Wallets reviewed

Decide who holds the keys before you compare crypto wallets. On a custodial platform, such as an exchange account, the company holds your coins. With a self-custody wallet you hold the private keys, and nobody else can move the funds. The SEC's investor education office puts the trade-off plainly: if a custodian "is hacked, shuts down, or goes bankrupt, you may lose access", while self-custody leaves you solely responsible for the keys (SEC bulletin).

Custodial failures are not hypothetical. Celsius halted all withdrawals on 12 June 2022 and filed for bankruptcy the following month; a judge later ruled that coins in its Earn accounts belonged to the bankruptcy estate, which left those customers as unsecured creditors. FTX filed for bankruptcy on 11 November 2022, and the CFTC alleged that the conduct behind it cost customers more than $8 billion in deposits.

Self-custody removes that risk and swaps in another one. Lose the recovery phrase and nobody can restore the wallet. Coinbase says it "can't move crypto or help you" if you lose the recovery phrase for its self-custody app, Coinbase Wallet.

A hot wallet is an app or browser extension on an internet-connected device. A cold wallet, usually a hardware device, keeps the keys offline. The SEC bulletin calls cold storage generally safer from cyberattacks, but a device can be lost, damaged or stolen, so the backup matters more than the gadget.

• Software wallets such as MetaMask, Phantom, Rabby, Trust Wallet and Exodus suit everyday amounts and connecting to apps.
• Hardware wallets such as Ledger and Trezor suit savings you rarely touch. Trezor publishes its firmware as open source; Ledger keeps the firmware on its secure element closed under NDA, while Trezor's Safe models use a secure element too.
• Most wallets back up to a recovery phrase built on the BIP-39 standard, usually 12 or 24 words. Anyone who sees those words can empty the wallet, so keep them offline and never type them into a website.

Most losses come from tricking the owner rather than breaking the cryptography. Chainalysis counted 158,000 personal wallet compromises in 2025, affecting at least 80,000 people, with $713 million stolen. Victims reported $11.4 billion in crypto-related losses to the FBI's Internet Crime Complaint Center in 2025, $7.2 billion of it from investment fraud.

• Malicious signatures. A fake site asks you to sign an approval that hands over your tokens. The security firm Scam Sniffer tracked about $84 million lost to these "drainers" on Ethereum-style chains in 2025, down from $494 million in 2024, and calls that a lower bound.
• Address poisoning. A scammer sends a tiny transfer from a lookalike address so that you copy it from your history next time. Check the whole address, not the first and last few characters.
• Fake apps and poisoned updates. A counterfeit Ledger Live app on the Microsoft Store took about $768,000 in 2023 before it was removed. On 14 December 2023 a malicious version of Ledger's Connect Kit code library ran for a few hours on third-party apps and cost users about $600,000, according to Ledger.
• Tampered devices and weak seeds. In July 2026 attackers drained Coldcard wallets whose seeds had been generated with weak randomness because of a 2021 firmware bug. Coinkite says the devices were not hacked. Estimates of the theft grew from about $38 million in the first sweep to more than $110 million. In October 2026 Ledger confirmed a hidden hardware implant in at least one device sold by an Asian reseller, CryptoBilis. Buy hardware only from the maker or an authorised reseller, and treat a discounted or opened box as unsafe.
• Leaked customer data. Ledger's 2020 breach exposed about 272,000 customers' names, addresses and phone numbers, and Trezor disclosed two breaches at its shipping partner in 2026: about 13,700 customers in August and about 67,000 more US customers in September. Leaks like these feed targeted phishing.

Our wallet scoring methodology sets five weighted pillars:

• Security (40%): custody model and key isolation, open-source code or audits, the connection attack surface, and how past incidents were resolved.
• Chain and asset support (20%): chains, tokens and app connections.
• Ease of use (20%): setup, consistency across mobile, desktop and extension, and a clear recovery flow.
• Cost (10%): device price, in-wallet swap fees and paid tiers.
• Trust and transparency (10%): incident disclosure, audit cadence, whether recovery or custody services are opt-in, and privacy.

Only wallets with a published review appear in our country rankings.

We have published reviews of seven wallets: Ledger, Trezor, MetaMask, Trust Wallet, Phantom, Rabby and Exodus.

• Country guides: United States, United Kingdom, Canada and Australia.
• What is a crypto wallet?: the basics of keys, addresses and backups.
• How to use MetaMask: a first-time setup walkthrough.