Is a cold wallet safer? Hardware wallet, exchange, ETF: which layer each incident broke

Is a cold wallet safer? It depends on which layer you are worried about. October's two incidents broke different layers. The hardware-wallet implants came in through the sales channel, before the device reached its buyer. The Binance theft went through the authorisation process for the exchange's hot wallets. On what has been published so far, the implants did not modify the devices' secure elements, and Binance says it found no leak of its wallet private keys.

After the Ledger and Trezor implant reports and the Binance theft landed in the same October, a Taiwanese crypto forum (PTT's DigiCurrency board) filled with the same few questions. "Is a cold wallet safer?" "I didn't trust my cold wallet before, and now it looks like nowhere is safe." "Why was there that much money sitting in a hot wallet?" "Was one set of hot-wallet signatures broken, or leaked?" One commenter suggested just buying IBIT. I built 3D teardowns of the implants found in the Ledger Nano X, Stax and Flex and the Trezor Safe 5, and I keep the Binance incident page up to date, so here is the chain split into layers: where each incident broke, what held, and what you control.

Five layers between a coin and its owner

1. Device supply chain: the hardware wallet leaves the factory and passes through distributors, online marketplaces or shops before it reaches you.
2. Recovery-phrase generation and setup: on first setup the device generates the recovery phrase (the words of the wallet backup) and shows it on screen for you to write down.
3. Your own storage: where the written words are kept, and who can get to them.
4. Exchange custody: coins on an exchange sit in the exchange's wallets. Cold-wallet keys are generated and kept on offline devices; hot wallets stay online to serve withdrawals quickly. Every outgoing transfer goes through the exchange's internal signing and approval.
5. ETF custodian: with a spot bitcoin ETF you own fund shares, and the coins are held by the fund's custodian.

The implants: the supply chain failed, and the theft happened at setup

The Nano X implants are wired into the SPI bus between the secure element and the display, and they only listen; they never drive a line. During setup the secure element generates 24 words and sends them to the screen. The implant reads the picture off that bus, decodes the words and sends them out over LTE through a pre-provisioned eSIM. The Flex version adds an extension flex cable, and the Stax version is a Nordic nRF9151 cellular board stacked on the main board. The builds differ, but each one takes the words from the display path and sends them out over a cellular link. On 13 October, Ledger's Donjon team confirmed implants in Ledger devices sold by the reseller CryptoBilis.

The secure element held. The private key never left the chip, and the implants did not modify the secure element or Ledger OS. The catch is that Ledger's authenticity check only verifies the secure element, so it still passes, and Ledger's own buying guide says the check cannot detect this kind of implant.

Every tampered unit came through a channel after the factory. The Nano X units were bought on Lazada, Amazon, Yahoo! Auctions Japan, MediaMarkt and Ozon. One Flex was bought at Singapore's airport and its buyer had never plugged it in. The two Stax units were ordered from CryptoBilis on 27 April 2026.

On 30 October Trezor said it had received a report of a Safe 5 sold by CryptoBilis with an extra board between the main board and the screen, carrying a cellular module and an antenna, that reads what the screen shows. Trezor says it has not verified this itself. As of that notice, no CryptoBilis buyer had reported stolen funds to Trezor.

Follow the mechanism through: if a device was tampered with at layer 1, the recovery phrase may already have leaked the moment layer 2 displayed it, and no amount of care at layer 3 can undo that. Both makers' advice points the same way. Ledger tells CryptoBilis buyers who have already set up their device to move their assets to a new device set up with a new recovery phrase, and never to enter or restore any recovery phrase on a device bought from CryptoBilis. Trezor tells anyone who bought any Trezor model from CryptoBilis since March 2026 to move their funds as soon as possible to a new wallet with a new seed; using the backup the tampered device generated on another device does not solve the problem, and if no other secure hardware wallet is to hand, a software wallet or an exchange you know can serve for now. Trezor also says not to open the device yourself and that weighing it is not a reliable test; keep the device and contact support for a replacement or a voucher.

Your lever at this layer is where you buy. But CryptoBilis was an authorised Ledger and Trezor reseller in Southeast Asia at the time, so an authorised channel is not a guarantee either. Ledger announced tighter rules for its authorised resellers on 15 October, and Trezor says it has limited its authorised sellers.

The original research source for the implant part numbers, versions and teardown data is Karpelès Lab (Mark Karpelès): the Ledger implant OSINT report and the GitHub repository ledger_implant_osint. This article presents it in my own words; it is not affiliated with or endorsed by Karpelès Lab. The 3D teardowns: Nano X, Stax, Flex, Safe 5.

Binance: the hot-wallet authorisation failed

Figures below are as of the incident page's 08:23 update on 3 November (Taiwan time, UTC+8). Later changes are on the Binance incident page (in Chinese).

From just after 04:00 on 30 October, Binance wallets on several chains were emptied. At 04:24 a single Ethereum transaction moved about 167,464 ETH plus 63 token transfers out of the hot wallet Etherscan labels "Binance 14". At 10:25 Binance published its preliminary findings: a DevOps engineer's laptop was probably compromised, which let the attacker into a service container and send unauthorised withdrawal transactions, and no leak of wallet private keys was found. A 16:47 update said further entry points had been found. That night, co-CEO Richard Teng said the attacker had gained execution rights over a hot wallet through an EIP-7702 authorisation that had not gone through Binance's normal approval.

EIP-7702 lets an ordinary Ethereum address delegate execution to contract code. The authorisation has to be signed with that address's private key, but once signed, anyone can submit it. CryptoSlate's account of the on-chain record shows the attacker submitting 50 previously signed EIP-7702 authorisations to the hot wallet at 04:20. So the authorisation carried the hot wallet's signature, while Binance says the key did not leak. The CEO of the security firm Blockaid gave a preliminary view of key misuse rather than key theft: the signing system was tricked or compromised into signing malicious transactions. Binance says the full technical post-mortem will come once the facts are verified.

What was not affected: Binance says deposits worked normally; Binance.US says it operates independently and was unaffected; BNB Chain says its chains and bridge were unaffected.

On the money: Binance estimates the total impact at about US$6.3 billion, says about US$3 billion has been frozen on-chain, and has set aside more than US$6.34 billion of company funds to cover the loss. Its fourth update, on 1 November, said about 95% of affected assets had been replenished, with BTC, ETH, USDT and seven other coins at 100%. Working from proof-of-reserves data, CoinDesk estimated that the ETH taken from the two hot wallets was about 5.6% of Binance's ETH reserves. Withdrawals reopened in batches from the afternoon of 1 November, reached 15 networks that evening, and more were due from 3 November.

At this layer you cannot see how much sits in hot wallets or how signing is approved. You can decide how much to keep on the exchange. You can check that your balance is counted, using proof of reserves (the zero-knowledge proof for the 31 October 08:00 snapshot was produced on 2 November and currently covers the ten coins above). And you can stick to official channels: during the incident a doctored screenshot promising every user US$150 in compensation circulated, and Binance called it fake.

ETF: custody handed to a custodian

On what has been published, the two incidents hit hardware-wallet sales channels and Binance's own wallets, and none of the sources cited here involves an ETF custodian. Since IBIT came up, here is how the iShares Bitcoin Trust's SEC filings describe custody: the prospectus dated 31 July 2025 (its only supplement since, on 21 November 2025, does not touch custody) and the annual report (10-K) filed on 27 February 2026. Other ETFs have their own arrangements in their own documents.

• The custodian is Coinbase Custody Trust Company, with Anchorage Digital Bank as an additional available custodian; the quarterly report filed on 6 August 2026 says the sponsor has no current plans to move any bitcoin there. Apart from what sits in the trading account, the trust's bitcoin is kept in the Vault Balance, with private keys generated and stored on devices not connected to the internet, in accounts that must be segregated from the custodian's own assets and other customers' assets.
• Some bitcoin sits temporarily in a Trading Balance at Coinbase, Inc. That balance is a claim on a shared omnibus account rather than identifiable bitcoin, and the agreement does not require it to be held in cold storage or segregated. Coinbase has told the sponsor it keeps most assets in cold wallets and the rest in hot wallets so withdrawals can be fast.
• Coinbase's commercial crime insurance is shared among all Coinbase customers, not reserved for this fund. The July 2025 prospectus put the limit at up to US$320 million; the February 2026 10-K still describes the cover as shared but no longer gives a figure.
• Individual shares cannot be redeemed with the trust; only Authorized Participants can redeem, in Baskets. An ordinary shareholder never receives the bitcoin itself.

With an ETF you skip the device, the recovery phrase and your own storage. The exchange-style layer of hot wallets, cold wallets and signing is still there, now run by the custodian under the fund's structure, and you can neither see it nor change it. Your levers are which fund you pick and reading its prospectus.

Side by side

Layer	Implant cases	Binance incident	What a regular user controls
1. Device supply chain	Failed: devices modified in the channel after the factory	Not involved	Where you buy
2. Recovery-phrase generation and setup	Secure element held; the words were read off the display path	Not involved	On a tampered device, nothing at this step
3. Your own storage	The words may already have leaked at setup, which storage cannot undo	Not involved	Where the backup is kept and who can reach it
4. Exchange custody	Not involved	Failed: hot-wallet execution rights taken through an EIP-7702 authorisation that skipped normal approval; Binance says no keys leaked	How much you keep there; checking your balance against proof of reserves
5. ETF custodian	Not involved	Not involved	Which fund; reading its prospectus

FAQ

Is a cold wallet safer?

It depends on the layer. The implants did not break the secure element; what failed was the channel between the factory and the buyer. A cold wallet keeps the key with you, and with it hands you the job of choosing the channel, the setup and the storage.

"I didn't trust my cold wallet before, and now it looks like nowhere is safe"?

The two incidents broke different layers: one in the sales channel, one in an exchange's authorisation process. Each layer fails in its own way, and what you can check or control differs. Start by working out which layer your assets sit in, then look at what you control there.

Why was that much money in a hot wallet?

Hot wallets exist to serve withdrawals quickly. In the IBIT prospectus, Coinbase says it keeps most assets in cold wallets and the rest in hot ones. Binance has not published its split; CoinDesk estimated the ETH taken at about 5.6% of Binance's ETH reserves.

Was a set of hot-wallet signatures broken, or leaked?

Binance says no private key leak was found. The attacker went in through a compromised laptop and other entry points and obtained hot-wallet execution rights through an EIP-7702 authorisation that skipped normal approval. Blockaid's CEO gave a preliminary view of key misuse, with the signing system tricked or compromised, rather than key theft. The full technical report has not been published.

Is buying an ETF the way out?

An ETF hands custody to a custodian. You no longer manage a device or a recovery phrase, but you cannot take out the bitcoin itself, and the insurance limit is shared across all of the custodian's customers. That risk now sits with the custodian and the fund structure.

Not investment advice.