3 Crypto Hacks Reveal a Smarter Way to Store Your Bitcoin
 |
| By Juan Villaverde |
Last week, news broke that someone had been draining hardware wallets in a way almost nobody saw coming …
New devices were rigged before they ever reached their purchasers.
The company at the center of it is CryptoBilis, a Southeast Asian reseller on Ledger’s list of authorized sellers.
However, months before the thefts, ownership of CryptoBilis changed hands.
Despite this, the business kept its authorized status. It continued to ship boxes with “Ledger” printed on them.
But at some time, somewhere along the way, the devices inside started being tampered with.
Ledger has since confirmed an unauthorized implant in a device sold through the reseller. It copied the 24-word recovery phrase off the screen and sent it out over a mobile network.
No malware, no phishing needed. The moment you set up the wallet, your keys were gone.
On-chain investigators put losses at $86–$93 million across more than 300 wallets. Ledger says its own systems and direct sales were not compromised. And that every confirmed instance of this particular exploit traces back to this one reseller.
My colleague Marija Matić took a closer look at how you can confirm your own device is secure earlier this week. And what to do if you’re unsure.
Even so, think about what happened …
Victims in this case sought to buy hardware wallets for one reason only: So that they didn’t have to trust anyone.
But what they thought was an official reseller, vetted by the company … turned out to be a corrupt middleman whose owner had changed without their knowing.
Which is why my suggestion is, if you want to buy a hardware wallet, you should do so only from the manufacturer’s own website.
- Not from a reseller.
- Not from a marketplace storefront.
- Not even from one of the above the manufacturer says is trustworthy.
This is the third hardware wallet scare in a matter of weeks.
But they have almost nothing in common. More to the point, none of them have exposed vulnerabilities in the encryptions themselves.
Near the end of July, you recall, attackers swept roughly $70 million of Bitcoin out of Coldcard wallets. Most of it in a matter of minutes.
As my colleague Mark Gough explained at the time, this was a vulnerability in the random-number generator that created the wallets’ keys.
If seed phrases weren’t truly random, attackers could work out likely seeds offline. Match them to funded addresses. And sweep ‘em clean.
Nobody broke encryption. The encryption was fine. But the keys that protected it were weak. Because the randomness behind them wasn’t truly random.
And owners had no practical way to spot that.
Then, last month, Trezor was in the hot seat. But again, not because of any hardware issues.
In this case, the third-party company that handled shipping the physical devices was hacked. And the personal info of anyone who had bought a Trezor device was leaked.
That was enough for the hackers to create targeted attacks to try and trick buyers into giving up their keys.
All three stories landed as a wave of headlines about AI solving long-standing math problems dominated news sites and social media discourse.
So naturally, the two have gotten mashed together.
The rumor now is that AI may be about to crack crypto’s encryption, and that’s what’s draining wallets.
It isn’t.
One theft was a result of old-fashioned software tampering. Another was a bug. The third, a data leak from a third party.
None involved cracking anything.
Even so, Ethereum (ETH) pioneer Vitalik Buterin wrote last week that AI-accelerated math deserves to be taken seriously. It IS plausible over the next two years AI could seriously damage some newer forms of cryptography.
But he also cautioned against rushed solutions.
Panicked migrations carry their own risk of lost funds. Moreover, nothing has actually been broken, so far. And as math improves, so does cryptography.
In addition, the engineers who design hardware wallets, tech executives who run exchanges and ETFs have vast incentives to anticipate emerging security threats. And to nip them in the bud.
I expect a slow, ongoing, industry-wide process — with plenty of warning.
But all this has shifted my thinking.
In the early days I told everybody to self-custody. I don’t say that anymore. At least not to most people.
Because self-custody is a double-edged sword.
Yes, you have complete control over your own crypto. But you also have to keep up with the news.
You have to understand how private keys work. And what you can and cannot do with them.
I’ve seen people hand over their private keys to someone pretending to be customer service for a blockchain — which isn’t even a thing!
In recent months, even careful owners were hurt by a firmware bug nobody could see. And a reseller nobody could vet.
In short, more autonomy means more responsibility.
And if that’s too much for you for any reason, you may want to consider diversifying where you hold your crypto.
Instead of relying solely on self-custody, you may consider also holding through a centralized exchange like Coinbase (COIN) or Kraken. Or buy getting exposure through a spot ETF.
With these options, you hand all that complexity over to a third party with massive incentive to keep your funds secure.
True, that means you have to trust those third parties.
But regulations and insurance does bolster that belief a bit.
In addition, BlackRock (BLK) and Coinbase hold hundreds of billions of dollars in crypto between them. And their entire business depends on custody going right.
This isn’t the suggestion I would have made back in 2018.
But it’s now 2026. Crypto is far more popular, and bad acters more formidable.
It’s time to take that change into account when it comes to how you store your crypto.
Best,
Juan Villaverde
