Onchain investigator ZachXBT has criticized hardware wallets, arguing that users should not rely on them for critical transaction signing or storing large amounts of cryptocurrency.
Summary
- ZachXBT says current hardware wallets are unsuitable for critical transactions, naming Ledger as the worst.
- He argues a dedicated iPhone used only for crypto could provide a better operational setup.
- Recent wallet scams show attackers continue targeting crypto holders through fake apps and social engineering methods.
In a Telegram post, ZachXBT described hardware wallets as “complete garbage” and said he does not advise using them for important tasks. Instead, he suggested using a separate iPhone dedicated entirely to managing crypto assets.
ZachXBT singles out Ledger over frequent updates
ZachXBT directed his strongest criticism at Ledger, one of the largest hardware wallet manufacturers. He called Ledger “the worst” and claimed that frequent updates to Ledger Live can interfere with basic functions.
He said Ledger Live receives “regular updates for UI / apps for no good reason that break simple actions.” The comments represent ZachXBT’s personal assessment. He did not provide evidence that Ledger devices had suffered a new security breach or that their private-key protection had been compromised.
Ledger has since renamed Ledger Live to Ledger Wallet. According to the company’s official release notes, Ledger Wallet version 4.8.0 was released on June 11 with security improvements, interface changes and minor bug fixes.
The company continues to promote hardware-based signing as a way to keep private keys separate from internet-connected devices. ZachXBT’s proposal takes a different approach by using a smartphone reserved only for crypto transactions.
Hardware wallet users remain targets for crypto scams
The criticism comes as attackers continue targeting hardware wallet owners through social engineering and fake applications. These attacks do not necessarily involve breaking the security of the physical wallet itself.
As previously reported by crypto.news, a crypto holder lost more than $282 million in Bitcoin and Litecoin in January following a hardware wallet social engineering scam. ZachXBT reported that the attackers quickly moved the stolen funds through several services and converted part of them into Monero.
The incident showed how attackers can target users without directly compromising a hardware wallet’s technical security. Social engineering instead attempts to convince victims to reveal sensitive information or take actions that give criminals control over their assets.
Ledger users have also faced attacks involving software that impersonates official company products. Such cases can create security risks even when the physical hardware device continues working as designed.
Fake Ledger app stole $9.5 million from users
In April, a fake Ledger Live application listed on Apple’s App Store stole at least $9.5 million from more than 50 victims in one week, as reported by crypto.news. The fraudulent application copied Ledger branding and appeared to users searching for the company’s wallet software.
Victims reportedly entered their recovery phrases into the fake application, allowing attackers to gain control of their wallets. The stolen assets included Bitcoin, Ethereum, Solana, Tron and XRP. Apple later removed the fraudulent application from its store.
ZachXBT’s recommendation of a dedicated iPhone would reduce some exposure associated with using a device for everyday browsing, messaging and other online activity. However, a smartphone still depends on its operating system, installed software, backup practices and the user’s security habits.
The debate comes down to different approaches to crypto self-custody. Hardware wallets focus on keeping private keys isolated from general-purpose internet-connected devices. ZachXBT instead favors strict device separation through a phone used only for crypto. In both cases, users can still face risks from phishing, fake applications, exposed recovery phrases and social engineering.
