Blockchain investigator ZachXBT has criticized hardware wallets as a category and recommended using a separate iPhone exclusively for storing crypto and signing transactions. “All hardware wallets are complete garbage,” ZachXBT wrote in a Telegram post, describing the opinion as a “hot take.” He did not disclose a new vulnerability or present evidence that all hardware-wallet models share a common security flaw.
ZachXBT separately singled out Ledger as the provider he considered the worst. His specific complaint focused on frequent updates to Ledger’s companion application, which he said could prevent basic functions from working properly. The remarks therefore included two separate criticisms: a broad rejection of current hardware wallets and a more specific complaint about Ledger’s software reliability. They did not establish that Ledger’s hardware or secure element had been compromised.
Wallet incidents carry different risks
Recent wallet-related reports illustrate why software failures, user claims and confirmed hardware flaws should not be treated as the same issue. A Cardano holder recently claimed that 2.3 million ADA left a Ledger-secured wallet without the owner signing a transaction or connecting to a decentralized application. Ledger acknowledged the report, but the publicly available information did not establish how the funds were moved or prove that its hardware had been breached.
In a separate case, Ledger’s Donjon security researchers demonstrated a laser fault-injection attack against Tangem wallet cards. The technique could reset a card password and allow transactions to be signed, but it required physical possession, specialist equipment and dismantling the card. The researchers did not extract the private key, while Tangem said the practical threat to ordinary users was minimal.
Software impersonation presents another risk. A fake Ledger application distributed through Apple’s App Store reportedly stole funds after users entered their recovery phrases. That incident involved malicious software and credential theft, not a compromise of Ledger’s physical devices.
Dedicated iPhone carries separate exposure
A phone used only for crypto may reduce exposure to everyday browsing, social media and unknown applications. However, it remains a general-purpose device whose security depends on its operating system, wallet software, backup settings and account recovery configuration.
For that reason, a dedicated iPhone should not automatically be considered equivalent to cold storage. It replaces the hardware-wallet security model with a different set of risks rather than eliminating them.
ZachXBT’s post raises questions about hardware-wallet reliability and usability, particularly around Ledger’s companion software. It remains an operational-security opinion, not proof that hardware wallets are universally compromised.
