Do you need one?

Gabriel Custodiet, host of the Escape the Technocracy podcast and author of the Watchman's Torch premium newsletter, argues against the broad use of cryptocurrency hardware wallets. The article is triggered by a Coldcard hardware wallet seed phrase vulnerability (discussed in episode 229 of his podcast) that led to over $100 million in stolen funds. His central thesis: hardware wallets are over-marketed, introduce new attack surfaces, discourage actual use of cryptocurrency, and should only be used by a tiny, privacy-educated minority.

Key Incident: The Coldcard Vulnerability

• A massive theft occurred due to poor generation of seed phrases by Coldcard Bitcoin hardware wallets.
• The stolen funds totalled $100 million plus and growing.
• Gabriel had not recommended Coldcard 'for many reasons for years', but it remained a popular choice.
• He helped friends, clients, and audience members move funds before they could be stolen.

A specific anecdote is used throughout: a friend whose Coldcard wallet was compromised, whose seed phrase was poorly hidden in his home country, and who couldn't send funds from his software wallet without the Coldcard (also in a different country) — necessitating an international trip. Gabriel notes that if the funds had been on a software wallet in front of him, he could have 'created a new wallet and transferred in 60 seconds.'

Importantly, Gabriel states the Coldcard problem is not endemic to hardware wallets but rather 'a problem with hubris and abandoning FOSS [Free and Open-Source Software] as Coldcard did — a problem that could affect any tech company of any kind.'

The Four Core Arguments Against Hardware Wallets

1. They make using your funds complicated

• People forget how the devices work and how they connect to software wallets.
• They store devices in difficult-to-access places.
• They are 'designed for savers, not spenders' — Gabriel fundamentally disagrees with saving a young, experimental money technology rather than using it.
• Hardware wallets are signing devices, not merely seed generation devices; the private keys reside on the hardware, meaning you need the device's permission to transact.
• A transaction requires a two-part action: the hardware wallet and an accompanying software wallet.
• If your device is in a Swiss vault, you need a trip to Switzerland — and you could have been 'completely screwed over by the Coldcard situation' in the meantime.
• He mentions people who bought Bitcoin 'in late 2025 at its peak and subsequently saw it dip' — noting the psychological toll.
• Conclusion: 'Hardware wallets absolutely discourage the use of Bitcoin or any cryptocurrency.'

2. They put a serious target on your back

Gabriel calls this 'the worst problem of hardware wallets.'

• The Coldcard's calculator-like appearance has become 'synonymous with Bitcoin wealth' — he says it 'basically screams torture me.'
• If a thief sees the device in your home, they may return for a 'more personal conversation' (i.e., physical extortion).

Shipping problem:

• Most hardware wallets must be shipped to you; buying in person is risky (could be fake), and even buying at a conference means transporting it home on a plane.
• Shipping requires giving personal information; when this data is breached, thieves get email addresses and phone numbers.
• At worst, thieves 'might show up to your house knowing you likely own crypto.'

Cited articles (real-world examples of crypto-related home invasions):

• 'Inside a violent gang's ruthless crypto-stealing home invasion spree' — on Wired
• 'French couple mistaken for crypto holders endures three home invasions' — on coinalertnews.com

Supply chain attacks:

• In August 2026, Trezor suffered a data breach via one of their shipping providers.
• Trezor's quoted tweet: "We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days."
• Affected countries: US, UK, Sweden, Colombia, Brazil, Italy, and Portugal.
• Gabriel's reaction: 'Of course this happened. Of course it will happen.'
• He notes the Coldcard attacker 'had been studying the company and its practices for a long time.'
• Hardware wallets 'need immense airtight security across all sectors of their creation and shipment process — more than what they're currently doing and probably what they're capable of doing.'

If you must buy one, Gabriel advises:

• Ship to a postal box
• Use a burner email
• Never give a real phone number
• Ideally don't use your real name

3. They are over-marketed and over-sold

• Many people enter cryptocurrency through hardware wallets as their first step — 'they're basically told they need to.'
• The implicit message: 'If you can't afford a $150 device, you can't afford to be in Bitcoin.'
• These users lack the tech background, operational security awareness, understanding of end-to-end encryption, or even understanding of crypto itself.
• Starting with a hardware wallet means users 'never actually learn how to use Bitcoin' — they never get comfortable with software wallets, verifying software, updating, or keeping up with tech news.
• He asks: 'How many Coldcard users do you think are aware of what's happening and have moved their funds? A small percentage.'
• Most were told: 'Buy this device, I'll walk you through it. You never worry again.'
• 'Hardware wallets reach a much wider audience than they should. So does cryptocurrency generally.'

4. They are 'magical devices'

• Gabriel has a longstanding stance against 'magical devices' — things that most people do not understand.
• 'Everything comes at a cost. Convenience means destroying something else.'
• 'There is no privacy phone and there is no perfect cryptocurrency device that protects your wealth and keeps it private.'
• He references his own YouTube video: Escape the Technocracy Underground Spotlight 2: The Myth of Privacy Phones.
• Core philosophy: 'Privacy and sovereignty are mindsets, not devices.'
• 'Privacy is knowledge, not software and definitely not hardware.'
• Magical devices create 'the illusion that the device is offering them something that they themselves are meant to offer the device.'
• 'Hardware wallets breed incompetent users.'

The Counterargument: What About Hot Wallet Vulnerabilities?

Gabriel addresses the standard hardware wallet argument: 'If your device has malware on it, then this malware could steal your seed phrase. Your phone is a hot device because it has an internet connection, so you are by definition vulnerable.'

His rebuttals:

• His friend was 'exceedingly vulnerable to the Coldcard attack despite that device never touching the internet.'
• His friend had 'a newish and fairly secure phone with minimal apps.'
• 'I don't hear many stories at all of people having their seed phrase stolen by malware on their device. It's definitely not common and certainly not as common as hardware wallet proponents would like you to believe.'
• Bitcoin developers he's spoken to 'emphasized how unlikely it is to lose funds on a hot wallet, especially if you practice basic operational security on your device.'

How people actually lose funds (according to Gabriel):

• Trusting exchanges like FTX
• Setting up complex multi-sig wallets
• Falling prey to common scams
• 'Doing stupid manoeuvres with their funds'
• Trusting companies like Coldcard that don't support FOSS

He also observes that people who use hot wallets are less likely to lose funds because 'they understand how all of this works. They're nimble and experienced at actual crypto owners.'

Gabriel's Alternative and Recommendations

Stop broad recommendation

• 'We need to stop recommending hardware wallets so broadly and we need to stop recommending Bitcoin and other cryptocurrencies as well.'
• 'I stopped encouraging people to get into crypto years ago because I realised I was putting the cart before the horse.'
• Crypto 'will remain for now as it should for the 1% of people who have enough tech savviness or interest and the correct amount of self-knowledge to know they want to use them properly.'
• 'Bringing in more under-educated or people uninterested in learning is simply bringing in more lambs to the slaughterhouse.'

For 99.9% of people

• 'If you want to be an asset to cryptocurrency, then use it. That's it.'
• 'Give them a tiny amount and let them spend it. Maybe also receive it.'
• 'For 99.9% of people, this is all they ever should do with cryptocurrency.'

Who hardware wallets ARE for

Gabriel's criteria for appropriate hardware wallet use:

He describes this person as 'a tiny dot of the population.'

Gabriel's personal approach

• He prefers to hold funds in a hot wallet.
• 'If I'm feeling fancy', he would get a dedicated Google Pixel, convert it to GrapheneOS, and use it exclusively as a wallet device.
• Like a hardware wallet, this device 'doesn't travel with me and doesn't get used for anything else.'
• However, since he doesn't 'believe in saving crypto', he's 'not even going to go this far.'

Summary of Key Takeaways

1. The Coldcard incident ($100M+ stolen) is the catalyst — but Gabriel frames it as a FOSS/hubris problem, not inherently a hardware problem.
2. Hardware wallets complicate fund access — they require two-part transactions and physical device presence, discouraging actual cryptocurrency use.
3. They create a physical security risk — the device itself signals crypto wealth, and shipping data breaches (like Trezor's in August 2026) expose buyers to targeted attacks, including home invasions.
4. They are over-marketed to under-educated users — people who should not be in self-custody are told a device solves everything, breeding incompetence.
5. They are 'magical devices' — privacy and sovereignty are mindsets and knowledge, not hardware.
6. Hot wallets with basic operational security are underrated — seed phrase theft via malware is rare; most losses come from exchanges, scams, and poor decisions.
7. Hardware wallets are only appropriate for a tiny minority — those with $10,000+, who don't use the funds daily, who are privacy-educated and tech-savvy.
8. For 99.9% of people, the only crypto activity should be sending and receiving small amounts.