On-chain investigator ZachXBT sparked a debate by calling hardware wallets “complete garbage” for serious crypto use, recommending a spare iPhone instead. His criticisms focused on issues like dead batteries, forced updates, and UI bugs during time-sensitive transactions. Security researcher Axel Bitblaze agreed with some points but questioned the phone approach, suggesting a 2-of-3 multisig setup. Tornado Cash co-founder Roman Storm noted mobile wallets lack BIP39 passphrase support. Trezor defended hardware wallets as dedicated devices that keep private keys offline, while Keystone acknowledged the potential of an isolated phone but stressed user discipline. Ledger emphasized that private keys never touching the internet can’t be phished.
Crypto investigator ZachXBT stated on his Telegram channel that “all hardware wallets are complete garbage and I do not advise using them for important tasks like signing transactions or storing funds.” He argued that a separate iPhone used solely as a wallet could outperform any hardware wallet on the market, specifically criticizing Ledger. “Ledger is the worst and Ledger Live has regular updates for UI/apps for no good reason that break simple actions,” he claimed.
On X, he listed problems hardware wallet users face during high-value time-sensitive transactions: dead batteries, obligatory upgrades, UI changes, and site bugs that prevent signing multisig transactions. Security researcher Axel Bitblaze agreed with the criticism but questioned whether a phone leaves users with “one device and one seed as the single point of failure.” He recommended a 2-of-3 Safe multisig setup with separate signer devices and offline seed storage.
Tornado Cash co-founder Roman Storm argued that mobile wallets lack BIP39 passphrase support, calling it the main advantage of hardware wallets. Trezor said a phone runs a full operating system with many attack points, while a hardware wallet is a dedicated device keeping private keys away from general computing environments. Keystone Wallet acknowledged ZachXBT was “not wrong” about an isolated phone’s potential but argued most users are better served by purpose-built units due to the discipline required for phone security.
Ledger stated its security model keeps private keys offline: “A private key that never touches the internet can’t be phished, deepfaked, or prompt-injected out of existence.” However, an incident earlier this year saw a victim lose $282 million in BTC and LTC from an offline device through social engineering.
