Hardware wallets

Wonder

1. How can a device sign a transaction without ever revealing the private key to the computer connected to it?
2. What does a secure-element chip protect against, and what does open firmware let outsiders check?
3. What happens when a hardware wallet is physically seized by an attacker with specialized equipment?

Explore

1. Hardware wallets are dedicated devices that store private keys on isolated hardware, signing transactions without exposing the keys to internet-connected computers. The device displays the destination address on its own screen for verification before confirmation. This isolation prevents malware on a connected host from extracting secrets or altering transaction details. Early products include the Trezor (SatoshiLabs, 2014), Ledger Nano S (2016), and Coldcard (Coinkite, 2018).
2. Designs diverge into secure-element chips and general-purpose microcontrollers. Secure-element chips resist physical extraction, but their internals are closed; general-purpose microcontrollers are fully inspectable but easier to attack physically. Several devices (for example Coldcard, BitBox02 and Trezor Safe) combine a secure element with open or source-available firmware. In 2020, Kraken Security Labs demonstrated extracting a Trezor seed via physical access to the device’s electronics. This trade-off defines current security postures: transparency versus tamper resistance.
3. Many signing workflows use Partially Signed Bitcoin Transactions (PSBT). A companion software wallet constructs an unsigned transaction and transmits it to the hardware device via USB, NFC, or QR codes. The user verifies details on the device’s display and confirms. The signature is generated internally using secp256k1 ECDSA or Schnorr algorithms and returned. The private key never leaves the secure boundary.
4. Air-gapped devices avoid a direct cable connection to the computer. Devices like the Coldcard sign via SD card, while others use QR codes to transfer transaction data. An SD card or QR code is still a data channel, so a compromised computer could alter the request; checking the details on the device’s own screen is what catches that. The physical separation between network exposure and key storage remains the core security model for long-term custody.
5. Supply chain and database risks persist despite hardware isolation. Tampered devices from unofficial sellers may contain backdoors. In 2020, Ledger’s customer database leaked, fueling phishing attacks that targeted users with social engineering rather than cryptographic breaks. The 2023 debate over Ledger Recover highlighted tensions between convenience and non-custodial principles, because the optional service would back up encrypted shares of the seed with third-party companies.
6. Hardware wallets serve as long-term storage for infrequent access, distinct from mobile or exchange wallets used for daily spending. Many users split funds this way: most on a hardware device, small amounts in a phone wallet. Self-custody also means no help desk can reverse a mistake or recover a stolen seed.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• Kraken Security Labs, Trezor seed-extraction research (January 2020)
• Ledger, 'Data Breach Disclosure' (2020)
• A. M. Antonopoulos & D. A. Harding, Mastering Bitcoin, 3rd ed. (2023), ch. 5
• SatoshiLabs, Trezor documentation
• Coinkite, Coldcard user manual