“Don’t trust, verify” is bitcoin’s founding ethic — but most wallet buyers have no practical way to verify anything. Our Verifiability Score (0–10) measures how much of a wallet’s security you can check for yourself versus how much you must take on faith. It now appears as a column in our comparison table.
The five pillars
| Pillar | Max points | What earns them |
|---|---|---|
| Open-source firmware | 3 | Fully open license = 3 · source-visible but restrictively licensed = 2 · partially open = 1 · closed = 0 |
| Reproducible builds | 2 | Anyone can rebuild the published firmware from source and match the binary = 2 · partial / with effort = 1 · not reproducible = 0 |
| Secure-element transparency | 1 | The security chip’s role and limits are documented rather than a black box |
| Independent audits | 2 | Multiple public third-party security audits = 2 · at least one = 1 · none published = 0 |
| Track record & disclosure | 2 | Years in the field, and — more importantly — how honestly the maker handles incidents when they happen |
Current scores (August 2026)
| Device | Open source | Repro builds | SE transparency | Audits | Track record | Score /10 |
|---|---|---|---|---|---|---|
| Trezor Safe 3 / Safe 5 | 3 | 2 | 0.5 | 1.5 | 1.5 | 8.5 |
| Trezor Safe 7 | 3 | 2 | 0.5 | 1.5 | 1 | 8 |
| Ledger (all devices) | 1 | 0 | 0.5 | 1.5 | 1 | 4 |
| Coldcard Mk4 / Q | 2 | 1 | 1 | 1 | 1 | 6 |
| Blockstream Jade Plus | 3 | 2 | 0.5 | 1 | 2 | 8.5 |
| Foundation Passport Prime | 3 | 1.5 | 1 | 1.5 | 1.5 | 8.5 |
| BitBox02 | 3 | 2 | 1 | 2 | 1 | 9 |
| Tangem | 1 | 0 | 1 | 2 | 1.5 | 5.5 |
| Cypherock X1 | 3 | 2 | 0.5 | 1 | 1 | 7.5 |
| Keystone 3 Pro | 3 | 1 | 1 | 1.5 | 1.5 | 8 |
| SafePal S1 line | 1 | 0 | 0.5 | 1 | 1.5 | 4 |
| OneKey Pro / Classic 1S | 3 | 2 | 0.5 | 1.5 | 1 | 8 |
| Ellipal Titan 2.0 / X Card | 1 | 0 | 0.5 | 1 | 1.5 | 4 |
| NGRAVE ZERO | 1 | 0 | 0.5 | 1.5 | 1 | 4 |
| GridPlus Lattice1 | 3 | 0 | 0.5 | 1 | 1.5 | 6 |
| SeedSigner (DIY) | 3 | 1 | 1 | 0.5 | 1.5 | 7 |
| SecuX V20 / W20 | 0 | 0 | 0.5 | 1 | 1.5 | 3 |
| D’CENT Biometric | 0 | 0 | 0.5 | 1 | 1.5 | 3 |
Reading the scores honestly
A low score is not an accusation. Ledger’s 4/10 reflects closed firmware and no reproducible builds — facts — while its Donjon team is simultaneously one of the best security research groups in the industry. You are trusting Ledger’s competence rather than verifying it; the score measures exactly that distinction.
Scores move. Coldcard’s 6 reflects a deduction after the July 2026 RNG incident (see our security tracker) — weighed against Coinkite’s same-day patch and disclosure, which is the kind of response the final pillar rewards. When facts change, scores change; every revision is dated.
Credit where due: this approach is inspired by the excellent work of WalletScrutiny, which tests reproducibility across thousands of wallets. Our score is our own editorial synthesis — for their raw build-verification data, go to the source.
Questions or corrections? We answer them. See also: how we review.