Hardware wallets face a self-custody test after security incidents

By Tom Whitfield

Losing every card in Tangem’s seedless setup, which can use three physical cards, would permanently lock users out, the company confirmed to Cointelegraph. One card receives the generated private key, while backup copies can reside on up to two additional devices.

That constraint anchors a renewed debate over whether self-custody suits beginners. Safe Labs CEO Rahul Rumalla and Onramp CEO Michael Tanguma disagree on the model’s original purpose.

What did the wallet failures expose?

Recent incidents involving Ledger and Coldcard have exposed weaknesses in hardware wallets, a category widely recommended as one of the safest ways to hold crypto because private keys remain offline. Implants in some Ledger devices stole recovery phrases, while a Coldcard firmware bug separately allowed attackers to recreate private keys and steal funds.

Those failures shift the practical question from whether offline storage is secure in principle to whether vendors can protect the devices, firmware and interfaces around it. The burden now falls on hardware makers to contain supply-chain and update risks before those products can meet beginner users’ security needs.

Was self-custody meant for beginners?

Onramp CEO Michael Tanguma compared Bitcoin custody with personal computers in the 1970s, when users needed technical skills to assemble and operate them. “Self-custody was never designed with newcomers in mind,” he told Cointelegraph.

Simpler designs later helped computers reach a wider audience, and Bitcoin custody now faces a comparable design challenge. Making self-custody easier could be critical to Bitcoin’s broader adoption because direct control over assets remains a defining feature of the network.

Safe Labs CEO Rahul Rumalla rejected that conclusion. He said self-custody was always intended for everyone, arguing that owning and controlling assets is crypto’s central purpose and that users need not perform every security task themselves.

What does multisig change?

Multisignature wallets require multiple keys to authorize transactions, which can reduce dependence on any single key. Synergy Network CTO Justin Hutzler said traditional implementations can add complexity across signer coordination, key backups, recovery procedures and transaction approvals.

Those tasks can overwhelm a first-time user even as multiple keys improve resilience against the loss of one credential. Multiple approvals do not prevent every attack, and Rumalla said several signers could still authorize a malicious transaction if all relied on the same compromised interface.

That limitation matters for custody providers and wallet vendors because multiple signers do not create independent verification when they trust the same interface. The operational burden shifts toward helping users coordinate legitimate signers while ensuring they do not approve the same deceptive request.

Do seedless wallets solve recovery risk?

Tangem’s approach removes recovery-phrase management by generating a private key on one card and placing backups on no more than two additional devices. The tradeoff is physical custody: users must secure every card, and Tangem said no user has reported losing all of them.

Foundation CEO Zach Herbert said seedless backups can preserve self-custody while avoiding a written recovery phrase. He criticized Tangem’s lack of a built-in screen, which leaves users relying on smartphones to verify transaction details.

“An attacker does not need to extract your private key if they can trick you into authorizing a transaction that empties your wallet,” Herbert said. The warning applies beyond Tangem, because inaccessible keys do not block a fraudulent interface from capturing a valid approval.

Seedless design must therefore solve two distinct problems: recovering access after physical loss and preventing deceptive transaction approval. Card backups address the first while leaving the second dependent on interface security and user verification.

Where does responsibility sit?

The disagreement is not limited to interface design. Tanguma frames self-custody as a product that must become simpler, while Rumalla treats it as an ownership model that can remain accessible to beginners when providers handle implementation.

For custody businesses, that distinction affects product design, support costs and security controls. Simplifying recovery can reduce one failure mode, but screenless verification, approval through one compromised interface and card loss can move risk to the user or another device rather than remove it.

The discussions disclosed no implementation deadline or coordinated industry standard. The market-structure change to watch is whether safer multisig, card-based recovery and transaction verification allow self-custody to expand beyond technically confident Bitcoin users.