What the device actually holds
Ask wallet maker Trezor what sits on its device, and its hardware wallet guide answers that it stores the private keys, not the coins. The assets “remain on the blockchain.” When you send, the transaction details travel to the device, get signed inside it with the key, and only the signed result goes back to the computer for broadcast. The key stays put.
Wallet maker Ledger describes the same flow on its academy page. Its secure element chip also drives the screen.
The US securities regulator works from the same picture. A custody bulletin from the SEC’s Office of Investor Education and Assistance, dated December 12, 2025, says wallets “do not store crypto assets themselves” and warns that a lost or stolen cold-wallet device may mean a permanent loss. The way back is the seed phrase, which the bulletin says can restore a wallet if its hardware is lost or damaged.
Where you meet it
The checkpoint is the device’s own screen and buttons, guarded by a PIN. Guessing a Trezor PIN gets slow.
Ledger requires 4 to 8 digits chosen at setup, and without them nobody can sign a transaction or update the firmware, while Trezor allows up to 50 digits. On a Trezor the waiting time doubles after each wrong PIN, and 16 failed attempts wipe the device. The backup words can restore it, so anyone holding them “can access your wallet without needing your Trezor,” the company says.
The Ledger incident of December 14, 2023
On December 14, 2023, attackers turned one of Ledger’s own software libraries against people using third-party crypto apps. The Connect Kit, the JavaScript code that lets websites talk to Ledger devices, was swapped for a malicious version after a former employee fell for a phishing attack, according to a published letter from chief executive Pascal Gauthier. A fix went out within 40 minutes of the company becoming aware.
The bad file stayed live for around five hours, the letter says, and Ledger believes funds were drained within less than two. Its hardware was not affected.
So how did people lose money with a device in hand? Ledger’s academy page is blunt. A hardware wallet, it says, can’t stop you from signing a malicious smart contract, and when a wallet does not display the full details of what is being signed, the practice Ledger calls blind signing, the owner approves something they cannot read.
Ledger’s advice after the incident was to clear sign, because “what you see on the Ledger screen is what you actually sign.” Before pressing confirm, read the address and the amount on the device itself, not on the computer screen beside it.