ZachXBT’s Hardware Wallet Criticism Ignites Debate Over Crypto Self-Custody

Mobile wallets may offer a smoother experience, but critics warn they introduce a much broader attack surface than dedicated hardware.

ZachXBT has sparked debate after claiming on his Telegram channel that hardware wallets are “complete garbage” for serious crypto use.

According to him, people who often handle huge amounts are better off using a spare iPhone as a sign-in device.

ZachXBT Details the Daily Struggles of Hardware Wallet Users

The crypto investigator’s Telegram message was blunt:

“Hot take: All hardware wallets are complete garbage and I do not advise using them for important tasks like signing transactions or storing funds,” he wrote.

He went further, arguing that a separate iPhone used only as a wallet could provide a better experience than any hardware on the market right now, while he specifically criticized Ledger.

“Ledger is the worst and Ledger Live has regular updates for UI/apps for no good reason that break simple actions,” claimed ZachXBT.

Back on X, he listed several problems that hardware wallet users could face when making a typical time-sensitive high-value transaction. The issues included dead batteries, obligatory upgrades of the device and software, UI changes, and site bugs that prevent signing multisig transactions.

Soon after, security researchers, wallet developers, and regular crypto users began responding to ZachXBT’s post. Axel Bitblaze agreed with the on-chain detective’s criticism of hardware wallets but questioned whether a phone was really a better replacement for them, since they would still leave the user with “one device and one seed as the single point of failure.”

Instead, he recommended a 2-of-3 Safe multisig setup with separate signer devices. He also advised crypto holders to store their seed phrases offline and to do a test before moving large amounts, while keeping spending wallets separate from long-term holdings.

You may also like:

Tornado Cash co-founder Roman Storm also chipped in, agreeing with the idea behind ZachXBT’s proposal but arguing that mobile wallets lack one important feature: BIP39 passphrase support.

The developer, who is facing a lengthy prison term after being convicted of operating an unlicensed money-transmitting business in 2025, pointed out that the extra passphrase layer is the main advantage of hardware wallets and called on software wallet makers to add support for it, which, in his view, would make them more useful for self-custody.

The debate also attracted responses from hardware wallet companies, with one of the largest, Trezor, saying that because a phone runs a full operating system, it has many possible attack points. Meanwhile, a hardware wallet is designed as a dedicated device that keeps private keys away from general computing environments.

Keystone Wallet took a more balanced position. The team acknowledged that ZachXBT was “not wrong” about the potential of an isolated phone but contended that most users are better served by purpose-built units, since the security of a phone depends heavily on strict user discipline.

Ledger’s Stance

As of this writing, Ledger had not responded directly to ZachXBT’s claims. However, it did publish a well-timed post on its X account, where it stated that its core security model is based on keeping private keys away from internet-connected devices.

“A private key that never touches the internet can’t be phished, deepfaked, or prompt-injected out of existence,” it wrote. “That’s the whole bet on hardware.”

Still, such devices are not completely immune to human mistakes. For example, an incident earlier this year saw a victim lose $282 million in BTC and LTC from their offline device through a social engineering scam.