![\"ZachXBT](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/08\/blog-why-cold-wallet-in-smartphone-are-bad-choice-08-08-2026-content-pic2-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\nFirst, the facts, because social media retellings have already picked up details that were never in the original post.<\/p>\r\n\r\n\r\n\r\n
On July 16, 2026, ZachXBT posted in his Telegram channel that \u201call hardware wallets are complete garbage\u201d and advised against using them for signing transactions or storing funds. He singled out Ledger as the worst option.<\/p>\r\n\r\n\r\n\r\n
Instead, he suggested keeping a separate iPhone used exclusively for crypto. He also added that this setup is only suitable for technically experienced users.<\/p>\r\n\r\n\r\n\r\n
His main complaint about Ledger is the software, not the hardware.<\/strong> The company renamed Ledger Live to Ledger Wallet and added buying, swaps, staking, and yield features. Updates arrive frequently and, according to ZachXBT, can break basic functionality at exactly the moment you need to sign a transaction urgently.<\/p>\r\n\r\n\r\n\r\n Now for what the post did not contain. He did not demonstrate a vulnerability. He did not claim the Secure Element had been compromised. And he did not publish the kind of technical breakdown he is respected for in other areas.<\/p>\r\n\r\n\r\n\r\n This is the opinion of an experienced practitioner, not a security study. That distinction matters, because \u201cthis device is badly designed\u201d and \u201cthis device has been hacked\u201d are two very different claims to verify.<\/p>\r\n\r\n\r\n\r\n The second point that almost everyone missed:<\/strong> ZachXBT recommended a dedicated iPhone, not an air-gapped device with no network connectivity at all. That is an isolated hot wallet: the phone is still online, the app receives updates, and transactions are signed online.<\/p>\r\n\r\n\r\n\r\n The Incrypted guide takes the idea in a different direction: factory reset, SIM removed, radios disabled, and transactions signed through QR codes between two devices. That is no longer the same setup ZachXBT suggested. We cover both approaches because online discussions have largely merged them into one.<\/p>\r\n\r\n\r\n\r\n Danny Sanders, Trezor’s Chief Commercial Officer, responded the same day. He acknowledged that hardware wallets can be inconvenient and that a firmware update can genuinely get in the way of an urgent transaction.<\/p>\r\n\r\n\r\n\r\n But he pointed to the key issue: a phone remains a general-purpose device where transaction verification and signing happen within the same trust domain. We will return to this in a dedicated section because it is the strongest argument in the entire debate.<\/p>\r\n\r\n\r\n\r\n [vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n Neither side of this debate is claiming that private keys have been leaking directly out of hardware wallets. In 2026, funds are far more often stolen through fake apps, phishing, and address substitution. Keep that in mind when deciding which problem you are actually trying to solve.<\/p>\r\n [\/vc_message]<\/p>\r\n\r\n\r\n\r\n Cold storage means the private key has never been, and will never be, in an environment connected to a network. Not \u201calmost never.\u201d Not \u201cI turned off Wi-Fi.\u201d Never.<\/p>\r\n\r\n\r\n\r\n Now look at the process described in the guide. The phone has to be activated, updated to the latest supported version, connected to an app store, and used to download the wallet before it is isolated. On iOS, there is no way around this stage: activation and the App Store require a network connection.<\/p>\r\n\r\n\r\n\r\n So the device on which you later generate the seed phrase has already been online, has already received third-party code, and already has a history you did not verify.<\/p>\r\n\r\n\r\n\r\n A hardware wallet<\/a> takes a different path. It generates entropy \u2014 the random data used to create the key \u2014 inside a Secure Element on a device that does not have a full general-purpose network stack. This is not a matter of user discipline; it is a property of the device architecture.<\/p>\r\n\r\n\r\n\r\n So the accurate description is this: an isolated smartphone gives you a hot wallet with a reduced attack surface. That is better than running MetaMask on your everyday phone. But it is not true cold storage, and calling it a full cold-wallet replacement is misleading.<\/p>\r\n\r\n\r\n\r\n This is the first point we can support with numbers rather than intuition.<\/p>\r\n\r\n\r\n\r\n A smartphone runs a full operating system: GPU drivers, a Bluetooth stack, font renderers, image parsers, media codecs, a browser engine, and vendor background services. Every one of those components was written by people, and every one can contain bugs.<\/p>\r\n\r\n\r\n\r\n Hardware-wallet firmware has a much narrower job than a full mobile OS. Its core role is to handle keys securely, display transaction details, and produce signatures.<\/p>\r\n\r\n\r\n\r\n What does that mean in practice? In its 2025 review<\/a>, Google Threat Intelligence Group counted 90 zero-day vulnerabilities \u2014 flaws unknown to the vendor before exploitation \u2014 that were used in real-world attacks.<\/p>\r\n\r\n\r\n\r\n Of those, 39 affected operating systems, while mobile zero-days rose to 15 from 9 the year before. One Android security bulletin in December alone patched more than 100 vulnerabilities. Ledger or Trezor firmware does not see anything close to that volume simply because there is far less code involved.<\/p>\r\n\r\n\r\n\r\n A good example of how this works is LANDFALL,<\/strong> commercial-grade spyware that Unit 42 analyzed<\/a> in November 2025. CVE-2025-21042 was located in Samsung’s image-processing library. The exploit was delivered through a specially crafted DNG image in a messenger app, often without any user interaction.<\/p>\r\n\r\n\r\n\r\n Samples date back to July 2024, while the patch arrived in April 2025. In other words, the vulnerability appears to have been used in the wild for roughly nine months before it was later added to CISA’s catalog of actively exploited vulnerabilities.<\/p>\r\n\r\n\r\n\r\n The important point is that none of these vulnerabilities were in a crypto wallet. They were in an image parser, a graphics driver, or a font engine.<\/p>\r\n\r\n\r\n\r\n But any one of them can lead to privilege escalation, and once an attacker has system-level access, everything becomes visible \u2014 including the memory of the wallet app holding your key.<\/p>\r\n\r\n\r\n\r\n This is the second point, and it is the one that concerns us most. Phones are constantly researched not just by hobbyists, but by commercial companies with serious budgets.<\/p>\r\n\r\n\r\n\r\n Look at the prices. Exploit broker Crowdfense<\/a> publicly offers up to $7 million for an iOS zero-click chain \u2014 an attack that requires no action from the victim \u2014 and up to $5 million for Android. Its overall exploit acquisition budget was $30 million.<\/p>\r\n\r\n\r\n\r\n Russia-based Operation Zero has said it is willing to pay up to $20 million for a full chain. For comparison, Google paid roughly $17 million in bug bounties across 2025. In some cases, a researcher can make more by selling a vulnerability to a broker than by reporting it to the vendor.<\/p>\r\n\r\n\r\n\r\n That creates a market. In its 2025 review, GTIG recorded for the first time that commercial surveillance vendors had overtaken state-backed groups in attributed zero-day use: 18 of 42 attributed cases were linked to commercial surveillance vendors.<\/p>\r\n\r\n\r\n\r\n Now consider Israeli mobile forensics, which is often misunderstood. Cellebrite and GrayKey \u2014 originally Grayshift, now part of Magnet Forensics \u2014 do not need to attack the protected chip directly. They exploit weaknesses in the operating system to bypass the lock screen and then extract data through the system itself.<\/p>\r\n\r\n\r\n\r\n Leaked support matrices published by 404 Media<\/a> show a clear pattern: older devices and older OS versions often support full data extraction, while newer versions are marked as still under research.<\/p>\r\n\r\n\r\n\r\n That is an uncomfortable conclusion for anyone using a phone as a wallet. Secure Enclave or Titan M2 does not solve the problem if the path in is through firmware or OS vulnerabilities. No one needs to attack a protected element under a microscope when there is a cheaper route: bypass the lock screen and work with the system as root.<\/p>\r\n\r\n\r\n\r\n And the worst part is that the exact device people usually recommend pulling out of a drawer \u2014 an old phone without current patches \u2014 is often the easiest category to extract data from.<\/p>\r\n\r\n\r\n\r\n [vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n If your threat model includes physical access to the device \u2014 theft, loss, a border search, or seizure \u2014 keeping a seed phrase on a phone is one of the riskiest options. Most modern hardware wallets protect access with a PIN or another local authentication mechanism and limit brute-force attempts.<\/p>\r\n [\/vc_message]<\/p>\r\n\r\n\r\n\r\n Third point. Guides usually tell you to remove the SIM card, enable airplane mode, and separately disable Wi-Fi and Bluetooth in settings. Those are sensible steps, but they do not create a true air gap. Here is why.<\/p>\r\n\r\n\r\n\r\n Airplane mode is a software flag. The operating system decides whether the transmitter is actually powered down. If the system is compromised, the flag itself no longer guarantees anything.<\/p>\r\n\r\n\r\n\r\n You cannot simply remove the radios from a modern smartphone either. Wi-Fi and Bluetooth are typically integrated into the same combo chip, while the cellular modem is built into the SoC or soldered nearby.<\/p>\r\n\r\n\r\n\r\n Trying to physically remove them turns the phone into a brick, not an air-gapped device. You are not removing the radio; you are removing the phone’s ability to function.<\/p>\r\n\r\n\r\n\r\n It gets more interesting from there. Since iOS 15, Bluetooth, NFC, and UWB chips can continue operating in a low-power mode for up to 24 hours after an iPhone is switched off, supporting features such as Find My, car keys, and payments.<\/p>\r\n\r\n\r\n\r\n Researchers at TU Darmstadt’s Secure Mobile Networking Lab showed in \u201cEvil Never Sleeps<\/a>\u201d that the Bluetooth chip firmware was neither signed nor encrypted and that secure boot was not enabled for it. On a compromised device, code could be placed there and continue running even while the phone appeared to be off.<\/p>\r\n\r\n\r\n\r\n So \u201coff\u201d on a phone ultimately means \u201cthe system says it is off.\u201d Dedicated hardware wallets usually expose a much narrower set of interfaces, and some models have no wireless connectivity at all. COLDCARD Mk4, for example, physically includes NFC, but it is disabled by default and can be permanently disabled at board level if desired.<\/p>\r\n\r\n\r\n\r\n Tangem does have NFC, but it has neither a general-purpose operating system nor a battery, so there is nothing that can keep running invisibly in the background without the owner knowing.<\/p>\r\n\r\n\r\n\r\n This argument was not part of the original list of talking points, but in our view it is the most important one. It is not about a specific vulnerability; it is about architecture, which means a software patch cannot eliminate it.<\/p>\r\n\r\n\r\n\r\n When you sign a transaction with a hardware wallet, the recipient address and amount are shown on a separate device with its own screen. An infected computer can display anything it wants, but the hardware wallet shows what is actually about to be signed, and you confirm it with a physical action on that device. That gives you a second, independent check.<\/p>\r\n\r\n\r\n\r\n On a phone, both the address display and the signature are produced within the same system. If that system is compromised, there is no independent verification left: the same software environment that prepares the transaction also controls what you see on screen.<\/p>\r\n\r\n\r\n\r\n This is not theoretical. At ACM CCS in October 2025, researchers presented Pixnapping<\/a> (CVE-2025-48561), an attack in which a malicious app with no special permission can reconstruct what another app displays by exploiting a side channel in the graphics pipeline.<\/p>\r\n\r\n\r\n\r\n Researchers extracted two-factor authentication codes in under 30 seconds on Pixel 6-9 devices and the Galaxy S25. They bypassed the September patch, and Google released another fix in December.<\/p>\r\n\r\n\r\n\r\n Now remember what the guide itself says about generating a seed phrase: 12 or 24 words are displayed in plain text on screen, and that is exactly when the phrase is most exposed. On a hardware wallet, that screen does not belong to a general-purpose operating system. On a phone, it does.<\/p>\r\n\r\n\r\n\r\n This is worth a separate look for anyone who believes Apple silicon settles the security question by itself. In 2023, Kaspersky disclosed Operation Triangulation<\/a>, a chain of four zero-days that infected iPhones through an invisible iMessage with no interaction from the victim.<\/p>\r\n\r\n\r\n\r\n The most interesting link in the chain was CVE-2023-38606. The attack used an undocumented hardware feature in Apple chips: special registers that allowed the attackers to bypass hardware memory protection. The feature appeared in neither public documentation nor drivers, and it is still unclear how the attackers learned about it.<\/p>\r\n\r\n\r\n\r\n Why does this matter here? Secure Enclave and similar protected zones do not exist in a vacuum; they live inside the same SoC as the rest of the system. When researchers discover hidden mechanisms inside that SoC, claims about \u201cbank-grade security\u201d only hold until the next layer of research.<\/p>\r\n\r\n\r\n\r\n A hardware wallet may also contain a Secure Element, but the surrounding attack surface is usually a few buttons, a screen, and a limited set of interfaces \u2014 not a full operating system running a messenger that accepts incoming content from anyone in the world.<\/p>\r\n\r\n\r\n\r\n Fourth point. Smartphones are designed for multitasking, media, connectivity, and convenience. Their trade-offs are made in favor of features, not in favor of preserving one secret safely for many years. You can see that in three very practical areas.<\/p>\r\n\r\n\r\n\r\n As of February 2026, more than 40% of active Android devices \u2014 over one billion phones \u2014 were running Android 12 or older versions for which Google no longer provides full system-level patching.<\/p>\r\n\r\n\r\n\r\n The old phone sitting in a drawer is exactly the kind of device this affects. The guide correctly says the phone should still receive security updates, but that removes the main argument about the setup costing nothing.<\/p>\r\n\r\n\r\n\r\n Lithium batteries age with time, not only with charge cycles. After several years in storage, you may end up with a swollen cell pressing against the screen and motherboard.<\/p>\r\n\r\n\r\n\r\n Hardware wallets either draw power from USB or use their own battery, while a card-format device such as Tangem has no battery at all.<\/p>\r\n\r\n\r\n\r\n To bring an iPhone back online after it has spent years in a safe, you may need Apple activation servers, an account, and the password for that account. That creates an external dependency on a company, its policies, and your ability to remember the credentials years later.<\/p>\r\n\r\n\r\n\r\n A hardware wallet can be powered over USB without asking anyone for permission. If the device itself fails, the seed phrase can be restored on any compatible wallet in minutes.<\/p>\r\n\r\n\r\n\r\nThe category mistake: a cold wallet on a smartphone is not cold storage<\/h2>\r\n\r\n\r\n\r\n
More code means more attack surface \u2014 and the numbers show it<\/h2>\r\n\r\n\r\n
![\"Codebase](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/08\/blog-why-cold-wallet-in-smartphone-are-bad-choice-08-08-2026-content-pic3-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\nThe industry built around breaking into phones<\/h2>\r\n\r\n\r\n
![\"Cybercriminals](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/08\/blog-why-cold-wallet-in-smartphone-are-bad-choice-08-08-2026-content-pic4-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\nThe air gap that is not really there<\/h2>\r\n\r\n\r\n
![\"Disassembled](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/08\/blog-why-cold-wallet-in-smartphone-are-bad-choice-08-08-2026-content-pic5-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\nOne screen, one trust domain<\/h2>\r\n\r\n\r\n\r\n
Operation Triangulation: when even Apple hardware is not enough<\/h2>\r\n\r\n\r\n\r\n
A smartphone is a consumer device \u2014 it was not built for this<\/h2>\r\n\r\n\r\n
![\"Cold](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/08\/blog-why-cold-wallet-in-smartphone-are-bad-choice-08-08-2026-content-pic6-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\nSupport ends sooner than you think<\/h3>\r\n\r\n\r\n\r\n
The battery ages even inside a safe<\/h3>\r\n\r\n\r\n\r\n
Bringing the device back to life years later is harder than it sounds<\/h3>\r\n\r\n\r\n\r\n
![\"Hardware](\"https:\/\/lwallet.com.ua\/wp-content\/uploads\/2026\/08\/blog-why-cold-wallet-in-smartphone-are-bad-choice-08-08-2026-content-pic7-1024x573.jpg\" "\\"\\"")
<\/figure>\r\n<\/div>\r\n\r\n\r\n