Onchain investigator ZachXBT has intensified his criticism of hardware wallets, describing them as 'complete garbage' and advocating for a dedicated iPhone approach to crypto self-custody. His position has gained support from Tornado Cash developer Roman Storm, who agrees with the concept but warns of critical implementation gaps. As reported by crypto.news, Storm stated he would 'agree – if there were actually a mobile app with BIP39 passphrase support' - a feature that would add an extra layer of security by hiding real wallets behind empty ones. The debate highlights growing concerns about hardware wallet security vulnerabilities and the need for better mobile wallet solutions.
The primary concern centers on BIP39 passphrase support, a feature that would prevent attackers from accessing real wallets even if they obtain seed phrases. According to Roman Storm, a thief who finds the paper sees an empty account - a passphrase would have made the recent UK case where $172 million was lost after a Trezor recovery phrase appeared on home CCTV completely worthless. The threat landscape has intensified significantly, with Chainalysis logging 158,000 personal wallet compromises in 2025, nearly triple 2022's count, resulting in $713 million in losses affecting 80,000 victims. One seed phrase vulnerability alone drained $3.1 million this month alone, demonstrating the urgent need for better security measures.
Major hardware wallet manufacturers have defended their position against the iPhone alternative. Trezor chief commercial officer Danny Sanders rejected the swap, arguing that phones are general-purpose devices with too many doors and citing documented zero-click exploits. He emphasized that hardware wallets act as independent second screens, preventing checks from being compromised if phones are compromised. Ledger has since renamed Ledger Live to Ledger Wallet, with version 4.8.0 released on June 11 featuring security improvements and interface changes. The debate highlights the ongoing tension between dedicated hardware devices and mobile solutions in the crypto self-custody market.
Current mobile wallets face significant limitations in security features. According to Roman Storm, MetaMask has ignored requests since 2021 for BIP39 passphrase support, while Trust Wallet skips it entirely. Only Rabby offers it on desktop, leaving AirGap Vault as the lone mobile option. The solution requires mobile wallets to support passphrases and air-gapped signing so phones never connect to the internet. However, Casa co-founder Jameson Lopp warns that people often lose passphrases and lock themselves out forever. The debate comes amid growing regulatory concerns, with Hong Kong already forcing travelers to unlock phones and wallets at borders, adding another layer of complexity to mobile self-custody solutions.
