A hardware wallet is one of the strongest practical tools for self-custody, but it is not a promise that nothing can ever go wrong. Ledger CEO Pascal Gauthier’s warning that perfect security does not exist is best understood as a reminder to build several independent layers around the device—not as evidence that hardware wallets are pointless.
Key takeaways
- Hardware wallets isolate signing keys, but cannot judge whether a transaction matches the owner’s intent.
- Attackers often target the recovery phrase or the person approving the request instead of breaking a secure element.
- The trusted display is the final checkpoint for the network, address, amount and approval scope.
- Supply chain, setup, backup and recovery procedures matter as much as the hardware itself.
- The goal is not a mythical 100% guarantee; it is to prevent one mistake from becoming a total loss.
What Ledger’s CEO actually said
During a Bloomberg Crypto interview on November 10, 2026, Gauthier said that everyone will be hacked at some point and that perfect security does not exist, including for Ledger. The short clip travelled quickly on X.
In the wider discussion, he contrasted self-custody losses with failures at centralised platforms and described AI as an accelerator for attackers. The useful conclusion is not that every owner is destined to lose funds. It is that no single control should be treated as infallible.
What a hardware wallet protects
A hardware wallet generates and uses private keys away from the everyday computer or phone. The host app can prepare a request, but signing occurs inside the device after the owner confirms it. This dramatically reduces the chance that ordinary malware can simply copy a key.
What it cannot know: whether the website is genuine, whether the recipient is the person you intended, or whether you understand the permissions in a smart-contract request. It signs the data shown after you approve it.
Five ways funds can still be stolen
1. Recovery-phrase exposure
A photograph, cloud note, fake support form or compromised backup lets an attacker restore the wallet elsewhere without touching the original device.
2. Phishing and counterfeit apps
Fake wallet, exchange and airdrop pages try to obtain the recovery phrase or produce a harmful signing request that appears routine.
3. Address substitution
Clipboard malware can replace a copied destination. If the owner trusts the computer screen and skips the device display, the hardware wallet will still sign the attacker’s address.
4. Malicious approvals
Token approvals may grant a contract future authority rather than move funds immediately. Unlimited permissions and blind signing can therefore create losses after the original click.
5. Supply-chain and recovery weaknesses
Second-hand devices, altered hardware, unknown distribution paths and unsafe recovery sessions all sit outside the secure element. Buy from a traceable source and create the recovery phrase yourself on the device.
The trusted-display advantage
The device screen is designed to show what the hardware will actually sign. Check the network, full destination, amount and approval scope every time.
Clear Signing can translate contract data into readable information, while systems such as SignGuard can flag suspicious sites and requests. Both are assistance, not guarantees. If the hardware display disagrees with your intention, cancel.
Build security in layers
- Buy through a verifiable channel and keep the receipt.
- Generate the recovery phrase on the device; never type it into a website or phone.
- Keep the backup physically separate and resistant to fire and water.
- Test with a small transfer and verify the result independently.
- Limit token allowances and remove permissions that are no longer needed.
- For substantial holdings, consider separate wallets, passphrases or multisig—but rehearse recovery before relying on them.
FAQ
Can a hardware wallet be hacked?
Yes, but the term covers very different events: a device vulnerability, physical tampering, recovery-phrase theft, phishing or a transaction the owner approved without understanding. Attacking the person is often easier than breaking the chip.
Is an air-gapped wallet 100% safe?
No. Air gaps reduce connectivity risk, but backup, recovery, transaction review, physical damage and human error remain.
Will legitimate support ever ask for a recovery phrase?
No. SIAMBC and legitimate wallet manufacturers do not need your recovery phrase, private key, PIN or passphrase for warranty, updates or account recovery.
Information checked on November 12, 2026. This article is educational and is not investment advice.
Share:
OneKey Neo launches as a lighter big-screen hardware wallet