One month ago, ZachXBT said something that got him buried in backlash: that hardware wallets, the devices the entire crypto industry tells people to trust with their life savings, were "complete garbage."
He wasn't vague about it either, singling out Ledger by name. The community pushed back hard. Then, in the span of a few weeks, two of the industry's most respected hardware wallet makers each had a genuinely bad month, and the backlash started looking a lot less justified.
The Warning Nobody Wanted To Hear
On July 15, 2026, ZachXBT posted in a Telegram message that he doesn't consider current hardware wallets suitable for signing critical transactions or storing large amounts of assets, describing the entire category bluntly as "complete garbage." He suggested that experienced users might be better served using a separate, dedicated device reserved exclusively for crypto activity instead. His sharpest specific criticism landed on Ledger, which he called the worst offender, pointing to frequent software updates that, in his words, break simple functions for no good reason.
At the time, ZachXBT wasn't claiming to have found a new vulnerability, and he said as much himself, he was offering a personal assessment based on years of watching how these devices actually perform in practice, not announcing a fresh exploit. That distinction mattered less than the reaction that followed, which was swift and largely unfavorable toward him.
The Coldcard Disaster That Followed
Roughly two weeks later, the first crack appeared. Starting July 30, 2026, attackers began exploiting a firmware flaw in Coldcard, a Bitcoin-only hardware wallet made by Canadian manufacturer Coinkite that had built its reputation specifically on being one of the more security-focused cold storage options available. The root cause traced back to a March 2021 firmware build that mistakenly routed part of the seed generation process through a software-based random number generator instead of the device's dedicated hardware RNG, weakening the effective randomness of affected seeds from a designed 128 bits down to as little as 40 bits, low enough to brute-force without ever needing physical access to the device.
The damage unfolded in waves. An initial sweep on July 30 drained roughly 594 BTC in under 25 minutes, hitting hundreds of single-signature wallets, many of them dormant for years. By the time subsequent waves were tallied, Galaxy Research put total losses at approximately 1,816 BTC drained from more than 5,200 addresses, with some assessments placing the figure closer to $130 million, making it the third-largest crypto hack of 2026. What made it particularly unsettling was who it hit: not careless users, but people who'd done everything the industry recommends, offline storage, seeds never photographed or shared, devices that never touched the internet. Updating the firmware doesn't retroactively fix an already-compromised seed either, meaning anyone who generated a seed on affected Coldcard devices between March 2021 and the patch needs to migrate to an entirely new seed to actually be safe.
Trezor's Own Announcement, In Full
Then came Trezor's turn. The company, one of the largest and longest-running names in cold storage, posted directly on X confirming a serious data breach tied to a third-party shipping provider. You can read their full statement in their official announcement.
According to Trezor's own words, one of its shipping providers experienced a data breach exposing sensitive order data, affecting new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who placed an order within the 90 days prior to August 8, 2026. The exposed data included full names, shipping addresses, phone numbers, and email addresses. Trezor confirmed the breach affected 11,742 customers with full exposure, meaning their name, email, phone number, and shipping address were all compromised, and a further 1,947 customers with partial exposure limited to name, city, and email. The company said the scope was limited specifically because of its strict 90-day data storage policy, a policy it said it had also successfully negotiated with fulfillment partners.
Trezor was direct about what this means practically: while the company's systems and devices themselves remain secure, affected customers should expect an increase in phishing attempts, since attackers now have real names, addresses, and contact details to build convincing scams around. The company urged users to never enter a wallet backup phrase on any website or share it with anyone, and to only check for firmware or app updates through official Trezor channels.
Zachxbt's Reaction Says It All
ZachXBT's response to Trezor's announcement was short, and given everything that had unfolded over the prior month, it landed with real weight. He replied simply: "Yet another hardware wallet incident…." You can read his full reaction on his official page.
I think that brevity is exactly the point. A month earlier, he'd made a sweeping, unpopular claim and taken real heat for it. He didn't need a long thread to make his position clear this time, the sequence of events had essentially made the argument for him. Two of the industry's most trusted hardware wallet brands had each suffered a major security failure within roughly the same window he'd been criticized for painting the entire category with too broad a brush.
What Trezor Is Doing To Prevent A Repeat
To its credit, Trezor didn't stop at an apology. The company said it's currently developing an Anonymous Delivery option, aiming to launch it in the EU by September and in the US by the end of the year, specifically designed to prevent this exact kind of breach from being possible in the first place. The feature would let customers order hardware wallets without ever linking the purchase to their home address or real identity, using a dedicated checkout flow, a nickname or label ID instead of a real name, an automated parcel locker for pickup rather than home delivery, and unbranded packaging with a generic sender label, with the carrier only sending pickup PIN codes via email or SMS. Trezor described the project as a top priority internally right now.
I think that response is worth acknowledging on its own terms, it's a genuine structural fix rather than just a statement, and it directly targets the exact vector that caused this breach. But it also arrives after the fact, following an incident that's now sitting alongside a $130 million Coldcard exploit as evidence for exactly the kind of systemic fragility ZachXBT was pointing to a month ago, before anyone had a reason to take him seriously.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!
