category.hardware_wallet.label

Safety comes from a certified secure element (its Common Criteria EAL level), how long the device has been on the market without a device-level exploit that lost user funds, and whether you can independently audit the firmware. We score exactly those — security certification & track record and verifiability. One honest distinction we hold to: no reputable device here has ever had a remote exploit drain funds; the incidents on record are data breaches, opt-in features, companion-app bugs patched with no known fund loss, or physical-access demos on discontinued models, which we surface but never treat as remote fund loss.

Ledger leads on secure-element certification (EAL6+) and has the most established mainstream ecosystem, but we weight verifiability & self-custody at 40%, and Ledger's device OS is closed-source — you cannot independently audit its most security-critical code — with no air-gapped signing. Fully open-source devices like Trezor and BitBox02 score higher on that axis. Our ranking is affiliate-blind: a partnership never moves a provider up.

Both matter and they pull in different directions, which is why we score both and let you weight them. A certified secure element resists physical attack; open-source firmware lets anyone verify what the device does. Note that every certified secure-element die is closed by necessity (a condition of the certification), so the open-vs-closed distinction is really about the device firmware and companion app. Air-gapped signing (no live data link) also counts toward the self-custody side of the verifiability score; which rail you otherwise use — USB, Bluetooth or NFC — is the preference we show as a fact.