Crypto Self-Custody & Hardware Wallets

The self-custody stack in 2026 has been reshaped by the 2023 Ledger Recover firmware controversy. Trezor + Coldcard + BitBox02 dominate among privacy-and-OSS-conscious users; Ledger still has the largest market share but lost trust with the open-source crowd. Software wallets are dominated by Sparrow, Bitcoin Core, Electrum for BTC and MetaMask / Rabby / Frame for EVM. For tracking see Rotki & Crypto Tracking; for full-node hardware (Umbrel etc.) see Self-Hosted Personal Apps; for digital legacy see Digital Legacy & Vault Apps; for vital docs / seed storage see Self-Hosted Vital Docs; for password vault see Self-Hosted Passwords; for backups see Backup & Disaster Recovery.

Hardware wallets (the 2026 lineup)

• ★ Trezor (Model One, Safe 3, Safe 5) — paid (~$60–220); fully open-source firmware + hardware schematics; SatoshiLabs; Czech Republic; the OSS-first default.
• ★ Coldcard Mk4 / Q — paid (~$160–250); Bitcoin-only; air-gapped (microSD / QR); open-source firmware; secure-element; the BTC-maximalist + Sparrow pick.
• ★ BitBox02 — paid (~$170); Swiss; open-source firmware; secure-element; clean UX; strong privacy-focused choice.
• Keystone (3 Pro, Tablet) — paid; air-gapped via QR; popular among "no USB ever" users.
• Foundation Passport — paid; air-gapped; nicely designed; smaller community.
• SeedSigner / Krux — free OSS DIY; build your own air-gapped signer on a Raspberry Pi Zero or M5StickV.
• Frostsnap — paid; FROST-based threshold signer; newer.
• Specter Shield / Specter DIY — paid + DIY; multisig-flavored.
• Ledger (Nano S+, X, Stax, Flex) — paid; largest market share; 2023 Recover firmware controversy raised concerns about closed-source firmware running on the secure element. Many OSS-conscious users have moved to Trezor / Coldcard / BitBox02.

The Ledger 2023 controversy (★ context)

In May 2023, Ledger announced Ledger Recover — an opt-in service where the device firmware can split your seed into encrypted shards across three custodians. Backlash centered on:

• ★ Closed-source secure-element firmware could technically extract / split seeds; users had previously been told this was impossible.
• ★ The trust model fundamentally relies on Ledger's intent — if compelled by a court or compromised, code paths exist.
• ★ Other vendors (Trezor, Coldcard, BitBox02) responded by emphasizing fully OSS firmware + reproducible builds.

Practical: existing Ledger devices still work for self-custody; many users continue using them. Privacy-and-OSS-first users tend to recommend Trezor / Coldcard / BitBox02 to new buyers.

Software wallets (BTC)

• ★ Sparrow Wallet — free OSS desktop; the 2026 power-user BTC default; full PSBT support; works with all major hardware wallets; multisig; CoinJoin; great UX.
  • https://sparrowwallet.com/
• ★ ★ Bitcoin Core — free OSS; the reference Bitcoin implementation; full node + wallet; canonical source of truth; pair with Sparrow as the front-end.
  • https://bitcoincore.org/
• ★ Electrum — free OSS; long-running BTC wallet; lighter than Bitcoin Core; SPV.
• Wasabi — free OSS; privacy-focused; CoinJoin built-in.
• Samourai — free OSS Android; privacy-focused.

Software wallets (EVM / Multi-chain)

• ★ Rabby Wallet — free OSS browser extension + desktop; clearer UX than MetaMask 2024–26; pre-execution simulation; security-focused.
• MetaMask — free; long-time default; closed-source-mobile / OSS-extension; usability declining 2024–26.
• Frame — free OSS desktop; system-wide signer; pairs with hardware wallets.
• Brave Wallet, Trust Wallet, Coinbase Wallet, Phantom — free; varying OSS status.

Lightning Network wallets

• Phoenix — free; non-custodial Lightning; ACINQ.
• Zeus — free OSS; pairs with your own LND / CLN node.
• Mutiny — free OSS web Lightning wallet.
• Breez — free; non-custodial LSP-flavored.

Multisig

• ★ Sparrow + Coldcard + Trezor — free OSS multisig setup; the canonical "two-of-three with hardware diversity" stack.
• Casa — paid; managed multisig with key-recovery service; for non-technical high-net-worth users.
• Unchained Capital — paid; collaborative multisig; institutional-flavored.
• Liana — free OSS; timelock-based recovery.
• Specter Desktop — free OSS; multisig-focused desktop app.
• Nunchuk — free + paid; multisig-friendly mobile + desktop.

Self-host crypto node

• Umbrel — free OSS; Raspberry Pi / x86 personal-server OS; one-click Bitcoin Core + Lightning + apps. See Self-Hosted Personal Apps.
• Start9 (StartOS) — free OSS; commercial appliance + free OS.
• MyNode — free + paid premium.
• Citadel — free OSS fork-of-Umbrel.
• RaspiBlitz — free OSS Raspberry Pi distro for Bitcoin + Lightning.
• nix-bitcoin — free OSS; reproducible NixOS-based stack.

Running your own node ⇒ better privacy (don't query someone else's electrum server) + sovereignty + Lightning channels.

Seed storage (★ critical)

• ★ Steel backup — paid (~$50–150); fire / flood / earthquake-resistant; engraved or stamped seed phrase. Brands: Cryptosteel, Blockmit, Steelwallet, Coldti.
• ★ Paper backup in a fireproof safe — free + cheap safe; OK if you're disciplined.
• ★ Shamir's Secret Sharing (SLIP39) — Trezor's native split-into-shards; for advanced users.
• Multisig — eliminates the single-seed-loss failure mode; complexity tradeoff.
• ★ NEVER photograph the seed; NEVER type it into a computer (except hardware-wallet recovery).
• Store the seed location, not the seed, in your password manager / vault. See Digital Legacy & Vault Apps.
• Geographic separation — multiple steel backups in different physical locations is the gold standard.

Inheritance + crypto (★)

The hardest unsolved problem of self-custody. Options:

• ★ Multisig with a custodial co-signer (Casa, Unchained) — co-signer can help heirs.
• Time-lock with Liana — heirs can spend after N months without your sig.
• Sealed instructions in a safe-deposit box / fireproof home safe — sealed envelope: device location + PIN + steel-backup location. Heir-readable.
• Detailed letter in your estate vault — see End-of-Life Wishes.
• Hardware-wallet manufacturer "legacy" features are limited; assume they don't exist.
• ★ Document the inheritance path as carefully as the security itself.

License / pricing

• Trezor, Coldcard, BitBox02, Keystone, Foundation, Frostsnap, Ledger: paid hardware.
• SeedSigner, Krux: free OSS DIY (cost of components ~$30–100).
• Sparrow, Bitcoin Core, Electrum, Wasabi, Samourai, Rabby, Frame, Liana, Specter, Nunchuk, Phoenix, Zeus, Mutiny: free OSS (or free + community tip).
• Umbrel, Start9, Citadel, RaspiBlitz, nix-bitcoin: free OSS (hardware costs separate).
• Casa, Unchained: paid managed.

Pick this if…

• Default OSS-first hardware wallet, BTC + alts: Trezor Safe 3 / Safe 5.
• BTC-only, air-gapped, OSS-first: Coldcard Mk4 / Q + Sparrow.
• Privacy-focused Swiss-engineered: BitBox02.
• DIY, very technical: SeedSigner or Krux.
• Existing Ledger user: keep it; if you're buying new and OSS-conscious, consider Trezor / Coldcard / BitBox02.
• Multisig (2-of-3 hardware diversity): Sparrow + Coldcard + Trezor + a third device.
• Non-technical high-net-worth: Casa or Unchained collaborative multisig.
• Self-host node: Umbrel or Start9 on a Raspberry Pi 5 / mini PC.
• Tracking holdings: Rotki, watch-only via xpubs.