Best Hardware Wallets in 2026

A hardware wallet is the one purchase that meaningfully changes your security model: private keys never touch an internet-connected machine. The six devices ranked below are scored on what a buyer can verify from the outside — LICENSE files, secure-element certifications, recovery design, and each vendor's dated public incident history.

We don't own these devices. Every claim here traces to vendor documentation or public record, which is checkable; a review that says "we tested it" is not. That method cannot judge how a device feels in your hand. It also cannot be charmed by packaging — and it surfaces things hands-on reviews reliably miss, like the fact that the most famous "open source" Bitcoin wallet stopped being open source in 2020, or that the vendor with the worst breach record also runs the lab that found everyone else's bugs.

Who is actually open source

"Open source" appears in the marketing of five of these six vendors. The LICENSE files tell a more precise story.

Trezor is the cleanest of the big names. LICENSE.md in the firmware monorepo licenses core and storage under GPLv3, the legacy and library code under LGPLv3, and the crypto library mostly under MIT. The hardware designs are separately open under AGPLv3 plus the CERN Open Hardware Licence, with OSHWA certification CZ000005. Firmware and schematics, both forkable — that is the full claim, and it checks out.

Coldcard is the surprise. Open COPYING-CC in the firmware repo: an MIT body followed by the "Commons Clause" License Condition v1.0, which removes "the right to Sell the Software" — any product "whose value derives, entirely or substantially, from the functionality of the Software." That condition arrived after Coinkite accused Foundation Devices of building its Passport wallet on formerly-open Coldcard code. You can still read every line, compile it, and verify a release. You cannot call it open source — the Commons Clause exists specifically to fail that definition. We score it as what it is: source-available with full reproducibility, one notch below open.

Keystone's LICENSE is a verbatim MIT text — with a header so nonstandard that GitHub's licence detector gives up and reports "Other". A cosmetic quirk, but a telling one: almost nobody reads these files. The substantive limits are elsewhere: the repo README says the MCU vendor's library ships precompiled "due to intellectual property restrictions", and the secure-element firmware published on GitHub belongs to the first-generation device, not the Keystone 3.

BitBox has the licence nobody argues about: Apache-2.0, the only OSI-approved permissive licence in this comparison. Blockstream Jade is plain MIT — Jade is discussed below, not ranked, for a different reason.

Ledger doesn't claim full openness, and credit for saying why plainly: "Is Ledger open source?" explains that the agreement with STMicroelectronics "legally prevents us from exposing the low-level code that talks to the hardware blocks of the Secure Element." The apps, SDK and companion wallet are open; the operating system your keys live inside is not, and the public BOLOS repo confirms "only a few pieces of the OS are available as of today."

What EAL6+ actually certifies

Four of the six ranked devices advertise an EAL6+ secure element — Trezor and BitBox use Infineon's Optiga Trust M, Ledger uses ST's ST33. Be precise about what that certificate is: a Common Criteria evaluation of the chip, performed for the chip maker, mostly in the context of bank cards and passports. It says nothing about the wallet's firmware, its supply chain, or the code that decides what the chip signs. A wallet with an EAL6+ element can still ship a bug — the certificate just makes physically extracting secrets from the silicon extremely expensive.

Two vendors take a different route. Keystone stacks three secure elements from mixed vendors plus PCI-grade tamper response, betting on redundancy over a single certificate. And Trezor's Safe 7 introduces the TROPIC01 — pitched as the first "transparent, auditable" secure element, attacking the long-standing irony that every open-source wallet kept its keys in the one chip nobody outside an NDA could inspect. The audit process started immediately and in public: see the incident ledger below.

Blockstream Jade has no secure element at all — a "blind oracle" scheme splits key protection between the device and a Blockstream server. That is a genuinely different trust model, not a lesser version of the same one, which is why Jade sits in the not-ranked section instead of losing points in this table.

Air gap is an architecture, not a feature

Half the market says "cold storage"; the designs differ completely. Keystone 3 Pro and Coldcard Q never connect to another machine: transactions travel by QR code or a microSD card you carry across, and on the Coldcard the USB port can be permanently disabled. The wire between your keys and the internet is a camera, and you can read every byte it carries.

Everything else on this page signs over a link — USB on the Safe 5 and BitBox, plus Bluetooth on the Safe 7, the BitBox02 Nova and every current Ledger. A radio is not a hole in itself (signing still happens on-device, keys stay in the element), but it is attack surface, and December 2023 showed the adjacent risk: the Ledger Connect Kit supply-chain attack drained wallets not by breaking devices but by compromising the JavaScript between the device and the dApp. Air-gapped signing with on-screen verification is the design that makes that whole class of attack visible before it costs you.

Six years of incidents, dated

What broke, when, with primary sources. This section is why documentation beats hands-on testing: none of it is visible in a review unit.

Ledger. July 2020: e-commerce database breached — ~1M emails and, after revision, ~272,000 records with names, phone numbers and home addresses, dumped publicly that December and feeding phishing waves ever since. May 2023: the Recover launch forced the admission that firmware can, "technically", always extract keys — resolving a years-old ambiguity in the wrong direction. December 2023: the Connect Kit npm attack shipped a wallet drainer through Ledger's own library for about five hours (~$484k estimated losses). January 2026: a third-party payment processor leak exposed customer contact data again. The pattern: the devices hold; the company's data perimeter keeps failing.

Trezor. January 2020: Kraken Security Labs extracted a seed in about 15 minutes of physical access from the Model One and Model T — unfixable in that hardware generation, and the reason the secure-element Safe series exists. January 2024: a support-portal breach exposed contact data of ~66,000 users. March 2025: Ledger Donjon bypassed a supply-chain countermeasure on the Safe 3 (the Safe 5 was unaffected). June 2026: Donjon again — a laser fault-injection attack on the Safe 7's TROPIC01; physical possession required, mitigation shipped, funds safe per Trezor. The pattern: the old architecture was breakable and got replaced; the new one is under active public examination — which is what you want to see.

Coldcard. The findings are old and the record since is quiet: a 2020 PIN-extraction disclosure against the Mk2 (fixed by the Mk3's chip change), and two 2020–21 software findings by Shift Crypto — an isolation bypass and a multisig xpub swap — both fixed. No documented real-world fund loss.

Keystone. One published third-party finding — Offside Labs, 2024, fixed in firmware 1.2.8 — disclosed by the vendor itself, alongside two earlier audit reports it open-sourced. Nothing in the wild that we could document.

BitBox. The opposite of an incident: Shift Crypto coordinated the 2020 SegWit fee-inflation disclosure that affected every hardware wallet, and published the fix jointly. No public compromise of its own found.

The meta-observation: four vendors on this page — Trezor, Tangem, Jade, Coldcard — have had a flaw published by Ledger's research lab, while Ledger's own failures were never the silicon: they were databases, npm accounts and business decisions. Judge the device and the organisation separately.

Recovery: Shamir, Seed XOR, and what Recover conceded

A single 24-word sheet is a single point of failure — fire, photo, or family. The vendors split on what to do about it. SLIP39 Shamir backup — splitting the secret into shares where, say, any 2 of 3 restore — is supported on every current Trezor and on the Keystone 3 Pro. Coldcard ships its own Seed XOR scheme instead, with the useful property that each share is itself a working decoy wallet. BitBox and Ledger offer neither; BitBox's answer is an effortless microSD backup, which eliminates transcription errors but is still one object holding the whole secret.

Ledger's answer is Recover: an opt-in $9.99/month service that shards an encrypted copy of your seed to hardware security modules at three companies in three countries, 2-of-3 needed to restore against a government ID. As a product, it addresses the number-one real-world failure — people lose their own backups. As an architecture, it settled a debate: the firmware can move key material out of the secure element when Ledger ships code asking it to. Opt-in today, capability forever. That is the fact to price in, whatever you decide it is worth.

The ones we didn't rank

Tangem ($54.90 for a two-card set) fails this method's entry bar: the card firmware is closed and deliberately non-updatable, so nothing about what runs on the card is independently checkable — you are trusting the Riscure and Kudelski audits end to end. The recent record also argues for caution: in December 2024 the app was found logging private keys of seed-phrase wallets (fixed within days, logs purged), and in September 2025 Ledger Donjon published a PIN "tearing attack" that Tangem declined to treat as a vulnerability. The seedless card model is genuinely convenient; convenient and verifiable are different products.

Blockstream Jade Plus ($169.99) is the strongest budget air-gap option and fully MIT-licensed, but its no-secure-element "blind oracle" design delegates part of key protection to a Blockstream server, which makes it incomparable on this page's terms rather than worse. Its December 2025 CBOR vulnerability disclosure was handled fast and documented well. One warning for bargain hunters: the $99 camera-less Jade Core signs over USB or Bluetooth — it is not air-gapped at all, whatever the family resemblance suggests.

Ledger Stax ($399) shares the Flex's secure element and software stack; the extra $150 buys a curved screen and wireless charging, not security. If the Ledger model fits you, the Flex is the rational buy.

What changed in 2025–26

If you last compared hardware wallets a year ago, the shelf moved: Trezor shipped the Safe 7 in November 2025 and cut the Safe 5 to $129; Ledger's current range runs Nano S Plus $59, Nano X $99, Nano Gen5 $179, Flex $249, Stax $399; Coinkite quietly replaced the Mk4 with the Mk5 ($169.94) next to the Q; Shift Crypto released the BitBox02 Nova; and Blockstream added the $99 Jade Core. Every price above was read from the official store on 19 July 2026 — check them again before you buy, because this paragraph will age like every other spec sheet.

One thing did not change: nobody on this page pays us, no manufacturer saw a draft, and every factual claim links to something you can open. If you find one that doesn't check out, tell us — corrections ship with the next deploy.