Wallets

Data as of 19 August 2026

A hardware wallet keeps your private keys on a small offline device instead of on an exchange or inside an app on your computer. Every transaction is signed inside the device and confirmed on its own screen, so malware on your computer cannot quietly change the destination, and the keys themselves never touch the internet. February 2025 made the case better than any brochure: Bybit, the second largest exchange in the world, lost 1.5 billion dollars from its own cold storage in a single afternoon. Its customers were made whole that time, but no European deposit guarantee scheme covers crypto held on an exchange. The only balance that is truly yours is the one whose keys you hold.

One thing a hardware wallet does not need is a licence. Under EU law a maker of self-custody wallets is not a crypto-asset service provider, so MiCA governs exchanges, not your device. What will reach you is the Transfer of Funds Regulation: a licensed exchange must verify that a personal wallet receiving more than 1,000 euros really belongs to you before you withdraw to it. That check is normal; expect it the first time you move a meaningful sum.

How to choose

Four questions separate the seven devices below better than any star rating.

How does it talk to your computer? USB devices (Trezor, Ledger) are the convenient mainstream. Air-gapped devices (SafePal, ELLIPAL, Keystone, NGRAVE) pass transactions back and forth as QR codes, so nothing is ever plugged in: a smaller attack surface, at the cost of a slower routine. Tangem is a chip card you tap on your phone.

Can anyone audit it? Trezor and Keystone publish their firmware as open source, and Trezor's new Safe 7 carries the first secure element whose full design is public. Ledger takes the opposite path: certified chips whose internals stay closed, so you trust the certification rather than an audit you can read. NGRAVE's operating system holds the highest certification of all (EAL7) but is proprietary. Both philosophies are defensible; know which one you are buying.

Where do you verify the address? A large touchscreen makes actually checking the destination address realistic instead of theoretical. Tangem has no screen at all: you verify on your phone, which means trusting the phone a little more.

What does it cost against what it protects? The range runs from about 50 euros (SafePal S1) to about 400 (NGRAVE ZERO). If the device costs less than a small percentage of what it will guard, the exact model matters less than owning one at all.

And one rule above all four: buy directly from the official store or an authorised reseller, never from a marketplace listing or second-hand. A March 2025 supply-chain finding against resold Trezor Safe 3 units is precisely the attack this rule prevents. Then write the recovery phrase on paper, keep it offline, and never type it into anything: every documented loss with these devices traces back to that phrase, not to the hardware.

Side by side

Prices are indicative official-store figures and drift with promotions; check the shop before deciding. Below, each device gets a written profile with the honest caveats included, and every one of the seven now has a full-length review of its own covering its chips, its breach history and what it costs to buy from Greece.