If I were asked to build the perfect wallet today I would look at three specific things. What is it built out of: chips, elements, materials. How is it programmed: the firmware and the software. Finally, who built it, how do they behave, and what is their mission. Basically asking the wallet the classic Arnold Schwarzenegger line, “who is your daddy and what does he do?”

Those three questions would lead me down a tree that is fraught with ideology, technical limitations, economic trade-offs, and so many layers of trust. I think most could agree that the “Perfect Wallet” is not only a difficult thing to achieve, but perhaps a deeply personal one.

But let's give it a try. I'll build a hypothetical wallet out of known components and explain why I think it represents the best of what I want out of a wallet.

Start with the grains of sand. This year's DEF CON will showcase in their badge a long-awaited project by developer bunnie and baochip. The idea is to inspect your wafer, then build visibly on top of that.

The first test will come through this year's DEF CON badge. The trust layers I'm interested in are execution of firmware, screen control and transaction parsing — all attack surfaces that rely on the semiconductor manufacturer's specs. So let's start our hypothetical wallet here, with an MCU whose physical implementation can be examined instead of merely documented.

Now we are interested in cryptography and physical attacks. Traditional secure elements come from manufacturers like ST, Infineon, Microchip with proven track records. Say some dastardly or fortunate actor grabs my new wallet and I no longer have it in hand. The secure elements from these manufacturers provide varying levels of security from zips and zaps that try to break in and steal my private keys. These secure elements resist sophisticated attacks, but their internal design remains basically closed even to the owner of the device.

The philosophy of obscurity from the chip design is believed to add security. The manufacturer and its certification process become auditors of a component on my device that I cannot fully inspect. The evidence says that trusting these chips is often justified, but only as long as the game stays the same.

For this wallet, we'll try something different with a secure element from TROPIC. Recent external tests have shown it handles some punishment in the zip-zap department. The testing exposed weakness, but that is partly the point. In an open system, weaknesses become inspectable engineering problems rather than forever buried. The trust layer has not disappeared, but now it can be checked.

The next layer, auditable open source firmware and software, is almost universally accepted. The open source claims from current wallet makers live mostly at this level and they are legit. I will be 100 percent clear that I am not qualified to even speculate as to what would be the most secure choice here, but will simply say I will only pick one with fully open-source code and it's on me to learn.

The final layer I have focused on a lot in my previous articles but it is worth mentioning here again: the open source mission. A wallet company's mission should be auditable just like the code. I don't mean in a greenwashed CEO, or a finance bro's bravado — I mean have you had your company's history tracked and audited? What have you done about past problems? What's your security record as it stands today, and an honest assessment about how you are addressing it?

Open silicon, open secure element, open software, open company. Are we picking up a theme?

This is the radically open model. Auditable trust from chip to company. If anyone claims they can remove trust entirely from the equation I believe they are mistaken. If you put effort into demonstrating where your trust is derived, I'm back on board and listening.

Software has always built more software. Now, software buys software.

Most modern AI systems introduce some level of Agentic Commerce. The AI, acting as an agent for the user, buys tokens, pays for third party applications, and even has the option to interact with financial systems. Hardware devices have a role to play in building trust when it comes to these agentic systems and the reason is because of the architecture of how they are built.

Previous efforts on the internet have gone through iterations of building human identity with usernames, passwords, accounts, and, dreadfully, subscriptions. New trends are emerging that bypass the identity crisis entirely and are being tooled for autonomous economic activity. Autonomous commerce requires trust in heterogeneous payments, identity, authorization systems to become interoperable instead of separate products.

I think the interesting question becomes not just how do organizations come together to build those standards; I remember my pops talking about the W3C and the many other standards groups, particularly about how apparently Sir Tim Berners-Lee was a bit of a Diva*, but mostly because they established HTTP, OAuth, and XML, while conventions like RSS and REST gave developers shared ways to build. Industry had to agree on common protocols or the web would fracture into incompatible ecosystems. The web did not scale because one company built the best browser. It scaled because competitors agreed on enough common protocols that innovation could happen above them. Agentic commerce appears to be reaching a similar moment. MCP, x402, stablecoins, authorization frameworks and identity standards are all evolving independently and they will become transformative if they converge into a shared language.

Coinbase introduced Agentic Wallets in February 2026, MetaMask has one, Ledger has an Agent Stack. Many large crypto houses either have them or are similarly interested in building them out. In many ways this mirrors the wider world of the new ecommerce following similar trends in online shopping wallets, social media payment methods, banking, trading and gambling platforms. Still, differences are starting to emerge between the philosophies of the wallets. At first glance they appear to be solving the same problem. They aren't. Those differences come down to this:

“When is human intervention required?”

Programmable wallets delegate in advance, they are customized by people and then largely hand off the authority to act to the agent. The other approach is centered more in the self-custody loop, where policy-driven wallets delegate execution and outline constraints requiring human approval for sensitive activities.

The programmable wallet puts heavy emphasis on SDKs, APIs, x402 and MCP, all being assembled into the same infrastructure stack, creating a digital superstructure. This philosophy goes beyond crypto wallets, the blockchain becomes the settlement layer when payments are necessary, but they build the authority into the wallets to approve the on-chain activity unseen by human eyes. Alternatively, emphasizing protocol allowlists, transaction simulation, revocable permissions, and most crucially human approval bends the policy-driven wallet more towards a consumer UX.

In the hardware wallet world, you are the authority. It asks if you are willing to sign this transaction. If software does become the economic actor, is self-custody still about controlling private keys, or is it more about controlling delegated authority? I've postulated previously that there is a signature that happens before a transaction even begins to be drawn up. If I delegate my willingness to buy, my trust in the counterparty, the timing of the decision and some measure of signing authority to my agent, where does my consent actually occur?

Recently it was reported that Ledger users in Australia had been targeted by a sophisticated attack that involved mailing notices about hardening their wallets for the pending “Quantum Crisis” in cryptography. What many of these users didn't know was not only were these letters not sent by Ledger, but the concept that any wallet could address the quantum problem with any sort of simple firmware update was way oversimplified. This attack allegedly netted the scammers at least 1.4 million AUD according to the authorities in Queensland. At first glance, this looks like another phishing story. I don't think it is.

Normally we would think of signing flow as:

the computer > the transaction > the wallet > the cryptographic signature > the blockchain

What we are seeing from advanced social engineering attacks changes the equation to look more like this:

story > belief > decision > cryptographic signature > blockchain

This new attack surface is decidedly non-technical and requires a very different approach to handling the threat. So far, the industry's response has largely been focused on education. Wallet manufacturers publish phishing warnings, exchanges remind customers never to share their recovery phrases, and security researchers dissect yesterday's scams in the hope users will recognize tomorrow's. Those efforts matter, but they all rely on the same assumption: that the user will remember the lesson at exactly the moment it matters. I think the challenge is slightly different.

Before a cryptographic signature is ever produced, something else has already happened. The user has accepted a story. They believe they're speaking with Ledger. They believe they're installing a security update. They believe they're recovering forgotten bitcoin. By the time the wallet asks for approval, the decision has often already been made. I'd call that moment the psychological signature.

Clear signing suddenly becomes much more interesting when viewed through that lens. It isn't simply a way of displaying transaction details on a trusted screen. It is an opportunity to interrupt the psychological signature before it becomes a cryptographic one.

The question changes from:

“Does this transaction look correct?”

to:

“Does this transaction actually match the reason I think I'm here?”

That question isn't unique to crypto. It's how humans have always understood exchange. We have never understood payments through numbers alone. We understand them through context: where we are, who we are dealing with, what we expect to receive, and the familiar rituals surrounding the exchange. At a grocery store, the building, the cashier, the displayed total, and the food in front of us all reinforce the same story. Crypto transactions often strip those cultural signals away, leaving an address, an approval request, and a story supplied somewhere else. Clear signing matters because it can return some of that missing context to the moment of authorization — and expose when the transaction on the screen does not match the exchange the user believes they are making.

Viewing the problem through the lens of the psychological signature also changes what we should expect from hardware wallets. Their job is no longer just to protect private keys or display transaction details, but to challenge the story that led the user there. Good clear signing should create a moment of healthy skepticism, asking not only whether the transaction is technically correct, but whether it matches the user's actual intent. The larger problem is that crypto has reproduced the ability to exchange value without reproducing many of the cultural signals people have relied on for centuries to understand an exchange. As those signals disappear, attackers are learning to supply their own. Clear signing, then, is not simply a UX feature. It is part of the larger work of rebuilding context, meaning, and informed consent at the moment a digital decision becomes irreversible.

For a security company, the amount of customer data floating around the internet should be terrifying. In crypto, even ordinary retail metadata can become attack infrastructure. A tracking pixel, checkout record, support ticket, or shipping address may not contain a private key, but it can help connect a real person to assets that cannot be reversed, recovered, or insured away.

The first layer of defense in this story is to not capture unnecessary data in the first place. Data breaches are common, becoming more so, and inevitably going to be even more of a problem as more powerful AI tools reach more hands. So what happens when a company has to purge its customer list, minimize email scraping, turn off user tracking on apps? Do sales automatically plunge?

I think a more important question we face now is how can we justify not doing those things and proclaim to be a security business. We've seen time and again the largest hardware wallet manufacturer Ledger have its customer rolls leaked over the past several years. Is Ledger special? No. Other companies have had the same issue across crypto and many other industries and public entities alike.

"Ledger's device security was not the issue; the privacy failure was in the commerce layer, where order data tied real people to confirmed hardware-wallet ownership."

At least with the Ledger leaks, users are aware there are security threats that they are taking steps with self-custody to avoid. When custodial platforms' data is breached, an entire new box is open. One can debate the response to the Coinbase customer data breach, May 2025, but the reality was customers had one less tool available to them: a hardware device. I don't typically delve into custodial or software based problems and solutions for crypto — this is The Device Layer — but needless to say, regardless of how well high-value customers were handled behind the scenes, regular users still had to live with the exposure or the uncertainty around it.

"Coinbase expected a $180 million to $400 million hit after hackers bribed support staff outside the U.S. and stole account data from a small subset of customers."

A company focused on security needs to consider its privacy policies. Don't just encrypt your database, minimize it. Collect only what information is necessary, retain only what is crucial. This philosophy can be taken to the development level too. Find alternatives to tracking user behavior in-app. They may be harder to research, but frankly it can be pretty clear when developers don't use their own app. It doesn't take wizardry, it takes work.

In crypto, customer data isn't just residual and harmless. It is a map. It can show who bought a device, where they are and how they can be contacted. A company cannot be expected to operate with zero data — devices have to ship. Support teams need to answer real questions. But privacy first means every piece of data has to justify its own existence and an exit plan for that data needs to be in order. Breaches aren't just embarrassing, they are counter to the whole movement.

The wallet can be secure while the customer is exposed. A privacy-first company understands that difference before the breach, not after it.

Despite the cyclical and almost passé reminders of the dangers of mismanagement in crypto — from the dissolution of Mt. Gox, to the freezing of assets at critical moments on retail trading platforms — there seems to be ever more hunger for "safer" access to the crypto profit dream. A recent article on CoinMarketCap illustrated the voraciousness for Bitcoin ETFs could be weakening self-custody habits.

"Trezor warns that growing adoption of spot Bitcoin ETFs could weaken self-custody practices and undermine one of Bitcoin's core principles."

The better read may be that paper exposure is not weakening self-custody habits so much as revealing who was never practicing them in the first place. The SEC recently issued a warning about how unprepared hodlers can lose access to their crypto when attempting self-custody during periods of transfer of estate, forgetfulness, or simple and understandable lack of understanding of their self-custody vehicles.

"Investors choosing self-custody control their own private keys and bear full responsibility for security, backup procedures, and technical setup."

Don't try to scare them away; educate them. A recent Tangem-commissioned Protocol Theory report makes that gap obvious: self-custody is widely valued but still poorly understood, with users continuing to default to centralized platforms even when they say control matters. All of the large hardware wallet manufacturers have faced that education gap in their own ways. Some, like Ledger, have built safeguards that push self-custody closer to a managed service; others lean into single-chain maximalism and simplify around a narrower threat model. What they all share is a growing attack surface, shaped by bad actors, increasingly menacing AI, and users being asked to understand more every cycle.

If I'm trying to decide if I want to bet on my capabilities to fight off attackers or an institution's resources to do so, I'd be hard pressed to hedge so much confidence in myself. If it were just that, the story would be simpler. The reality is, and this is true for all actual self-custody solutions, it comes down to how much you're willing to learn — protocols, safe signing, trends in attacks. At the end of the day those things all afford you the control. Institutional custodians will always face cyber and legal threats, not to mention bad actors on the inside, but they will never provide you real control over your assets, only the illusion or in the best of cases the service of custodianship.

Everyone markets self-custody as an aesthetic and jumps at the chance to plaster copy across socials with a hot buzzword. Now Congress is trying to turn self-custody into an actual legal boundary, and it is worth asking who benefits when that boundary gets written into law.

That translation matters.

Once Congress defines the boundary, "self-custody" stops being just a personal habit. It becomes a legal category.

The CLARITY Act passed the House and has advanced out of the Senate Banking Committee. With a tight window before elections, it may still reach the floor for a vote and it's worth looking at what the regulators are considering.

The self-custody language largely protects lawful self-custody, but explicitly preserves enforcement for AML, sanctions, illicit finance, terrorism financing, and related laws.

Where the battle really lies is the next layer: altcoins, exchanges, DeFi, stablecoins, token issuance, market intermediaries, and the SEC/CFTC boundary.

Proponents of the bill include major crypto companies and industry groups backed by a pro-crypto PAC network that has amassed nearly $200 million. They are interested in regulation that doesn't just define their products, but protects them. It is not all about influencing one bill, but the way the industry will be regulated as a whole.

The CLARITY Act would move the industry closer to that goal.

Detractors rightfully point out that the CFTC has less consumer protection and regulatory power than the SEC, and handing over a large portion of the oversight of these products would likely weaken any protections there are now. Anyone really paying attention, though, knows the SEC's current approach has not exactly produced a clean or reliable consumer-protection regime either. The real win for the big money exchanges and DeFi is a legal framework that is defined enough for them to invest in real infrastructure and strong enough to know that it won't change with the slightest breeze.

Look at the history of legislation around crypto for a little while and you see the same pattern.

• The industry has ideas and money, and they want regulators to weigh in.
• Bad actors take advantage of loopholes and entire sectors get captured by wholly unethical orgs or personality cults just waiting for the hammer to drop.

Here's where the gap is finally closed. Self-custody would be defined the way the community already uses it, and enshrined in law as a starting point. Scams and funnels will keep getting built on top of that, but the real success — the thing good-faith actors can actually invest and build around — is the legal definition itself.

It's useful. If it passes, maybe we really can put on some noggles and summer-vibe about self-custody for a minute. It would be a win. But the work to protect that hard-fought right comes next, because a massive pile of bad actors will come straight for it with backdoors disguised as software-as-a-service, social engineering, phishing schemes, and whatever else they can dress up as convenience.

For years, crypto security revolved around one question: can someone steal your keys?

A recent study of 39 browser wallets — WalletProbe: A Testing Framework for Browser-based Cryptocurrency Wallet Extensions — suggests that's no longer the whole story. Researchers found that many risks now emerge from the layer between users and blockchains: wallet interfaces, transaction simulations, approval screens, and warnings. In many cases, the cryptography worked exactly as intended. The user's understanding did not.

That's an important shift. Security is no longer just about protecting secrets. It's about understanding what you're being asked to approve.

This is why hardware wallets remain relevant. A dedicated signing device creates an independent verification layer, separate from the browser or website, giving users one final opportunity to verify what's happening before they authorize it.

A fake Uniswap ad on Google Search just drained over $400,000 from crypto users.

Trust is shifting from brands to verification

The study highlights a growing problem: users increasingly trust interfaces, simulations, and warnings they cannot independently verify.

In response, more of the industry is moving toward transparency, reproducibility, and verification. The goal is no longer to trust the company behind the wallet. It's to verify the system yourself.

"22,000 complaints related to AI last year, with the victims' losses totaling around $893 million."

The future wallet is an ecosystem, not a device

Modern crypto users don't live inside a single wallet. They move between browsers, dApps, multisigs, mobile apps, and signing devices.

The study reflects this reality: security increasingly depends on how these systems interact. The future wallet isn't a product. It's the trust layer connecting an ecosystem.

The takeaway

The study didn't uncover a crisis in cryptography. It uncovered a crisis in interpretation.

Across 39 browser wallets, researchers found that users increasingly depend on interfaces, simulations, warnings, and transaction displays to understand what they're approving. Meanwhile, the FBI reports nearly $900 million in losses tied to AI-enabled fraud, and a single fake Uniswap advertisement recently drained more than $400,000 from users.

The pattern is the same: attackers are no longer trying to break encryption. They're trying to influence decisions.

That's why hardware wallets remain important. The best modern devices don't just protect private keys — they create an independent verification layer between the user and the software asking for approval.

The strongest security systems don't just protect secrets. They help users understand what they're signing.

Every deck this year opens with the same slide: the hardware-wallet market is worth $431M, and 39.4% of it is North America. It gets quoted in pitch meetings, press releases, and roughly half the crypto-Twitter threads I get tagged in.

It's also the least interesting number on the chart. Here's the one that actually matters — and what it means the next time you're standing in a checkout flow deciding whether self-custody is worth the friction.

The number everyone quotes

North America leads. Fine. But a dominant share of a small market is a snapshot, not a trajectory. The map below is the one every analyst posts — and the one almost everyone reads backwards.

Look at the green, not the navy. The fastest-growing region isn't the one with the biggest slice today — it's the one bending the curve. Share tells you where the money has been. Growth tells you where it's going.

Why the map is misleading

Three things get lost the moment a regional pie chart hits a slide:

• Share is a rear-view mirror. A 39.4% slice reflects who bought devices over the last cycle, not who's buying them now.
• Dollar markets hide unit demand. Lower price points in growth regions mean more devices shipped per dollar booked — more humans actually choosing self-custody.
• Regulation moves faster than revenue. A single custody-rule change can reroute demand a full year before it shows up in market-size figures.

You don't need a market-research subscription to act on this. You need three moves, in order:

1. Stop optimizing for the dashboard. The "biggest market" isn't where the smartest custody habits are forming. Follow the practice, not the pie chart.
2. Treat your seed phrase like a property deed. If a single sheet of paper can move your net worth, store it like the legal document it functionally is.
3. Audit your signing flow before the next bull run, not during it. Phishing volume tracks price. The calm part of the cycle is the cheap time to fix it.

Market share tells you where the money has been. Growth tells you where it's going. Self-custody is a bet on the second number.

We're a hardware-wallet company writing about the whole category, so take this with the appropriate salt — but the regional shift is changing what we build, too. Lower-friction recovery and multi-language setup are now the roadmap, not the backlog. If the next million holders aren't in North America, the device can't assume they are.

More on exactly what that looks like in a couple of weeks. For now, the takeaway is smaller and more useful than a market forecast.

The takeaway

The $431M figure isn't wrong. It's just answering a question you probably weren't asking. Read the map for momentum, hold your own keys, and fix your signing flow while it's boring.