Not your keys, not your coins. If you hold meaningful amounts of crypto on an exchange, a hardware wallet is the single most important security upgrade you can make.
By the CryptoNorth Team
A build error in Coldcard firmware from March 2021 made some device-generated seed phrases — the 12 or 24 words that are the master key to your wallet — weak enough to brute-force, without an attacker ever touching the device. Roughly 1,816 BTC (about $116M USD) was taken from over 5,200 addresses starting 30 July 2026. Coinkite's advisory lists Mk2, Mk3, Mk4, Mk5 and Q as affected; TAPSIGNER, OPENDIME and SATSCARD are not. Updating firmware is not enough - it fixes future seeds only, so you must generate a NEW seed and migrate your funds. A seed generated with 50+ private dice rolls is the RNG exception Coinkite describes; a BIP-39 passphrase does not repair a bad seed, and passphrase users should still migrate. This is specific to Coldcard's key-generation code and does not affect Ledger or Trezor devices.
One answer per situation. Every pick below is argued in full in its own review, and the reasoning is the same one we publish on our methodology page.
All Ledger and Trezor prices are the makers' own Canadian listings, read on 31 August 2026 — not currency conversions. Coinkite lists the Coldcard Mk5 at $189 without stating a currency, so we show its figure rather than convert it.
On the commercial side: Ledger and Trezor both pay us a commission, Coldcard does not, and Trezor happens to pay slightly more than Ledger. We are naming a Trezor as best overall anyway, so it is fair to say so plainly — the reasoning is the certification tier and the open-source firmware, both of which we rated that way before either agreement existed.
When you keep crypto on an exchange, the exchange controls your private keys. If the exchange is hacked, goes bankrupt, or freezes withdrawals, your funds are at risk.
You control your private keys and seed phrase, so no platform can freeze, lend out or lose the coins on your behalf. The risk moves rather than disappears: it is now on you, and if your seed phrase is lost the crypto is gone for good.
Always buy directly from the manufacturer - never from third-party resellers on Amazon or eBay.
Free, convenient and good for day-to-day use and DeFi - but connected to the internet, so not where significant holdings belong.
Free non-custodial wallet covering 100+ blockchains natively - the "10M+ assets" figure just counts token standards. Independent legal entity after a 2018 Binance acquisition. Only its core library is open source. Mobile app has a clean record; the browser extension has had three incidents since 2023, so keep balances there small.
The default wallet for DeFi, now multichain - Solana arrived May 2025, Bitcoin December 2025, Tron January 2026. Swaps carry a 0.875% fee inside the quoted rate. Source-available licence, not OSI open source. Pairs with Ledger and Trezor, which is strongly recommended for real balances.
The most polished interface here, with real desktop apps and commission-free staking. Its built-in exchange advertises 0.5% but costs small traders closer to 5% in spread. Partially closed source, so seed generation cannot be independently audited.
A different kind of tool, listed separately because comparing it to the wallets above is a category error. This is not a beginner option and it is not trying to be - it is what you move toward once you would rather verify Bitcoin yourself than take somebody's word for it. It has no company, no fees and nothing to sell you.
The original Bitcoin software and the only wallet here with no company behind it. Running a node lets you verify your own balance without trusting anyone - the full chain is ~756GB, though a pruned node validates identically on 20-100GB. v30 removed legacy wallets, so migrate yours when you upgrade. Current release is 31.1.
Your 12-24 word recovery phrase is the master key. Write it on paper (never digitally) and store in multiple secure physical locations. Consider a fireproof safe.
No legitimate company or support agent will ever ask for your seed phrase. If someone asks - it is a scam. This is the number one way Canadians lose crypto.
Only purchase from ledger.com or trezor.io directly. Pre-configured or secondhand hardware wallets can have compromised firmware designed to steal funds.
Before sending crypto, always verify the first and last 6 characters of the receiving address. Clipboard hijacking malware can silently replace copied addresses.
Unlike bank accounts, crypto assets are NOT covered by CDIC, the federal deposit insurance that protects bank accounts. There is no government backstop for losses from hacks or exchange failures.
Every transaction may be a taxable event. Track CAD values at the time of every transaction for accurate CRA reporting. Crypto tax software helps automate this.
Transferring crypto between wallets you own is generally not taxable - keep records of wallet addresses to prove ownership. Swapping tokens within a wallet (e.g. BTC to ETH via Exodus) is a taxable event under Canada Revenue Agency (CRA) rules. See our Tax Guide for details. Tools like Koinly can track your adjusted cost base automatically across wallets (affiliate link), and our tax guide lists the alternatives.