CoolWallet Review: The Card Format and Its Tradeoffs

This coolwallet review covers three cards from CoolBitX: the battery free Go, the Bluetooth enabled Pro, and the older S. The format is genuinely convenient. The tradeoff is that a card this thin leans hard on your phone for its interface, and your phone is the part an attacker reaches first.

On this page: the three cards CoolBitX actually sells and the battery inside one of them, the 2020 Bluetooth replay flaw and what fixed it, what Kraken Security Labs found in the S, why the card format changes nothing about your backup, and the three things the affiliate reviews leave out.

What is CoolWallet, and who actually makes it?

CoolWallet is the hardware wallet line from CoolBitX, a Taiwanese company. The premise is one idea carried through stubbornly: build the wallet to the dimensions of a bank card so it lives in the slot beside your travel card instead of a drawer you never open. The CoolWallet Pro product page gives the card as 85.6 by 53.98 by 0.8 millimetres, which is credit card footprint at slightly under a millimetre thick.

The private key is generated and held on the card. The phone app is the screen, the keyboard and the address book. That split is the single most important thing to understand about the product, and every section below is really a consequence of it. If the phrase private key on the device is doing no work for you yet, start with what non custodial actually means and come back.

Which CoolWallet models are actually on sale?

Three, as of 6 September 2026, according to CoolWallet’s own store. Most review sites still write as though there are two, which tells you roughly when they last opened the page.

The Go is the interesting arrival and the one almost nobody covers. It has no battery and no Bluetooth radio, and the Go product page puts the same CC EAL 6+ certified chip inside it as the Pro. Both cards are listed as supporting 35 or more blockchains and over 12,000 tokens, and both require Android 7.0 or later, or iOS 15.6 or later on an iPhone 6S or newer.

A correction to our own September reading. The Go’s standard warranty is two years with no registration needed, and the lifetime cover is an add on: the Go product page, read on 18 October 2026, says it has to be registered within 30 days of the invoice date or bought within 30 days of the card. The table above, compiled on 6 September 2026, called it a lifetime warranty without that condition, which is exactly the sort of shortcut this review complains about in others.

One number in that table deserves a second look. The Pro carries a 15 mAh lithium ion battery, quoted at roughly two weeks on about two transactions a day and up to three months on standby. A battery is a consumable. A device sold partly on the promise of holding coins for years contains a component that measurably does not last years, and no review that earns a commission on the sale will open with that sentence.

Is Bluetooth on a hardware wallet a security problem?

It is a real attack surface, and CoolBitX has had to close a hole in it once. On 18 December 2020 the company published an advisory describing a seed replay attack against the encrypted Bluetooth protocol used by the CoolWallet S. The advisory states that an attacker could “re-execute the commands with the same payloads on the second CoolWallet with the data retrieved from the Bluetooth protocol from the first CoolWallet”.

Three conditions had to hold at once: the owner used basic wallet creation or recovery through an outdated app version, a malicious actor was physically within 30 metres at that moment, and that actor had a second CoolWallet already prepared to intercept. CoolBitX fixed it in CoolWallet App version 2.9.1 and CoolWallet S firmware version 106, and told users to update both.

Read that as an argument about firmware currency rather than an argument about Bluetooth. Any radio widens the circle of people who can talk to your wallet without touching it. The Go answers this by removing the radio: an NFC tap works over centimetres, so the attacker has to be close enough for you to elbow. CoolWallet sells that as convenience. It is also the stronger security position of the two, and it is worth saying so plainly. The same argument splits SafePal’s range, where two models sign by QR code and the Bluetooth X1 does not, a distinction the review sites tend to flatten.

What did Kraken Security Labs find in the CoolWallet S?

On 3 April 2020, Kraken Security Labs published its assessment of the CoolWallet S. The finding was that the Android application stored the wallet PIN, the pairing password and the hardware seed in plaintext, and that “PIN verification cannot be performed on the hardware wallet itself. Instead, PIN verification is performed on the host”. A compromised phone therefore handed an attacker everything needed to drain the paired card.

CoolBitX responded the same day. It disabled critical logging so sensitive data stopped being written out, blocked third party screenshots and screen recording while a seed or PIN is on screen, and changed memory handling so sensitive values are collected faster. Those fixes are six years old now and long since shipped.

The architectural lesson has not aged at all. A CC EAL certification describes the chip, not the product. The chip in the CoolWallet S was doing its job the entire time; the companion app was the part writing secrets into logs. Every wallet whose interface lives on your phone inherits that shape of risk, which is the same reason a phone based wallet like Trust Wallet is not cold storage no matter how careful you are with it.

How does the card format change your backup problem?

It does not change it at all, and that is the part worth sitting with. A CoolWallet is a way to sign transactions without exposing a key to your phone. It is not a way to survive losing the card. If the card is lost, snapped, stolen inside your wallet or simply flat when you need it, the recovery phrase is the only thing standing between you and a total loss.

Which raises the obvious tension with the format. The whole selling point is that the card travels with you, in the object most likely to be pickpocketed, sat on, or left in a taxi. A device you carry daily needs a backup you have actually tested, stored somewhere the card never goes. The failure modes are boringly consistent across every brand, and they are catalogued in the ways people actually lose a recovery phrase.

One rule holds regardless of hardware. Your recovery phrase is entered on the device itself during setup or recovery, and nowhere else. No genuine support agent, verification page, airdrop checker or wallet migration tool needs it. Any site or person asking you to type it is stealing from you, without exception.

Does the card format suit the way you hold coins?

That depends on a question about behaviour rather than a question about products: how often do you actually sign something? A card in your pocket is built around frequent, mobile signing. If you move funds a few times a year and otherwise leave them alone, you are paying a portability premium, and carrying your keys through airports, for a convenience you will use twice.

If you do sign often and from your phone, the card format is a genuinely good answer to a real problem, and the Go removes the radio from the equation entirely. Either way the decision is a security fit question, not a shopping question, and how to choose a crypto wallet and what cold storage actually means both frame it better than a star rating ever will.

What do the affiliate reviews leave out?

Three things, consistently. First, biometrics. A widely syndicated review of the Pro describes fingerprint and facial recognition protecting the wallet. CoolWallet’s own Pro specification page, fetched on 6 September 2026, lists dimensions, battery, chip certification and operating range, and does not list any biometric verification method. A face check on your phone is not a check performed by the card, and the two are routinely blurred together.

Second, the display. The same specification page lists no display specification, so treat descriptions of the on card screen as reported rather than confirmed from the manufacturer. This matters more than it sounds: the size of the screen you verify a transaction on determines how much of that transaction you can actually check before you approve it. Hardware wallets with roomier screens, such as the Ledger Nano X or a Trezor, make a different bet on that tradeoff.

Third, the 2020 advisories. Both are published by CoolBitX itself and neither is hard to find, yet the pages ranking for this product mostly do not mention them. A vendor that discloses a Bluetooth flaw, names the fixed versions and tells people to update is behaving well. A review that omits the disclosure is not, and it leaves the reader unable to answer the only question that matters here, which is whether their firmware is current.

What has changed since this was first published?

• As of October 2026 the CoolWallet store shows the Pro at 149 US dollars and the Go at 69 US dollars for a set of two cards. On 6 September 2026 the same pages showed NT$4,679 and NT$2,167. The store appears to show prices in the visitor’s currency, so read this as a change in what our visit was shown, not as evidence that the price moved.
• Corrected in October 2026: the Go’s warranty is two years as standard, with lifetime cover as a registered add on, per the Go product page. September’s version of this article said lifetime warranty without the condition.
• Found in October 2026: the Pro product page gives two different battery figures, about 2 hours to charge and up to 3 months on standby in its specification list, and 4 to 6 hours and 2 to 3 months in its own FAQ. We report both rather than pick one.
• On 15 June 2026 CoolBitX ended the fiat on and off ramp inside the CoolWallet App, which a partner called Bridge had run, per its own notice. The company says assets on the card were not affected. A search on 18 October 2026 found no new CoolBitX security advisory since the two from 2020 covered above.
• In October 2026 a Ledger investigation into devices sold by its authorised South East Asia reseller CryptoBilis, reported by Decrypt, put supply chains back in the news. That case concerns Ledger devices and we found no confirmed case involving a CoolWallet, but the lesson applies to every card: a reseller badge is not a seal. Our comparison of Ledger devices and the reseller risk sets out what the investigation found.

Frequently asked questions

This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.