BitcoinSafe

Open Bitcoin safety research

2026 Bitcoin hardware wallet safety benchmark

This annual benchmark compares what public evidence says about hardware-wallet safeguards. It measures documentation against version 1.0.0 of the BitcoinSafe threat model. It does not name a safest wallet.

Evidence cutoff: 2026-08-28Edition revision: 1.0.0Threat model: 1.0.0

A documented control is not proof that implementation is flawless. A missing or unverified record is not proof that a safeguard is absent. Use the evidence links and your own threat model.

2026

What the 2026 evidence shows

  • All four products document device-held signing keys, secret separation, recovery checking, authenticated firmware, and on-device transaction review.
  • COLDCARD Q and Mk4 document PSBT workflows that separate transaction creation, signing, and broadcast. The eligible Trezor and Ledger sources did not establish a general PSBT interchange workflow by the cutoff.
  • The current COLDCARD security advisory matters even though its firmware-update control is documented. Owners must check the affected firmware and seed-migration guidance rather than treating an update as a repair for an existing seed.
  • Public source availability differs. Independent reviewers could inspect more of the COLDCARD and Trezor firmware path than Ledger’s low-level Secure Element code.

Evidence-state totals by product

Each product has six records. COLDCARD Q and Mk4 have six documented states. Trezor Safe 5 and Ledger Flex each have five documented states and one not-verified state.

Control evidence matrix

Six threat-model controls evaluated across four hardware wallets. Select a state to read its evidence record.
ProductSigning-key isolationSecret separationRecovery checkAuthenticated firmwareTrusted-display verificationSeparated transaction roles
COLDCARD QCurrent modelDocumentedDocumentedDocumentedDocumentedDocumentedDocumented
COLDCARD Mk4Supported legacy modelDocumentedDocumentedDocumentedDocumentedDocumentedDocumented
Trezor Safe 5Current modelDocumentedDocumentedDocumentedDocumentedDocumentedNot verified
Ledger FlexCurrent modelDocumentedDocumentedDocumentedDocumentedDocumentedNot verified

Evidence details

Transaction verificationNot verified

Ledger Flex: Separated transaction roles

Documentation separates host creation, offline signing, and broadcast, but eligible sources did not verify a general PSBT interchange workflow by the cutoff.

Sources

Independent reviewer context

Reviewer observations helped identify questions and disagreements. Manufacturer or authoritative documentation still controls the benchmark state. Sponsorship and method limits remain visible.

COLDCARD Q, Trezor Safe 5, Ledger Flex

BTC Sessions
Method
A one-hour setup and workflow comparison covering desktop, mobile, connectivity, companion software, and advanced features.
Commercial disclosure
Coinkite sponsored the episode and supplied a discount; the reviewer disclosed a personal COLDCARD preference.
Observation
The review found Trezor easier to learn, COLDCARD more flexible, and Ledger oriented toward integrated convenience.
Limit
The video predates the August 2026 COLDCARD advisory. Its preference ranking is not used in benchmark states.

COLDCARD Q, COLDCARD Mk4, Trezor Safe 5, Ledger Flex

WalletScrutiny
Method
Code-availability and custody-method review using separate public records for all four products.
Commercial disclosure
No product sponsorship or affiliate link was identified on the reviewed records.
Observation
WalletScrutiny reported public firmware source for COLDCARD and Trezor, and stopped Ledger firmware verification under its public-source criteria.
Limit
This method focuses on custody and source availability. It does not replace physical testing, recovery drills, or usability research.

COLDCARD Mk4

Bitbo
Method
Editorial product review covering setup, air-gapped use, firmware, and current security guidance.
Commercial disclosure
Commercial terms were recorded as reviewer context and were not used to set control states.
Observation
The review treats Mk4 as a capable supported device but directs readers to the 2026 seed-generation advisory.
Limit
It is an editorial review, not a reproducible firmware audit.

Methodology

  1. 1The edition maps six device-relevant mitigations from threat-model version 1.0.0 to specific public evidence questions.
  2. 2Researchers checked manufacturer product pages, maintained documentation, security advisories, and attributed independent reviews through the evidence cutoff.
  3. 3A second factual pass checked eligibility, product status, state interpretation, dates, citations, translations, and limitations before approval.
  4. 4All totals and visible states come from the downloadable dataset. The build rejects missing product-control pairs, sources, translations, or a mismatched threat-model version.

Limits

  • BitcoinSafe did not buy devices, inspect hardware, reproduce firmware builds, or run recovery drills for this edition.
  • The benchmark measures public documentation. Better documentation can produce more documented states without proving better implementation.
  • The sample excludes products that lacked enough dated evidence for every selected control. It cannot support a market-wide ranking.
  • Evidence after August 28, 2026 belongs in a dated correction, a new revision, or the next annual edition.

Frozen scope

BitcoinSafe froze product eligibility, evidence types, controls, and exclusions before deriving any state. This disclosed sample is not a market census.

Eligibility rules

  • The product had to support Bitcoin and remain sold or receive documented firmware support at the evidence cutoff.
  • The product needed public manufacturer documentation for the selected controls and at least two eligible independent review records.
  • The sample was frozen before states were derived. It is a disclosed research sample, not a census of the market.

Exclusion rules

  • Discontinued products without current firmware support were excluded.
  • Products without enough dated public evidence for every selected control were excluded from this first edition.
  • Price, popularity, asset count, affiliate terms, and manufacturer preference did not affect eligibility or evidence states.

OPEN DATA

Reproduce the report

The versioned JSON and CSV contain the approved public fields, source URLs, localized conclusions, and deterministic summaries used on this page.

Download JSONDownload CSV

Corrections

Report a source error or interpretation problem through the public issue tracker. Material corrections receive a date and revision note rather than a silent rewrite.

Report a correction

Revision history

1.0.0 · 2026-08-28

Initial 2026 edition with four products, six controls, and twenty-four evidence records.

Continue with direct comparisons

The comparison pages add workflow fit, product-specific caveats, and attributed reviewer observations without turning the benchmark into a ranking.

COLDCARD Q vs Mk4COLDCARD Q vs Trezor Safe 5COLDCARD Q vs Ledger Flex