Part 4: Inside a hardware wallet

Inside a hardware wallet: architecture, signing flow, and failure modes

A hardware wallet is a single-purpose signing appliance. Its job is narrow: generate a seed from hardware entropy, never export it, and sign only what the user has seen and approved on a screen the host computer cannot control.

1, on the hostHost builds the transactionLedger Live, Trezor Suite, Sparrow or a Safe UI creates it, often a PSBT.

2, in transitTransportUSB, Bluetooth, NFC, or air-gapped QR code or SD card.

3, on the deviceDevice shows the truthFirmware parses it and shows destination, amount and fee on its own screen.

4, on the deviceHuman confirmsA physical button or touch on the device itself.

5, on the deviceSign insideThe chip derives the child key and signs with deterministic nonces.

6, on the deviceSignature outOnly the signature leaves. Seed and keys never do.

Step 3 is the real security product. Everything else could, in principle, be done by a phone's Secure Enclave if it supported the right curves. What the phone cannot provide is a display and input path that is independent of a possibly compromised operating system.

Three architectural schools

No design wins on every axis. Ledger optimizes for physical attacker resistance. Trezor optimizes for verifiability. Coldcard and Keystone optimize for removing the network-connected host from the trust boundary. I see that as healthy competition, and the vendors' security teams actively test each other's devices.

What hardware wallets have and have not stopped

The Bybit case is the one I would put in front of any risk committee. A multisig that needed at least three signers, each approving on a Ledger device, did what it was built to do: keep keys private and produce valid signatures. The failure was at step 3 of the flow above. The signers approved, on their devices, a payload that differed from the transaction the web interface showed them. The industry response is clear signing, such as ERC-7730, a metadata standard authored at Ledger, which teaches devices to render complex contract calls in human terms.

Binance, October 2026: when the signer is a machine

On 29 October 2026, Binance lost about $6.3 billion, roughly four times the Bybit loss and the largest crypto theft on record. According to TRM Labs data reported by Gizmodo, most of it left across 10 blockchains in about 20 minutes, and around $3 billion was later frozen. Binance said it would cover losses from its SAFU fund, part of its futures insurance fund, and company money. The FBI attributed the attack to North Korea's TraderTraitor unit.

Binance's initial findings describe a campaign that ran for months and never required a stolen private key. As SafeDep's summary of those findings lays out, the path ran through a tampered developer tool, a fake job interview, and an internal AI tool.

June 2026Tampered toolAn engineer installs a tampered Homebrew package. Binance replaces the device and rotates credentials.

September 2026Fake job interviewA second engineer runs a fake interview assignment on a work laptop, which installs malware.

October 20 2026Lateral moveThe attacker uses an internal AI tool to reach other engineers' machines and finds a container deployment token.

October 29 2026Signing service abusedA container deployed with stolen credentials reaches the signing service: transfers plus 50 signing transactions for EIP-7702 delegations. Most funds leave in about 20 minutes.

Key safety held completely. The hot wallet used MPC, so no single private key existed to steal, and Binance reports no evidence that any key leaked. The cryptography and the key shares did exactly what they were designed to do.

Intent safety failed at a machine. An exchange cannot have humans approve every withdrawal, so a signing service checks requests against rules and signs. Once an authenticated caller reached it, it signed what it was asked, including a transaction type, EIP-7702 delegation, that has no place in routine withdrawals. Bybit's signers approved a payload they could not read, and Binance's signer approved one that no person read at all.

MPC slowed the cleanup. The malicious delegations lived on-chain, so Binance's withdrawal kill switch had no effect on them. Revoking them required a new signature from the wallet, and because there was no single key to sign it, Binance only cleared the delegation at 00:10 UTC on 30 October, about four hours after the first transfer. The property that protects keys from theft also slowed the emergency response.

I read Binance as the institutional version of the hardware wallet lesson. Hardware wallets, HSMs, and MPC solve where the key lives. None of them decide what the key should sign. That decision belongs to a policy layer that must sit between any caller and the signer: per-transaction and per-hour value ceilings, destination allowlists, and a hard block on unusual transaction types such as delegations or contract upgrades unless a quorum approves them on hardware devices with readable screens.

Coldcard and Ledger, 2026: when the device itself is the weak point

Two 2026 incidents hit hardware wallets directly, from opposite directions.

Coldcard: keys born weak. Coldcard firmware from March 2021 onward created seeds with a weak software generator instead of the hardware one, leaving about 40 bits of entropy on older devices. Attackers began draining wallets on July 30, 2026, and took about 1,816 BTC, roughly $116 million. The device's two secure elements did not help, because the weakness lived in how the keys were born, not in how they were stored. Coinkite's advisory said funds were at risk if the seed was created on affected firmware without extra dice-roll entropy and without a strong BIP-39 passphrase, which is a strong argument for mixing in your own entropy at setup.

Ledger: the screen was watched. On October 9, 2026, buyers of Ledger devices from the Southeast Asian reseller CryptoBilis began reporting drained wallets, and Ledger confirmed an unauthorized hardware implant in an affected device. According to Ledger, a covert chip read the recovery phrase off the screen during setup and transmitted it over LTE using an eSIM. On-chain researchers put suspected losses at more than $93 million, while Ledger said its own systems and direct sales channels were not compromised. This attack went after step 3 of the signing flow above: the trusted screen worked as designed, but someone had wired an eavesdropper into the device before it reached its owner.

Together they set two baseline rules for anyone holding meaningful value: buy hardware only directly from the manufacturer, and treat the moment of seed creation as the most sensitive step in the device's life.

The threat model splits into what hardware wallets stop and what they leave to the process.

Continue to Part 5: Security posture