon.ledger.com/lsb/023/", "type": "official", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" } ], "fees_notes": null, "price": { "value": 249, "models": null, "notes": null, "sources": [ { "url": "https://shop.ledger.com/pages/ledger-flex", "type": "official", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Ledger Stax", "category": "Hardware wallet", "vaultrubric_score_pct": 50.5, "data_coverage_pct": 83, "limited_data": false, "eligible_for_pick": true, "customer_funds_hack": null, "incident_notes": [ { "date": "2020-07", "type": "data breach" }, { "date": "2023-12", "type": "hacked, Ledger committed to reimburse" }, { "date": "2025-01", "type": "firmware vulnerability (physical access only; informational, not scored)" }, { "date": "2026-08", "type": "firmware vulnerability" } ], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 1.3, "imputed_score": null, "basis": "from $399 (models: None) vs cheapest $49.99", "sources": [ "https://shop.ledger.com/pages/ledger-flex" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 3.5, "imputed_score": null, "basis": "base 7, 0 data breach (2020-07, >48 months, no customer funds lost), −3 customer funds loss (2023-12), 0 firmware vulnerability (2025-01, physical access only, informational), −0.5 firmware vulnerability (2026-08)", "sources": [ "https://www.ledger.com/message-ledgers-ceo-data-leak", "https://www.ledger.com/blog/security-incident-report" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Straightforward with clean interfaces but navigation can feel clumsy without touchscreen on some models.", "sources": [ "https://www.techradar.com/reviews/ledger-nano-x-cryptocurrency-wallet-review" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 7.5, "imputed_score": null, "basis": "Ledger Live app is well-rated for usability and asset management with positive user feedback.", "sources": [ "https://apps.apple.com/sg/app/1361671700?see-all=reviews&platform=iphone" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Relies on seed phrase with optional paid recovery service that has drawn criticism for security concerns.", "sources": [ "https://www.coindesk.com/tech/2023/05/16/ledger-bats-back-criticism-of-new-wallet-recovery-service" ] } ], "score_math": "0.167×1.3 + 0.167×3.5 + 0.167×5.0* + 0.167×7.0 + 0.167×7.5 + 0.167×6.0 = 5.05 → 50.5% (* unknown, imputed)", "facts": { "incidents": [ { "date": "2020-07", "type": "data_breach", "summary": "E-commerce DB breach: ~1M emails, ~272k detailed customer records leaked; devices/funds unaffected", "sources": [ { "url": "https://www.ledger.com/message-ledgers-ceo-data-leak", "type": "official" } ] }, { "date": "2023-12", "type": "customer_funds_loss", "customers_reimbursed": true, "summary": "Ledger Connect Kit supply-chain attack: malicious library version drained ~$600K from users blind-signing on EVM dApps; Ledger committed to make victims whole via a claims process (by Feb 2024)", "sources": [ { "url": "https://www.ledger.com/blog/security-incident-report", "type": "official", "as_of": "2026-10-11" }, { "url": "https://support.ledger.com/article/15580506579101-zd", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.theblock.co/news/business/2023-12-20-ledger-to-remove-blind-sign-after-connect-kit-exploit-promises-to-return-funds-268627", "type": "third_party", "as_of": "2026-10-11" } ], "reimbursement_status": "Ledger committed to reimburse" }, { "date": "2025-01", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletin 021 / CVE-2025-15645: missing validation in MCU firmware update could brick Nano X, Flex, Stax; fixed (Nano X 2.4.2, Flex 1.2.2, Stax 1.6.2); Ledger: client funds never at risk", "sources": [ { "url": "https://donjon.ledger.com/lsb/021/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15645", "type": "official", "as_of": "2026-10-11" } ], "remote": false, "access": "physical" }, { "date": "2026-08", "type": "firmware_vulnerability", "summary": "Ledger Security Bulletins 023 and 025: Secure SDK command-interleaving flaw (fixed SDK v26.6.1) and Ethereum app swap flow that could sign a token approval without display (fixed in app 1.22.3); device OS unaffected; no funds loss reported", "sources": [ { "url": "https://donjon.ledger.com/lsb/025/", "type": "official", "as_of": "2026-10-11" }, { "url": "https://donjon.ledger.com/lsb/023/", "type": "official", "as_of": "2026-10-11" } ], "remote": true, "access": "remote (malicious host/software/network)" } ], "fees_notes": null, "price": { "value": 399, "models": null, "notes": null, "sources": [ { "url": "https://shop.ledger.com/pages/ledger-flex", "type": "official", "as_of": "2026-10-10" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Coldcard Mk5", "category": "Hardware wallet", "vaultrubric_score_pct": 49.2, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": false, "customer_funds_hack": { "date": "2026-07", "summary": "Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement", "months_ago": 3, "reimbursed": false }, "incident_notes": [], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 2.3, "imputed_score": null, "basis": "from $219 (models: Official store price (list $269)) vs cheapest $49.99", "sources": [ "https://coldcard.com/mk5", "https://store.coinkite.com/store/coldcard" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 6.5, "imputed_score": null, "basis": "base 7, +1.5 secure element, +1 fully open-source firmware, −3 customer funds loss (2026-07)", "sources": [ "https://coldcard.com/security/status", "https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack", "https://coldcard.com/docs/coldcard-mk5/" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 0.7, "imputed_score": null, "basis": "1 assets (Bitcoin-only); log-scaled vs max 15,000", "sources": [ "https://coldcard.com/mk5" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Improved UX with better display, NFC, and intuitive design noted in reviews.", "sources": [ "https://crypto.news/coldcard-mk5-ships-with-5-major-wallet-upgrades" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 4.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. Mixed user feedback on handling of issues like WiFi bugs and refunds.", "sources": [ "https://www.trustpilot.com/review/coinkite.com" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 9.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. ", "sources": [ "https://www.trustpilot.com/review/coinkite.com", "https://www.reddit.com/r/coldcard/comments/18uyzse/anxiety_with_btc_on_ledger_and_coldcard", "https://coldcard.com/compare/coldcard-q-vs-mk5" ] } ], "score_math": "0.167×2.3 + 0.167×6.5 + 0.167×0.7 + 0.167×7.0 + 0.167×4.0 + 0.167×9.0 = 4.92 → 49.2%", "facts": { "incidents": [ { "date": "2026-07", "type": "customer_funds_loss", "customers_reimbursed": false, "summary": "Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement", "sources": [ { "url": "https://coldcard.com/security/status", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack", "type": "third_party", "as_of": "2026-10-11" }, { "url": "https://www.forbes.com/sites/boazsobrado/2026/08/04/i-did-everything-right-ai-warning-after-116-million-bitcoin-hack/", "type": "third_party", "as_of": "2026-10-11" } ] } ], "fees_notes": null, "price": { "value": 219, "models": null, "notes": "Official store price (list $269)", "sources": [ { "url": "https://coldcard.com/mk5", "type": "official", "as_of": "2026-10-11", "says": "Buy Now $219 USD" }, { "url": "https://store.coinkite.com/store/coldcard", "type": "official", "as_of": "2026-10-11" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Coldcard Mk4", "category": "Hardware wallet", "vaultrubric_score_pct": 47.7, "data_coverage_pct": 67, "limited_data": true, "eligible_for_pick": false, "customer_funds_hack": { "date": "2026-07", "summary": "Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement", "months_ago": 3, "reimbursed": false }, "incident_notes": [], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 3.4, "basis": "not found", "sources": [] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 6.5, "imputed_score": null, "basis": "base 7, +1.5 secure element, +1 fully open-source firmware, −3 customer funds loss (2026-07)", "sources": [ "https://coldcard.com/security/status", "https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack", "https://coldcard.com/" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 0.7, "imputed_score": null, "basis": "1 assets (Bitcoin-only); log-scaled vs max 15,000", "sources": [ "https://walletinsights.io/en/hardware-wallets/bitbox02/" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Air-gapped setup and PIN entry add friction but QR/NFC upgrades improve UX over Mk4", "sources": [ "https://www.reddit.com/r/coldcard/comments/1bzi8e7/coldcard_q_quality_of_life_at_a_price" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": null, "imputed_score": 5.0, "basis": "not found", "sources": [] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 7.0, "imputed_score": null, "basis": "Emphasizes seed phrase management and dice-roll entropy for secure backups", "sources": [ "https://www.coindesk.com/tech/2026/08/04/coldcard-urges-users-to-move-bitcoin-as-active-wallet-exploit-continues" ] } ], "score_math": "0.167×3.4* + 0.167×6.5 + 0.167×0.7 + 0.167×6.0 + 0.167×5.0* + 0.167×7.0 = 4.77 → 47.7% (* unknown, imputed)", "facts": { "incidents": [ { "date": "2026-07", "type": "customer_funds_loss", "customers_reimbursed": false, "summary": "Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement", "sources": [ { "url": "https://coldcard.com/security/status", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack", "type": "third_party", "as_of": "2026-10-11" }, { "url": "https://www.forbes.com/sites/boazsobrado/2026/08/04/i-did-everything-right-ai-warning-after-116-million-bitcoin-hack/", "type": "third_party", "as_of": "2026-10-11" } ] } ], "fees_notes": null, "price": { "value": null, "models": null, "notes": "Mk4 no longer listed on the official Coinkite store (replaced by Mk5 at $219); price unknown", "sources": [ { "url": "https://store.coinkite.com/store/coldcard", "type": "official", "as_of": "2026-10-11", "says": "Mk4 not listed" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } }, { "name": "Coldcard Q", "category": "Hardware wallet", "vaultrubric_score_pct": 40.5, "data_coverage_pct": 100, "limited_data": false, "eligible_for_pick": false, "customer_funds_hack": { "date": "2026-07", "summary": "Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement", "months_ago": 3, "reimbursed": false }, "incident_notes": [], "criteria": [ { "key": "price", "label": "Price", "weight": 0.1667, "score_out_of_10": 1.6, "imputed_score": null, "basis": "from $319 (models: Official store price (list $369)) vs cheapest $49.99", "sources": [ "https://store.coinkite.com/store/coldcard" ] }, { "key": "security", "label": "Security", "weight": 0.1667, "score_out_of_10": 4.0, "imputed_score": null, "basis": "base 7, −3 customer funds loss (2026-07)", "sources": [ "https://coldcard.com/security/status", "https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack" ] }, { "key": "coins", "label": "Supported coins", "weight": 0.1667, "score_out_of_10": 0.7, "imputed_score": null, "basis": "1 assets (Bitcoin-only); log-scaled vs max 15,000", "sources": [ "https://walletinsights.io/en/hardware-wallets/bitbox02/" ] }, { "key": "ease_of_use", "label": "Ease of use", "weight": 0.1667, "score_out_of_10": 6.0, "imputed_score": null, "basis": "Mixed feedback on usability; advanced but complex with some hardware complaints.", "sources": [ "https://www.reddit.com/r/coldcard/comments/s20xnh/understanding_gap_limit_and_limitation_of_250" ] }, { "key": "support", "label": "Support", "weight": 0.1667, "score_out_of_10": 4.0, "imputed_score": null, "basis": "Customer reviews (Trustpilot), may skew positive. User complaints about unresolved hardware issues and poor response on critical bug.", "sources": [ "https://www.trustpilot.com/review/coinkite.com" ] }, { "key": "backup", "label": "Backup/recovery", "weight": 0.1667, "score_out_of_10": 8.0, "imputed_score": null, "basis": "Strong mentions of microSD encrypted backups and secure notes as key features.", "sources": [ "https://www.reddit.com/r/coldcard/comments/s20xnh/understanding_gap_limit_and_limitation_of_250" ] } ], "score_math": "0.167×1.6 + 0.167×4.0 + 0.167×0.7 + 0.167×6.0 + 0.167×4.0 + 0.167×8.0 = 4.05 → 40.5%", "facts": { "incidents": [ { "date": "2026-07", "type": "customer_funds_loss", "customers_reimbursed": false, "summary": "Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement", "sources": [ { "url": "https://coldcard.com/security/status", "type": "official", "as_of": "2026-10-11" }, { "url": "https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack", "type": "third_party", "as_of": "2026-10-11" }, { "url": "https://www.forbes.com/sites/boazsobrado/2026/08/04/i-did-everything-right-ai-warning-after-116-million-bitcoin-hack/", "type": "third_party", "as_of": "2026-10-11" } ] } ], "fees_notes": null, "price": { "value": 319, "models": null, "notes": "Official store price (list $369)", "sources": [ { "url": "https://store.coinkite.com/store/coldcard", "type": "official", "as_of": "2026-10-11", "says": "COLDCARD Q $319" } ] }, "regulation": null, "insurance": null, "hq": null, "us": null, "us_note": null, "regions": null } } ] }