Anyone holding more in a DeFi wallet than they could shrug off losing needs a hardware wallet, though the device protects less than its marketing implies. Personal wallet compromises reached 158,000 incidents in 2025, nearly triple the 2022 figure, and made up roughly 23% of all stolen crypto, according to figures in Ledger's buyer's guide. That is the category a hardware wallet addresses: a private key lifted off a computer. It does little about the other routes to a drained wallet, which include signatures the owner gives willingly, approvals granted months ago, and protocols that fail on their own.

The decision therefore turns on how a wallet gets attacked more than on any single balance. A hot wallet keeps its key on a machine that also reads email, installs extensions and opens links. A hardware wallet keeps the key on a separate chip and asks for approval on its own screen. Once losing the hot balance to one bad download would hurt more than the cost and bother of the device, it is worth buying. For most people who have deposited real money into a lending market or a DEX pool, that point has already passed.

What the device takes off the computer

A browser wallet such as MetaMask stores its key on the same machine that runs everything else. That machine is exposed to commodity infostealers sold as a service, among them RedLine, Vidar, Lumma and Stealc, and to impostor software. More than 40 fake extensions impersonating MetaMask, Phantom, Trust Wallet, OKX and Coinbase were found on Firefox in July 2025, according to Ledger's security checklist.

A hardware wallet changes where the key lives. The seed is generated offline on the device and never touches a networked machine. Transactions are still assembled by the browser wallet, and Ledger itself recommends pairing MetaMask with a hardware signer for serious DeFi use. The finished transaction is then sent to the device, which displays it on a screen driven by its own chip rather than by the computer, and signs only when a button is pressed. Malware on the laptop can propose transactions. It cannot sign them, and it cannot change what the device's screen shows.

That screen is the second half of the protection, and it is only as good as what it can display. Where a dApp has published an ERC-7730 descriptor, the device can decode the call into plain terms: the action, the token, the amount and the recipient. Where it has not, the device falls back to raw data, and the owner is approving something they cannot read. The difference between clear signing and blind signing is the difference between a check and a formality. Trezor switched on ERC-7730 clear signing on September 8, 2026, with 1inch, Aave, Lido, Tether, LiFi and Hyperliquid as launch partners, Cryptopolitan reported. Coverage is still partial: the standard helps only where a descriptor exists.

Where the line falls in real losses

Recent incidents sort neatly by whether a hardware signer would have mattered.

Key theft, where it helps. Duelbits lost about $6.07 million across five chains on October 6, 2026, in a suspected private-key compromise of a hot wallet, according to rekt.news. This is the loss a hardware wallet is built to prevent. Radiant Capital lost over $50 million in October 2024 to trojan malware combined with blind signing, which shows the device's second weakness alongside its first strength.

Signatures, where it may not help. Bybit lost roughly $1.5 billion in ETH in February 2025 from a single cold wallet, a breach Ledger attributes partly to blind signing. Cold storage was in place and the money left anyway, because the signers approved what they were shown. On October 8, 2026, NEAR Intents lost $3.87 million to an attacker who funded a wallet with 10 USDT and drained a vault using "valid signed authorizations". No key needed stealing.

Protocol failures, where it is irrelevant. Compromised admin and developer keys overtook smart contract bugs as the leading attack vector in the first half of 2026, per CertiK data summarized by crypto.news. Drift lost $285 million and KelpDAO $290 million. A depositor's hardware wallet protects the depositor's key, not the protocol's.

Not a vault, not an approval manager

Threat Hardware wallet helps? Why
Infostealer malware on the computer Yes The key never sits on the computer
Fake or compromised browser extension Largely It cannot extract the key, but it can still request signatures
Phishing signature on a cloned dApp Only with clear signing The device screen shows the true call if a descriptor exists
Unlimited approval granted earlier No The approval already authorizes the spender
Hacked protocol or stolen admin keys No The funds are lost inside the contract, not the wallet

The fourth row catches the most people. A hardware wallet cannot stop a token approval it has already signed. Ledger compares an unlimited approval to a blank check with no expiry date, and pressing a button on a device does not cancel one.

The objection: devices fail too

The strongest case against the device is that it is not infallible. On July 30, 2026, a Coldcard firmware bug replaced the hardware random number generator with a predictable software one, and more than 1,596 BTC (about $130 million) was taken from roughly 7,300 addresses. Galaxy Research confirmed 1,082.65 BTC gone within 41 minutes. A buyer who chose the device precisely to avoid catastrophe got one.

The objection is fair and does not change the answer. The Coldcard failure was a single bug in a single vendor's firmware, found and exploited once. Infostealers, fake extensions and drainers attack every hot wallet, every day, as a business. The lesson is to keep firmware current and not to concentrate everything in one device. It is not a reason to keep keys on a laptop.

A rule of thumb, and the cheapest setup

The rule is simple. If the balance in a browser wallet exceeds what its owner would accept losing to one bad download, it belongs behind a hardware signer. Below that, the device is optional. Signing frequency changes which device to buy, not whether to buy one. Someone signing swaps and deposits several times a week faces phishing signatures far more often than malware, so they should choose a device that clear-signs the protocols they actually use.

The cheapest sensible arrangement keeps MetaMask as the interface and puts an entry-level device behind it as the signer. The Trezor Safe 3 qualifies, since it is among the models that received ERC-7730 clear signing in September 2026; the older Model One did not. Current retail prices are not in the sources this page relies on, so the maker's listed price should be checked directly. Ledger also recommends a small hot wallet for experiments, kept separate from the main holdings.

Two habits matter more than the purchase. Read the device screen before every approval, and reject anything it cannot decode. Audit and revoke stale approvals, which Ledger's software does through Revoke.cash. Larger sums may justify owners and a threshold rather than one device. A hardware wallet secures the key and nothing else, so whatever the owner signs with it still has to be read first.