Phantom, Solflare, Backpack or a hardware pairing: pick by what you defend against, checked against solana.com's own wallet directory on 15 October 2026.
Sender checks failed twice: mailing@trezor.io via Brevo, then help@trezor.io auto-replies. The checks that survive, in one table, plus Trezor's own rules.
The STM32 entropy alert is phishing sent through Trezor's breached Brevo account on 9 September. What BitBox and CoinTracking received, and what to do.
Ledger published LSB 023, 024 and 025 on 27 August. The one with the widest reach sits in the Secure SDK rather than in any single app, and none of the three is repaired by updating device firmware.
One device answers the trust question with auditable silicon and a colour touchscreen; the other signs Bitcoin only, behind an air gap, after a summer that broke its own seed generator. What each defends, and against whom.
Thousands of hardware wallet buyers had names, home addresses, phone numbers and emails taken in separate breaches at shipping partners, per TechCrunch. No key was touched, and the threat model changed anyway.
Hardware custody is a set of trade-offs, not a magic box. What a Ledger actually protects you from, what it cannot, and the trust-the-vendor question the marketing does not dwell on.