The private key is mathematics, the wallet is business.

Written by: Fortune

Three pieces of news, plus one hidden, all saying the same thing

On July 16, blockchain detective ZachXBT blasted on Telegram, saying that all hardware wallets are garbage and not recommended for signing or storing large amounts of assets. He specifically criticized Ledger Live for frequent updates and instability, suggesting using a dedicated iPhone instead of a hardware wallet. The news caused a stir online, with "hardware wallets are dead" trending. A Trezor executive later gave a somewhat soft response, admitting that hardware wallets and usability have not found a balance, but argued that ZachXBT applied the most complicated institutional scenario to all ordinary users. This statement makes sense, but after hearing it, ordinary users still remembered the first half.

Ten days later, a lawsuit from a federal court in California made this debate even more ironic. Three users collectively lost 1.8 million dollars in Bitcoin due to a counterfeit Sparrow Wallet found in the App Store. The official Sparrow never made an iOS client, yet the knockoff app lingered in the store for a long time, despite multiple reports from the developers, and Apple was slow to act, even once marking the developers' own account as a rule violation for removal. Users didn’t trust the wallet itself; they trusted the Apple brand, and when the brand lost a bit of credibility, the safety of the wallet became a secondary issue.

In the same week, Phantom announced it would stop supporting the Monad network on August 26, meaning users wouldn’t be able to check balances or send transactions in the app then. While assets still safely sat on the chain, the access was cut off. Even more interesting, a day before Phantom announced it would shut down Monad, it just announced the integration of Robinhood Chain. A new public chain launched while an old chain was taken offline, both listed in the same week's product schedule, likely supported by real data showing weak trading volumes for Monad, but in this event, users had no voting rights from start to finish, and that is the real problem. This type of wallet's underlying design does not grant users the authority to customize RPC networks; the survival of a chain depends on the product manager's resource scheduling, not on whether users want to use it.

Yet another issue, without making headline news, has been quietly fermenting in developer forums for months. In February 2026, the official skill marketplace of the OpenClaw ecosystem (ClawHub) suffered a supply chain attack, with thousands of malicious skill packages infiltrating the official market, specifically targeting hundreds of wallet formats and browser credentials. The victims were not ordinary retail investors, but exactly those early users drawn in by the "AI automated trading" selling point. This incident did not have a detonator like ZachXBT's claim, but the bubble it burst was far larger than the dispute over hardware wallets.

These news stories belong to four dimensions: the debate over security philosophy, the collapse of distribution channels, the centralization of access rights, and the crisis of trust in AI automation. When viewed together, they are essentially saying the same thing: wallets have never truly handed back control to users as they claim. Every generation of wallets promises better security and more freedom but buries new single points of failure within its processes. The failure point of hardware wallets is human, the failure point of software wallets is the distribution channel, and the failure point of Agent wallets is that AI brain which can be manipulated without clarity about where commands originate.

The entry point to Web3 begins with a browser plugin

The earliest official Ethereum client, Mist, required syncing tens of gigabytes of full node data, which ordinary people could neither install nor use; it was merely a geek's toy, with a rough interface and command-centric operation, and it quietly ceased maintenance in 2019. MyEtherWallet solved the issues of transferring and receiving coins, but it lacked the ability to communicate with DApps; users had to manually copy private keys and piece together transaction data, and one wrong step could result in losing the private key. Both of these wallets predated MetaMask but hardly qualify as usable entry points to Web3; they essentially functioned as key storage boxes with interfaces.

In 2016, MetaMask launched, turning the wallet into a browser plugin that injected window.ethereum into web pages, allowing DApps for the first time to make signature requests directly to wallets. Users no longer had to run nodes or transcribe private keys; they simply opened a webpage, connected their wallet, and hit confirm. The "Connect Wallet" paradigm thus became the industry standard. EtherDelta, Compound, and MakerDAO, as well as the subsequent DeFi and GameFi booms, all sprouted from this foundational infrastructure. It can be said that before MetaMask, there were only addresses and private keys, and it was after MetaMask that users truly experienced Web3. However, lowering the barrier to entry came at the price of leaving the entire mess of security issues to users: malicious authorizations, fake plugins, and mnemonic phrases in cloud notes—any of these could wipe out assets overnight.

The primary mission of a wallet is to securely store private keys + provide controlled and safe signing capabilities externally

Having taken this long detour, I want to clarify what wallets are actually for. In the world of blockchain, the only legal proof of any action is a signature; transferring funds involves signing a transaction, authorizing is signing a command, logging into a website is signing a message; multi-signature and permission delegation are fundamentally layers of signature verification. The primary mission of a wallet is to securely store private keys and then provide controlled and safe signing capabilities externally. Transferring funds, managing assets, and connecting to DApps are merely exterior scenarios that wrap around the signing process. Without signatures, a wallet is just a page displaying an address; it is no different than a ledger book. This sentence serves as the common denominator for every subsequent section—hardware, non-custodial, custodial, Agent—arguing back and forth about how this matter should be executed correctly.

The chain of trust does not start to break with hardware; it begins from the moment random numbers are generated

Theoretically, a private key is a 256-bit true random number, and brute-forcing it is akin to dreaming. Yet in December 2020, a batch of Bitcoin was transferred from a mining pool address, amounting to approximately 3.5 billion dollars at the time. The method of attack was not breaching any device, but rather that the wallet software used a weak random number generator to create keys, with effective entropy reduced to around 32 bits; modern computers could exhaustively compute this in one to two hours, making thousands of addresses like being opened with a master key. This incident only entered the public eye when the U.S. Department of Justice announced forfeiture in 2025; these assets originally belonged to the LuBian mining pool controlled by Chen Zhi. The defect carried from the conception of the private key cannot be covered up by hardware isolation; what you thought was impregnable might have been flawed from the day it was born.

This case illustrates a very simple truth: the chain of trust does not start with hardware but begins from the moment the random number is generated. For every subsequent layer, whether the firmware is open source, if the supply chain has been tampered with, how strict the App Store review process is, and whether customer service can be deceived by scripted dialogue are all links in this chain; any weak link makes all previous physical isolations meaningless.

The logic of hardware wallets is very straightforward: private keys are generated and signed in offline chips, never networked, so they are physically isolated from remote attacks. This sounds unassailable, but if we look at all the theft cases from the past six months, the January loss of 282 million dollars originated from customer service deceiving users out of their mnemonic phrases; in April, a fake Ledger Live client in the App Store embezzled 9.5 million dollars; in July, the Sparrow lawsuit resulted in a loss of 1.8 million dollars. In all three cases, not a single one involved the hardware chip itself being compromised; all fell due to supporting software, phishing apps, and user gullibility.

ZachXBT's remark that "hardware wallets are garbage" certainly carries a provocateur's intent, but it strikes a real pain point: hardware wallets only protect the private key; they cannot protect the person holding the private key. What's also interesting is that there has been a self-deprecating recognition within the hardware wallet industry—"hardware wallets, anything over $20 is false demand." Indeed, the material cost of a secure chip doesn’t exceed 20 dollars, but turning it into a trustworthy product piles on costs at each certification, audit, and supply chain protection layer. Hence, being expensive doesn't necessarily mean it's all false demand. However, when you realize that you can acquire an old Android phone with a camera for 20 dollars, install an open-source wallet, run it in airplane mode, and complete offline signing through scanning codes before broadcasting it online, you have a simple cold wallet solution that is even cheaper than the dedicated iPhone recommended by ZachXBT and doesn’t rely on the App Store's review. After all, this time the one that fell was Apple’s own store. At this point, the phrase "20 dollars" takes on another layer of meaning: rather than trusting a box that costs several hundred dollars, it's better to think about how to make signing simpler. Hardware wallets have not died; the fairy tale of "just plug it in and it's safe" is what has perished. At most, it can be considered the smallest unit of asset security; users still have to build their own walls outside.

Non-custodial wallets: the main force of Web3, also the largest conflict of interest

With private keys held by users themselves and platforms unable to access assets, only providing the interface, nodes, and aggregation services; this type of wallet is currently the main battlefield for capital migration. Regulators generally do not touch the wallet itself, only controlling fiat access and DEX aggregation services; this is also the systematic reason why the share of non-custodial wallets continues to rise. On-chain data clearly shows that over 70% of assets stolen stem from phishing and malicious authorization types of user behavior, while pure code vulnerabilities account for a very low percentage; in the end, the responsibility lies with the users themselves.

In the open-source camp, established software like Electrum and MyEtherWallet has all its code posted on GitHub, allowing anyone to audit it, and if issues arise, they can be traced back. In the closed-source camp, MetaMask and Phantom trap users with experience and ecological barriers, but if you open the settings page, you will find whether you can add a custom RPC is the watershed for judging how open a wallet truly is. When Phantom discontinued Monad, many users realized for the first time that they had no choice at all.

As for how wallets make money, it is not mysterious at all. Integrated Swap is a significant source of revenue; MetaMask's service fee has long remained at 0.875%, while Phantom is around 0.85%. Trust Wallet takes a different route, with front-end zero fees, surviving on commissions from aggregators’ orders. DApp listings and homepage placements come next, with monthly fees and transaction percentages, and prime placements are constantly auctioned. Cross-chain bridge integrations can also grab a share, with protocol parties offering targeted commissions, but wallets do not markup the front-end, leaving users completely unaware.

At this point, an awkward question arises: can a homepage recommendation that has accepted payment from developers still fairly inform users of the risks associated with that DApp? They can inform, but may not always be willing to do so. The wallet's business model conflicts with user security interests; in this scenario, recommending a high-risk DApp with high commissions leads to certain short-term profits, while when issues arise, the liability chain is extremely long, and it likely falls back on the users for not clearly understanding the authorization. Non-custodial wallets are not charities; they are businesses that need to turn a profit. This is inherently not an issue, but the problem lies in the fact that they simultaneously claim to be decentralized infrastructure, which creates a natural conflict of interest with paid rankings. The industry still has not established a basic disclosure mechanism regarding this conflict.

Custodial wallets: easy bills hiding in places you cannot see

Custodial wallets hold private keys on behalf of exchanges or licensed institutions, with users only obtaining an account password. This is the smoothest entry point for outsiders. The benefits are immediate: lost mnemonic phrases can be recovered, KYC can run the full compliance route, and financial management and leveraging can be integrated in one go, with nearly zero operational thresholds. The drawbacks are just as direct: if it's not your private key, it's not your coin; if the platform runs away, gets hacked, or is frozen by regulators, users have no means of resistance, their transaction behavior leaves traces, and privacy is virtually non-existent.

With the implementation of MiCA and the GENIUS Act, compliance costs skyrocketed; nearly 20% of small platforms in the EU have closed, and large withdrawals are collectively flowing to hardware cold wallets. Users have long since voted with their feet, treating custodial wallets as a springboard rather than an endpoint. The profitability structure of custodial wallets is more brutal than that of non-custodial wallets. The integrated Swap charges both explicit fees while profiting from internal fund pools through buying/selling price differences; cross-chain bookkeeping might involve internal ledgers offering zero protocol fees and zero gas; simply moving numbers around is a profitable business; integrated MiniApp ecosystems are the most strictly regulated and earn the most, with NFT trading commissions reaching 2% to 3%, and in-game recharge commissions ranging from 3% to 8%. This follows the logic of Apple's tax, where all funds are settled through the platform's funds pool, with T+7 to T+15 before being sent to developers, the billing period itself is a layer of hidden profit. Peace of mind has never been free, it’s just changing the method of billing.

Agent wallets: the hottest narrative of 2026, and the naked running scene of the permission system

Now we can talk about Agent wallets, which will be the hottest narrative in the crypto world in 2026, no exceptions. MetaMask, Coinbase, Binance, and TON are all promoting their own Agent wallet products, whether through sub-wallet isolation or third-party MPC sharding, they all tell the same story: users set rules, AI automatically completes exchanges, dollar-cost averaging, and arbitrage, allowing them to earn money while lying down.

The story sounds nice, but it’s prone to exposure upon implementation. Those truly in need of automated trading have never lacked tools. Quant teams and MEV players construct their own SDKs, using commercial MPC or HSM services like Turnkey or HashiCorp Vault for key management, while pulling a dedicated internal line to data centers, securing physical signature nodes and ensuring log integrity, this level of rigor far exceeds any consumer-grade Agent wallet. They don’t need wallet manufacturers to bestow an automation button; they have already built their infrastructure. In other words, Agent wallets are not aimed at knowledgeable users; their target demographic is precisely those who are less familiar with command lines or programming but want to ride the wave of AI automation.

A real incident has already occurred, with not a substantial amount, but the attack path is worth noting. In May of this year, someone transferred an NFT into a wallet automatically generated by Grok; this NFT was essentially a master key within the attached trading bot system Bankr, allowing its holder to bypass usual transaction limits. The attacker subsequently used Morse code to hide a set of instructions on X, and when Grok deciphered the instructions, it approved a transaction for three billion DRB tokens, worth approximately $150,000 to $180,000, all sent to the attacker. About 80% of the funds were recovered afterward, so the losses weren't catastrophic, but the crucial point to note is where the problem lay: it was not that the AI was deceived into making an illegal operation, but rather that the permission system left a backdoor open; anyone could grant themselves clearance just by sending an NFT, and the AI merely acted as the signer executing the instruction. The security sphere splits this type of attack into two parts: one half being prompt injection, the other being excessive authorization; these combined form the complete attack chain.

This is not an isolated incident. A report from a security research institution in July showed that attackers had started hiding commands en masse within web pages and technical documents, specifically targeting those AI agents that would independently search for information and execute tasks, yielding a hit rate so high that researchers have begun using phrases like "alarmingly well." Some attacks were simple enough to deceive AI into thinking it was merely paying a few dollars in service fees.

This raises a technical paradox. The original design philosophy of mainstream Agent wallets was not to rely on AI to follow rules but to hard-code limits and whitelists within smart contracts or policy engines, hoping that even if AI were manipulated, those hard limits would remain intact. The failure of Bankr this time stemmed specifically from the ability of an external NFT to reissue permissions, effectively opening a backdoor to the hard limits. When auditing an Agent wallet, the question should not be centered on whether the AI's judgment is reliable, but rather on who can reallocate permissions to this AI, and if this process has been secured.

The next layer of risk lies even further upstream: the poisoning of the skills and plugins ecosystem itself, which is entirely different from inducing AI during execution. In February’s supply chain attack on the AI Agent ecosystem, thousands of malicious skill packages infiltrated the official marketplace, specifically targeting hundreds of wallet formats and browser credentials; many victims were exactly those drawn in by the allure of automated trading. This is a supply chain issue, where the input skill packages themselves constitute malicious software, and it's entirely different from prompt injection; combined, these represent the full spectrum of risks that Agent wallets currently face.

The final layer, and the one that nobody wants to address, is the question of accountability when issues arise. The industry's current consensus minimum is that high-risk operations must receive manual secondary confirmation, and AI can only perform standardized repetitive actions within preset rules; this is why most serious Agent wallet product lines currently dare not fully enable their switches. However, projects like Bankr have already implemented automatic execution that doesn't require manual confirmation, putting the losses squarely on users, and there is currently no clear legal framework to determine liability. Hardware wallets are criticized as garbage, but at least their attack surface is confined to one person and one device. Agent wallets broaden the attack surface over the entire software supply chain and entire permission system, yet liability remains a blank space.

Single points of trust have never been reliable

Looking back at the news mentioned at the beginning: ZachXBT lambasted hardware wallets because manufacturers tout single-point security as holistic security, while ecosystems are riddled with holes; the fake wallets in the Apple store highlight that centralized distribution cannot accurately identify Web3 risks; Phantom discontinuing Monad reflects centralization in closed-source wallet permissions; Agent wallets encountering issues result from external NFTs being able to reissue permissions, amplifying the attack surface within the skills ecosystem. The common root cause is the concept of single points of trust—trusting chips, stores, or permissions that can be easily reissued; any error leads to game over.

Multi-signature solutions (like Gnosis Safe) can prevent single points of signature authority from going out of control, but they cannot manage weak random numbers, fake applications, permission backdoors, or the recommendation of malicious contracts; they do not solve the complete pollution of the trust chain.

The approach for surviving in 2026 can be summed up in three sentences: use open-source hardware cold storage for large assets, write mnemonic phrases on metal plates for physical isolation, and do not trust ecosystems and customer services blindly; wallets downloaded from stores may be counterfeit; do not search for originals if none exist, but verify official signatures; Agent wallets should only hold money that one can afford to lose, large amounts must undergo hardware double confirmation, and treat AI like an intern. Private keys are mathematics and never lie; every layer of hardware, software, distribution, and automation needs validation, not trust. This is the only conclusion worth taking away from this farce.