Why Are Hardware Wallets Under Scrutiny?
Trezor Chief Commercial Officer Danny Sanders has pushed back against recent criticism of crypto hardware wallets, arguing that the category still offers the strongest practical form of self-custody for most users despite clear usability problems.
The debate began after blockchain investigator ZachXBT said he did not advise using hardware wallets for important tasks such as signing transactions or storing funds. He suggested that users managing serious value could instead dedicate a separate iPhone only for storing funds and signing transactions.
The criticism touched a sensitive issue in crypto custody. Hardware wallets are widely promoted as the safer alternative to keeping assets on exchanges or internet-connected wallets, but users often complain about clunky interfaces, firmware updates, transaction delays, and compatibility problems with newer decentralized finance tools.
Sanders acknowledged that frustration, especially when a software or firmware update blocks an urgent or high-value transaction. “I actually get it, and I agree that we have clunky solutions out there,” Sanders said. “It’s really hard to build on the edge of security and usability.”
His response points to a broader custody trade-off. The most secure tools are often harder to use, while more convenient tools usually expose users to more online risk. That trade-off becomes sharper as crypto users move from simple storage into staking, bridging, DeFi transactions, multisig operations, and mobile-first asset management.
Is a Dedicated iPhone Safer Than a Hardware Wallet?
Sanders argued that ZachXBT’s recommendation may make sense only for a narrow group of sophisticated users managing large sums in high-pressure environments. In that setting, a single hardware wallet may not be enough, but replacing hardware wallets entirely with a mobile device creates a different risk profile.
“People who have to manage a lot of value in high-stakes environments need different setups, and just a single hardware wallet is not the best solution for that,” Sanders said. “But it doesn’t mean you can just say everything is garbage.”
A stripped-down iPhone could be useful as part of an advanced custody setup, Sanders said, but he warned that mobile devices carry more attack surfaces. Unlike a dedicated hardware wallet, an iPhone has Wi-Fi, Bluetooth, iMessage, cellular connectivity, and a broader operating system environment. Those features improve usability but also create more ways for malicious software, remote exploits, or user error to enter the signing process.
“You have Wi-Fi and Bluetooth and iMessage and cellular,” Sanders said. “Even generating your keys on a wallet on your iPhone is more risky than with a hardware wallet.”
Hardware wallets also give users a separate screen to verify transaction details before signing. That separation is important because the signing device can show what the user is approving even if a computer or browser interface has been compromised.
Investor Takeaway
The debate is not simply hardware wallet versus smartphone. It is about matching custody design to the user’s risk level. Retail holders, active DeFi users, funds, and protocol teams may need different setups rather than one universal security model.
What Does the Debate Mean for Wallet Design?
The strongest criticism of hardware wallets is not that self-custody is unnecessary. It is that current tools often fail during the moments when users most need them to work smoothly. A transaction delay during a routine transfer is inconvenient. A delay during a liquidation, exploit response, treasury movement, or urgent multisig approval can be costly.
That is why the wallet security debate is moving beyond seed phrases and device storage. Users are asking whether wallet infrastructure can support real-time transaction signing, safer mobile workflows, better backup protection, and clearer transaction verification without forcing users into fragile workarounds.
Tornado Cash co-founder Roman Storm also weighed in, arguing that the main gap is the lack of mobile wallets with BIP39 passphrase support. A BIP39 passphrase lets users add an extra word or phrase to a seed phrase, creating another layer of protection if someone finds the written backup.
“ZachXBT’s got the right idea,” Storm wrote. “There’s just nothing on mobile to actually do it with.”
Storm called on mobile wallet developers to add BIP39 passphrase support and air-gapped transaction signing. Air-gapped signing allows a user to sign a transaction without connecting the signing device directly to a network, reducing exposure to online threats while preserving some of the convenience of mobile workflows.
Why Custody Risk Is Becoming a Market Issue
The dispute comes as crypto users increasingly manage assets across multiple chains, applications, and transaction types. Wallets are no longer passive storage tools. They are becoming the main interface for trading, bridging, staking, lending, governance, and treasury operations.
That makes custody design a market infrastructure issue. If users cannot safely sign transactions under pressure, capital becomes harder to deploy. If security tools are too complex, users may avoid self-custody or make mistakes. If mobile wallets remain more convenient but less isolated, large holders may need layered setups that combine hardware devices, passphrases, air-gapped signing, and multisig controls.
For wallet makers, the message is direct. Security alone is not enough if the signing process breaks at critical moments. Convenience alone is not enough if private keys are exposed to too many attack paths. The next phase of wallet competition will likely be shaped by products that reduce operational friction without weakening key isolation.
For investors and institutions, the debate reinforces a basic point: custody risk is not solved by choosing a brand or a device. It depends on process, threat model, transaction size, backup design, and how often funds must move. Hardware wallets remain central to self-custody, but the market is pushing wallet providers to close the gap between cold-storage security and real-world transaction demands.
