Recent disclosures about compromised Bitcoin hardware wallets have reignited a familiar debate in the industry: how safe are self-custody devices compared with holding Bitcoin through exchange-traded funds (ETFs). The discussion comes after investigations into wallet exploits affecting cold-storage brands, including a Ledger case involving unauthorized hardware modifications.

As the public conversation expands, prominent voices argue that the answer is less about whether hardware wallets can be secure—and more about how threats are modeled, how devices are configured, and what trade-offs investors accept when choosing between personal custody and managed products.

Key takeaways

Ledger-related findings highlight a new class of risk: compromised hardware can shift the threat model beyond typical user errors and software vulnerabilities.
ETF advocates frame “enhanced security” as part of the product value proposition, especially for large holders who move assets to specialists.
Blockstream CEO Adam Back argues wallet manufacturers have historically lagged in threat modeling, suggesting the industry needs to catch up.
Executives and researchers emphasize setup and operational rigor: self-custody security still depends heavily on users avoiding mistakes and avoiding rushed migrations.

Ledger compromise renews scrutiny of cold-storage assumptions

The current wave of debate follows coverage of a compromised Ledger wallet reportedly containing an unauthorized hardware implant. Investigators cited in that reporting estimated that losses from such implants could exceed $86 million, a figure that has helped push hardware-wallet security from a niche discussion into mainstream investor concern.

While hardware wallets are designed to keep private keys offline, the Ledger development underscores that real-world attacks are not limited to malicious software or bad user behavior. When the supply chain or device integrity is compromised before a user ever interacts with it, the “cold” aspect alone may not be sufficient protection.

Plan B and the ETF argument: “zero regrets”

In the midst of these concerns, Bitcoin analyst Plan B pointed to his earlier decision to shift his Bitcoin holdings to ETFs. According to Plan B, he had made that move in 2025 and still sees it as the correct choice in light of recent Coldcard and Ledger exploit discussions.

In a Monday post on X, Plan B wrote he had “zero regrets” about the ETF decision. The key claim from the analyst’s perspective is that ETF custody reduces the reliance on individual operational discipline—transferring custody responsibilities to a specialist framework rather than an investor-managed setup.

Why large holders have used ETFs for years

One reason the ETF angle keeps resurfacing is that the behavior it describes is not new. Large holders have been moving self-custodied Bitcoin into ETFs for years, with “enhanced security” often cited as a primary selling point. Cointelegraph’s Ophelia Snyder, 21Shares co-founder, explained in an email that this long-running conversion of holdings has become part of “public discourse” again as additional hardware exploit reports circulate.

The implication is straightforward: when investors see evidence that self-custody can face complex risks—even beyond basic user mistakes—the motivation for delegating custody to regulated investment products becomes more persuasive, particularly for institutions and high-net-worth participants.

Hardware wallets can remain secure, but threat modeling must improve

Not everyone agrees that the recent events invalidate hardware wallets. Blockstream CEO and Hashcash inventor Adam Back said hardware wallets can still be a secure custodial option, but he argued that manufacturers must improve their understanding of the evolving threat landscape.

Back wrote on X that it appeared that “surprisingly few” manufacturers understood generic attacks for much of the last decade, calling for better “catch up” on threat modeling. In editorial terms, that matters because many investor discussions treat hardware wallets as a stable, solved problem. The more credible framing, however, is that device security is a continuous engineering process—one that has to adapt as attackers find new ways to target custody systems.

At the same time, Snyder argued that the core difference between self-custody and delegated custody is practical: self-custody security depends on the investor’s technical expertise and the rigor used when setting up and using the wallet. She emphasized that without careful setup, self-custody will generally be less secure than handing assets to specialist firms whose job includes managing custody protocols.

“Without taking the time and rigor to set up properly, self-custody will always be less secure than handing over the assets to a specialist firm whose job it is to manage those protocols for you.”

Security researcher Jameson Lopp similarly urged caution, saying self-custodial wallets can still be robust but warning investors against a mass migration that could create new central points of failure—especially if people move quickly and without sufficient planning.

The unresolved question: what investors should watch next

These exchanges leave a clear takeaway: hardware wallets are not automatically unsafe, but recent reports show that attackers can target more than end-user behavior. Investors deciding between self-custody and ETF custody should watch for how wallet providers respond—particularly around threat modeling, distribution safeguards, and how incidents are assessed in the wider ecosystem.

Until the industry can consistently map and mitigate supply-chain and device-integrity risks, the debate will likely continue—less as a binary “self-custody vs. ETFs” argument, and more as a question of operational resilience, manufacturing security, and how quickly institutions and individuals can adapt their custody strategies to new threat models.