{"id":479,"date":"2026-10-08T09:35:38","date_gmt":"2026-10-08T09:35:38","guid":{"rendered":"https:\/\/getbitcoin.guide\/articles\/?p=479"},"modified":"2026-10-29T09:22:55","modified_gmt":"2026-10-29T09:22:55","slug":"phantom-crypto-wallet","status":"publish","type":"post","link":"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/","title":{"rendered":"Phantom Crypto Wallet: The Threat Model It Leaves to You"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>The Phantom crypto wallet is a hot wallet: your keys are decrypted on the device you browse with, so its own June 2024 audit excludes malware from the threat model by design. The cryptography is not the weak part. Your laptop, your phone and whatever you tap approve on are.<\/strong><\/p>\n\n\n\n<div class=\"msq-audio\" data-article=\"phantom-crypto-wallet\" data-minutes=\"14\">\n<style>.msq-audio{margin:1.25em 0 1.75em;padding:16px 18px;background:#EEF3F8;border:1px solid #CBD8E6;border-radius:12px}\n.msq-audio-lead{margin:0 0 8px;font-size:.95em}.msq-audio audio{width:100%;margin:0 0 12px;display:block}\n.msq-toc-title{margin:0 0 6px;font-weight:700}.msq-toc ol{margin:0;padding:0;list-style:none}\n.msq-toc li{display:flex;gap:10px;align-items:center;padding:6px 6px;border-bottom:1px solid #CBD8E6;border-radius:8px}\n.msq-toc li:last-child{border-bottom:0}.msq-toc li.is-active{background:#fff}\n.msq-toc-play{flex:0 0 auto;width:30px;height:30px;border-radius:50%;border:0;background:#1F4E79;color:#fff;font:inherit;font-size:.72em;line-height:30px;padding:0;cursor:pointer}\n.msq-toc-play.is-playing{background:#B4531A}\n.msq-toc-time{flex:0 0 auto;min-width:3.1em;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-toc a{color:#1B1F24;text-decoration:none;line-height:1.35}.msq-toc li.is-active a{font-weight:700;color:#1F4E79}\n.msq-audio-note{margin:10px 0 0;font-size:.82em;color:#4A5560}\nh2.wp-block-heading[id]{scroll-margin-top:24px}\n.msq-hplay{display:inline-block;vertical-align:middle;width:26px;height:26px;margin:0 0 0 10px;border-radius:50%;border:0;background:#1F4E79;cursor:pointer;padding:0;position:relative;top:-2px}\n.msq-hplay::before{content:'\u25b6\ufe0e';display:block;color:#fff;font-size:11px;line-height:26px;text-align:center}\n.msq-hplay.is-playing{background:#B4531A}.msq-hplay.is-playing::before{content:'\u2016';font-size:13px;font-weight:700}\n.msq-bar{position:fixed;left:0;right:0;bottom:0;z-index:9000;display:flex;align-items:center;gap:10px;padding:8px 12px;padding-bottom:calc(8px + env(safe-area-inset-bottom));background:#FFFFFF;border-top:1px solid #CBD8E6;box-shadow:0 -4px 16px rgba(0,0,0,.08);font-size:.92em;color:#1B1F24;transition:transform .2s ease}\n.msq-bar.is-hidden{transform:translateY(130%)}\n.msq-bar-play{display:inline-flex;align-items:center;gap:8px;border:0;border-radius:999px;background:#1F4E79;color:#fff;font:inherit;font-weight:700;padding:8px 14px 8px 12px;cursor:pointer;white-space:nowrap}\n.msq-bar-play.is-playing{background:#B4531A}\n.msq-bar-icon::before{content:'\u25b6\ufe0e';font-size:12px}.msq-bar-play.is-playing .msq-bar-icon::before{content:'\u2016';font-size:14px;font-weight:700}\n.msq-bar-chapter{flex:1 1 auto;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n.msq-bar-time{flex:0 0 auto;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-bar-rate,.msq-bar-close{flex:0 0 auto;border:1px solid #CBD8E6;background:#fff;color:#1B1F24;font:inherit;font-size:.85em;line-height:1;border-radius:8px;padding:7px 9px;cursor:pointer}\n.msq-bar-close::before{content:'\u2715'}\n.msq-bar.msq-bar-pill{left:auto;right:14px;bottom:14px;padding:6px;padding-bottom:6px;border:1px solid #CBD8E6;border-radius:999px;box-shadow:0 6px 20px rgba(0,0,0,.15)}\n.msq-bar.msq-bar-pill .msq-bar-chapter,.msq-bar.msq-bar-pill .msq-bar-time,.msq-bar.msq-bar-pill .msq-bar-rate{display:none}\nbody.msq-has-bar{padding-bottom:76px}\n@media (max-width:600px){.msq-bar-time{display:none}.msq-bar{gap:8px;padding-left:10px;padding-right:10px}}\n.msq-s.msq-now{background:#EEF3F8;box-shadow:0 2px 0 #1F4E79;border-radius:2px}\ntr.msq-now td,tr.msq-now th{background:#EEF3F8;box-shadow:inset 0 -2px 0 #1F4E79}\n@media (hover:hover){.msq-s,tr[data-i]{cursor:pointer}.msq-s:hover{background:#EEF3F8}}<\/style>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"AudioObject\",\"@id\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/#audio\",\"name\":\"Phantom Crypto Wallet: The Threat Model It Leaves to You, read aloud\",\"description\":\"Synthetic voice reading of the article, recorded 8 October 2026.\",\"contentUrl\":\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-audio-202610081512.mp3\",\"encodingFormat\":\"audio\/mpeg\",\"duration\":\"PT13M35S\",\"uploadDate\":\"2026-10-08\",\"inLanguage\":\"en-GB\",\"isAccessibleForFree\":true,\"mainEntityOfPage\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/\",\"hasPart\":[{\"@type\":\"Clip\",\"name\":\"Phantom Crypto Wallet: The Threat Model It Leaves to You\",\"startOffset\":0,\"endOffset\":43},{\"@type\":\"Clip\",\"name\":\"What does the Phantom crypto wallet actually protect?\",\"startOffset\":43,\"endOffset\":143,\"url\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/#what-does-the-phantom-crypto-wallet-actually-protect\"},{\"@type\":\"Clip\",\"name\":\"What does Phantom's own security audit leave out?\",\"startOffset\":143,\"endOffset\":304,\"url\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/#what-does-phantom-s-own-security-audit-leave-out\"},{\"@type\":\"Clip\",\"name\":\"How do people actually lose coins from a Phantom wallet?\",\"startOffset\":304,\"endOffset\":461,\"url\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/#how-do-people-actually-lose-coins-from-a-phantom-wallet\"},{\"@type\":\"Clip\",\"name\":\"Can you pair Phantom with a hardware wallet?\",\"startOffset\":461,\"endOffset\":581,\"url\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/#can-you-pair-phantom-with-a-hardware-wallet\"},{\"@type\":\"Clip\",\"name\":\"What does the lawsuit against Phantom claim?\",\"startOffset\":581,\"endOffset\":701,\"url\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/#what-does-the-lawsuit-against-phantom-claim\"},{\"@type\":\"Clip\",\"name\":\"What does a hot wallet hygiene check look like?\",\"startOffset\":701,\"endOffset\":815,\"url\":\"https:\/\/getbitcoin.guide\/articles\/phantom-crypto-wallet\/#what-does-a-hot-wallet-hygiene-check-look-like\"}],\"contentSize\":\"5.7 MB\"}<\/script>\n<p class=\"msq-audio-lead\"><strong>Listen to this article<\/strong>, about 14 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.<\/p>\n<audio class=\"msq-audio-player\" controls preload=\"metadata\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-audio-202610081512.mp3\"><\/audio>\n<nav class=\"msq-toc\" aria-label=\"In this article\"><p class=\"msq-toc-title\">In this article<\/p>\n<ol>\n<li data-start=\"0.0\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"0.0\" aria-label=\"Play from: Phantom Crypto Wallet: The Threat Model It Leaves to You\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:00<\/span><a href=\"#top\">Phantom Crypto Wallet: The Threat Model It Leaves to You<\/a><\/li>\n<li data-start=\"43.3\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"43.3\" aria-label=\"Play from: What does the Phantom crypto wallet actually protect?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:43<\/span><a href=\"#what-does-the-phantom-crypto-wallet-actually-protect\">What does the Phantom crypto wallet actually protect?<\/a><\/li>\n<li data-start=\"142.92\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"142.92\" aria-label=\"Play from: What does Phantom&#x27;s own security audit leave out?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">2:23<\/span><a href=\"#what-does-phantom-s-own-security-audit-leave-out\">What does Phantom&#x27;s own security audit leave out?<\/a><\/li>\n<li data-start=\"304.06\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"304.06\" aria-label=\"Play from: How do people actually lose coins from a Phantom wallet?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">5:04<\/span><a href=\"#how-do-people-actually-lose-coins-from-a-phantom-wallet\">How do people actually lose coins from a Phantom wallet?<\/a><\/li>\n<li data-start=\"460.6\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"460.6\" aria-label=\"Play from: Can you pair Phantom with a hardware wallet?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">7:41<\/span><a href=\"#can-you-pair-phantom-with-a-hardware-wallet\">Can you pair Phantom with a hardware wallet?<\/a><\/li>\n<li data-start=\"580.66\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"580.66\" aria-label=\"Play from: What does the lawsuit against Phantom claim?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">9:41<\/span><a href=\"#what-does-the-lawsuit-against-phantom-claim\">What does the lawsuit against Phantom claim?<\/a><\/li>\n<li data-start=\"701.16\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"701.16\" aria-label=\"Play from: What does a hot wallet hygiene check look like?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">11:41<\/span><a href=\"#what-does-a-hot-wallet-hygiene-check-look-like\">What does a hot wallet hygiene check look like?<\/a><\/li>\n<\/ol><\/nav>\n<p class=\"msq-audio-note\">Recorded 8 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.<\/p>\n<script>var MSQ_SENT = [[0.0,\"h\",\"phantomcryptowallettheth\",46],[3.88,\"p\",\"thephantomcryptowalletis\",140],[13.92,\"p\",\"thecryptographyisnotthew\",31],[16.68,\"p\",\"yourlaptopyourphoneandwh\",48],[21.08,\"p\",\"onthispagethesentenceinp\",284],[43.3,\"h\",\"whatdoesthephantomcrypto\",45],[46.3,\"p\",\"phantomissoftwareabrowse\",46],[49.94,\"p\",\"itgeneratesyourkeysonyou\",88],[55.98,\"p\",\"nobodyatphantomcanmoveyo\",70],[60.94,\"p\",\"thatisthetradeeverynoncu\",78],[66.78,\"p\",\"whatitprotectswellisthek\",32],[69.5,\"p\",\"theindependentauditpubli\",155],[83.1,\"p\",\"itraisedtwosuggestionsbo\",289],[107.14,\"p\",\"whatitdoesnotprotectisth\",36],[110.3,\"p\",\"tosignanythingthekeyhast\",71],[115.1,\"p\",\"theauditrecordstwoapproa\",154],[127.26,\"p\",\"botharereasonableenginee\",28],[129.18,\"p\",\"neitherdoesmuchifthecomp\",59],[133.66,\"p\",\"mostpagesrankingforthisw\",137],[142.92,\"h\",\"whatdoesphantomsownsecur\",40],[146.2,\"p\",\"hereisthesentenceworthmo\",68],[150.44,\"p\",\"fromthethreatmodelsectio\",227],[167.12,\"p\",\"leastauthoritycalledthat\",139],[176.6,\"p\",\"thatisacourteouswayofsay\",52],[180.08,\"p\",\"thisisnotaphantompeculia\",108],[188.2,\"p\",\"butitdoesmeanacleanaudit\",133],[196.2,\"t\",\"flawinkeygenerationorder\",113],[205.28,\"t\",\"flawintheencryptedstorag\",119],[215.64,\"t\",\"malwarealreadyrunningony\",107],[225.52,\"t\",\"someonewithphysicalacces\",108],[235.32,\"t\",\"afakepagethatasksforyour\",108],[245.44,\"t\",\"approvingatransactiontha\",110],[254.56,\"p\",\"onepieceofhousekeepingbe\",57],[258.64,\"p\",\"theseedphraseflawpeoplea\",100],[269.48,\"p\",\"thecausesatinthebrowsers\",159],[280.44,\"p\",\"phantomsownpostsayshalbo\",131],[291.28,\"p\",\"youwillseeitquotedasajan\",51],[295.76,\"p\",\"itisnot\",7],[297.32,\"p\",\"january2025isthemonthoft\",78],[304.06,\"h\",\"howdopeopleactuallylosec\",46],[307.46,\"p\",\"everyguidancepagesaysthe\",34],[310.22,\"p\",\"whatnoneofthemcarriesisw\",83],[316.74,\"p\",\"phantomstrustpilotprofil\",96],[326.38,\"p\",\"holdthatlooselythepageit\",120],[335.06,\"p\",\"peoplewholosemoneywriter\",71],[340.7,\"p\",\"wereadthesixmostrecentre\",138],[350.3,\"p\",\"arevieweron6september202\",101],[358.38,\"p\",\"arevieweron1june2026repo\",129],[369.34,\"p\",\"abitcointalkthreadopened\",116],[378.42,\"p\",\"theposterspinthemechanis\",111],[386.38,\"p\",\"severalnotethatanupdaten\",86],[392.06,\"p\",\"adeveloperpostingon12jul\",150],[403.74,\"p\",\"hehadconnectedonlytooffi\",33],[406.22,\"p\",\"nofigureisgiveninthepost\",24],[408.46,\"p\",\"onphantomsgithubdiscussi\",166],[421.34,\"p\",\"twofollowupcommentsinapr\",44],[425.26,\"p\",\"theboardisfordeveloperss\",82],[430.7,\"p\",\"thepatternisconsistentan\",54],[434.5,\"p\",\"inalmosteveryaccountwher\",148],[444.74,\"p\",\"theaccountsthatruntheoth\",79],[451.62,\"p\",\"thisistestimonynoteviden\",64],[457.1,\"p\",\"whatitdoestellyouiswhere\",44],[460.6,\"h\",\"canyoupairphantomwithaha\",36],[462.68,\"p\",\"yesandonlywithledger\",20],[464.52,\"p\",\"phantomssupportedhardwar\",116],[474.04,\"t\",\"ledgernanox\",66],[481.6,\"t\",\"ledgerstaxledgerflex\",91],[490.68,\"t\",\"ledgernanosnanosplus\",71],[500.64,\"t\",\"ledgernanogen5\",74],[508.2,\"t\",\"trezorallmodels\",75],[515.04,\"t\",\"tangemallmodels\",75],[521.84,\"t\",\"solanasagaseedvault\",78],[529.6,\"p\",\"twolinesthereareworthase\",32],[531.88,\"p\",\"ifyouownatrezorphantomwi\",135],[541.76,\"p\",\"ifyouarebuyingaledgertop\",91],[547.64,\"p\",\"pairingchangesthethreatm\",131],[556.6,\"p\",\"thereisacostandphantompu\",33],[559.52,\"p\",\"itsperpshelppagestatesth\",68],[564.04,\"p\",\"thissitedoesnotrecommend\",111],[571.28,\"p\",\"thepracticalpointisnarro\",125],[580.66,\"h\",\"whatdoesthelawsuitagains\",37],[583.54,\"p\",\"murphyandthirteenotherss\",106],[596.94,\"p\",\"thecomplaintispublicsoit\",76],[601.82,\"p\",\"itallegesthaton20january\",225],[620.82,\"p\",\"paragraph4pleadsthatphan\",106],[628.1,\"p\",\"theclaimsarenegligencefr\",48],[632.34,\"p\",\"phantomtolddecrypttheyar\",45],[635.86,\"p\",\"theseareallegationsandth\",37],[638.9,\"p\",\"oneofthemcanbecheckedtod\",53],[643.02,\"p\",\"paragraph49assertstherew\",121],[652.58,\"p\",\"phantomshelpcentredocume\",172],[663.34,\"p\",\"thatauditisdated7june202\",58],[668.98,\"p\",\"onthatonepointthepleadin\",100],[676.02,\"p\",\"itisnotadefenceofanythin\",43],[679.02,\"p\",\"statusasfaraswecouldesta\",154],[693.3,\"p\",\"wecouldnotreadtheorderit\",107],[701.16,\"h\",\"whatdoesahotwallethygien\",38],[703.6,\"p\",\"noneofthisneedsaviewonwh\",41],[706.56,\"p\",\"itishousekeepinganditist\",75],[711.4,\"p\",\"nothinglegitimateevernee\",35],[713.88,\"p\",\"phantomshelpcentrestates\",88],[719.76,\"p\",\"anupdatedoesnotneedit\",21],[721.72,\"p\",\"arevokerdoesnotneedit\",21],[724.04,\"p\",\"ifapageasksthepageisthea\",29],[727.0,\"p\",\"disconnectingisnotrevoki\",26],[729.24,\"p\",\"phantomsownwordingdiscon\",119],[737.72,\"p\",\"twodifferentbuttonsandmo\",53],[741.84,\"p\",\"usetherevokersphantompoi\",29],[744.64,\"p\",\"itsguidancenamesfamousfo\",68],[751.0,\"p\",\"bothaskyoutoconnectawall\",26],[753.16,\"p\",\"neitherasksforaphrase\",21],[755.6,\"p\",\"keepaseparatewalletforri\",68],[760.64,\"p\",\"phantomsscamavoidanceart\",84],[766.44,\"p\",\"itsarticleonunfamiliarto\",84],[773.16,\"p\",\"treatanexposedphraseaspu\",28],[775.56,\"p\",\"ifithaseverbeenascreensh\",73],[781.44,\"p\",\"movethecoinstoawalletbui\",58],[786.12,\"p\",\"iftheworsthasalreadyhapp\",145],[796.68,\"p\",\"itsreportingguidancepoin\",145],[807.88,\"p\",\"ifyouareweighingwhereaho\",107]];\n(function(){\n  function init(){\n  var root = document.querySelector('.msq-audio'); if (!root) { return; }\n  var audio = root.querySelector('audio'), items = Array.prototype.slice.call(root.querySelectorAll('.msq-toc li'));\n  var starts = items.map(function(li){ return parseFloat(li.getAttribute('data-start')) || 0; });\n  var names = items.map(function(li){ return li.querySelector('a').textContent; });\n  var anchors = items.map(function(li){ var h = li.querySelector('a').getAttribute('href') || ''; return (h.charAt(0) === '#' && h !== '#top') ? document.getElementById(h.slice(1)) : null; });\n  var article = root.getAttribute('data-article') || location.pathname, minutes = root.getAttribute('data-minutes') || '';\n  var marks = {}, started = false, pausedAt = -1, closed = false, ended = false;\n  var RATES = [1, 1.25, 1.5], rate = 1;\n  try { var saved = parseFloat(localStorage.getItem('msq-audio-rate')); if (RATES.indexOf(saved) >= 0) { rate = saved; } } catch (e) {}\n  audio.playbackRate = rate;\n  function track(name, extra){ try { if (typeof gtag === 'function') { var p = { article: article }; for (var k in extra) { p[k] = extra[k]; } gtag('event', name, p); } } catch (e) {} }\n  function current(){ var t = audio.currentTime, idx = 0; for (var i = 0; starts.length > i; i += 1) { if (t + 0.25 >= starts[i]) { idx = i; } } return idx; }\n  function onScreen(){\n    var line = window.innerHeight \/ 3, idx = 0;\n    for (var i = 0; anchors.length > i; i += 1) { var el = anchors[i]; if (el && line >= el.getBoundingClientRect().top) { idx = i; } }\n    return idx;\n  }\n  function fmt(s){ s = Math.max(0, Math.round(s || 0)); var m = Math.floor(s \/ 60), r = s % 60; return m + ':' + (10 > r ? '0' : '') + r; }\n  function play(from, source){\n    if (from !== null) { audio.currentTime = from; }\n    var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n    track(from === null ? 'audio_resume' : 'audio_chapter', { chapter: names[current()], start: Math.round(audio.currentTime), source: source });\n  }\n  var hbtns = anchors.map(function(el, i){\n    if (!el) { return null; }\n    var b = document.createElement('button'); b.type = 'button'; b.className = 'msq-hplay'; b.setAttribute('aria-label', 'Play this section: ' + names[i]);\n    b.addEventListener('click', function(){\n      if (!audio.paused && current() === i) { audio.pause(); track('audio_pause', { source: 'heading' }); return; }\n      play(starts[i], 'heading');\n    });\n    el.appendChild(b); return b;\n  });\n  var bar = document.createElement('div'); bar.className = 'msq-bar msq-bar-pill is-hidden'; bar.setAttribute('role', 'region'); bar.setAttribute('aria-label', 'Audio player');\n  var playBtn = document.createElement('button'); playBtn.type = 'button'; playBtn.className = 'msq-bar-play';\n  var icon = document.createElement('span'); icon.className = 'msq-bar-icon'; icon.setAttribute('aria-hidden', 'true');\n  var label = document.createElement('span'); label.className = 'msq-bar-label';\n  playBtn.appendChild(icon); playBtn.appendChild(label);\n  var chap = document.createElement('span'); chap.className = 'msq-bar-chapter';\n  var clock = document.createElement('span'); clock.className = 'msq-bar-time';\n  var rateBtn = document.createElement('button'); rateBtn.type = 'button'; rateBtn.className = 'msq-bar-rate'; rateBtn.setAttribute('aria-label', 'Playback speed');\n  var closeBtn = document.createElement('button'); closeBtn.type = 'button'; closeBtn.className = 'msq-bar-close'; closeBtn.setAttribute('aria-label', 'Close the audio bar');\n  bar.appendChild(playBtn); bar.appendChild(chap); bar.appendChild(clock); bar.appendChild(rateBtn); bar.appendChild(closeBtn);\n  document.body.appendChild(bar);\n  function showRate(){ rateBtn.textContent = (rate === 1 ? '1' : String(rate)) + 'x'; }\n  showRate();\n  rateBtn.addEventListener('click', function(){\n    rate = RATES[(RATES.indexOf(rate) + 1) % RATES.length]; audio.playbackRate = rate; showRate();\n    try { localStorage.setItem('msq-audio-rate', String(rate)); } catch (e) {}\n    track('audio_rate', { rate: rate });\n  });\n  closeBtn.addEventListener('click', function(){\n    closed = true; if (!audio.paused) { audio.pause(); } paint(); track('audio_bar_close', {});\n  });\n  function mode(){\n    if (!audio.paused) { return 'pause'; }\n    if (ended) { return 'again'; }\n    if (!started) { return 'listen'; }\n    return (pausedAt === onScreen()) ? 'resume' : 'section';\n  }\n  playBtn.addEventListener('click', function(){\n    var m = mode();\n    if (m === 'pause') { audio.pause(); track('audio_pause', { source: 'bar' }); return; }\n    if (m === 'again') { ended = false; play(0, 'bar'); return; }\n    if (m === 'resume') { play(null, 'bar'); return; }\n    play(starts[onScreen()], 'bar');\n  });\n  function paint(){\n    var idx = current(), playing = !audio.paused, m = mode();\n    items.forEach(function(li, i){\n      var on = (i === idx) && playing, b = li.querySelector('.msq-toc-play'), a = li.querySelector('a');\n      li.classList.toggle('is-active', on); b.classList.toggle('is-playing', on);\n      b.textContent = on ? '\u2016' : '\u25b6\ufe0e';\n      b.setAttribute('aria-label', (on ? 'Pause: ' : 'Play from: ') + a.textContent);\n    });\n    hbtns.forEach(function(b, i){ if (b) { var on = (i === idx) && playing; b.classList.toggle('is-playing', on); b.setAttribute('aria-label', (on ? 'Pause this section: ' : 'Play this section: ') + names[i]); } });\n    playBtn.classList.toggle('is-playing', playing);\n    label.textContent = m === 'pause' ? 'Pause' : m === 'again' ? 'Play again' : m === 'resume' ? 'Resume' : m === 'section' ? 'Play this section' : 'Listen, ' + minutes + ' min';\n    playBtn.setAttribute('aria-label', label.textContent);\n    chap.textContent = started ? names[(playing || m === 'resume') ? idx : onScreen()] : '';\n    clock.textContent = started ? fmt(audio.currentTime) + ' \/ ' + fmt(audio.duration) : '';\n    bar.classList.toggle('msq-bar-pill', !started);\n    var show = !closed && (started || 0 > root.getBoundingClientRect().bottom);\n    bar.classList.toggle('is-hidden', !show);\n    document.body.classList.toggle('msq-has-bar', show);\n  }\n  root.addEventListener('click', function(e){\n    var b = e.target.closest ? e.target.closest('.msq-toc-play') : null; if (!b) { return; }\n    var li = b.parentNode, s = parseFloat(b.getAttribute('data-start')) || 0;\n    if (!audio.paused && current() === items.indexOf(li)) { audio.pause(); track('audio_pause', { source: 'index' }); return; }\n    play(s, 'index');\n  });\n  audio.addEventListener('play', function(){ ended = false; closed = false; if (!started) { started = true; track('audio_play', { minutes: Math.round((audio.duration || 0) \/ 60) }); } paint(); });\n  audio.addEventListener('pause', function(){ pausedAt = current(); paint(); });\n  audio.addEventListener('timeupdate', function(){\n    paint();\n    if (audio.duration > 0) {\n      var pct = Math.floor(audio.currentTime \/ audio.duration * 100);\n      [25, 50, 75].forEach(function(m){ if (pct >= m && !marks[m]) { marks[m] = true; track('audio_progress', { percent: m }); } });\n    }\n  });\n  audio.addEventListener('ended', function(){ ended = true; track('audio_complete', {}); paint(); });\n  var ticking = false;\n  function onScroll(){ if (ticking) { return; } ticking = true; setTimeout(function(){ ticking = false; paint(); }, 80); }\n  window.addEventListener('scroll', onScroll, { passive: true }); window.addEventListener('resize', onScroll);\n  paint();\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', init); } else { init(); }\n})();\n\n(function(){\n  function start(){\n    var root = document.querySelector('.msq-audio'), audio = root ? root.querySelector('audio') : null;\n    var map = (typeof MSQ_SENT !== 'undefined') ? MSQ_SENT : [];\n    if (!root || !audio || !map.length) { return; }\n    var scope = root.closest('main') || root.closest('article') || root.closest('.entry-content') || document.body;\n    var SKIP = '.msq-audio,.msq,.msq-tool,.msq-end,.msq-bar,script,style,noscript,figcaption,#rank-math-faq,.rank-math-block,nav,header,footer';\n    function norm(s){ return s.toLowerCase().replace(\/[^a-z0-9]+\/g, ''); }\n    var nodes = [], stream = '', walker = document.createTreeWalker(scope, NodeFilter.SHOW_TEXT, null), n;\n    while ((n = walker.nextNode())) {\n      var el = n.parentElement; if (!el || el.closest(SKIP)) { continue; }\n      var raw = n.nodeValue, keep = [], norms = '';\n      for (var i = 0; raw.length > i; i += 1) { var c = raw.charAt(i).toLowerCase(); if (\/[a-z0-9]\/.test(c)) { keep.push(i); norms += c; } }\n      if (!norms) { continue; }\n      nodes.push({ node: n, a: stream.length, b: stream.length + norms.length, keep: keep });\n      stream += norms;\n    }\n    var segs = [], cursor = 0, lastRow = null;\n    map.forEach(function(m, idx){\n      var kind = m[1], f = m[2], len = m[3];\n      if (kind === 't') {\n        var rows = scope.querySelectorAll('tr'), after = !lastRow;\n        for (var r = 0; rows.length > r; r += 1) {\n          var tr = rows[r];\n          if (!after) { if (tr === lastRow) { after = true; } continue; }\n          var cell = tr.querySelector('td,th');\n          if (cell && norm(cell.textContent).indexOf(f) === 0) { tr.setAttribute('data-i', idx); lastRow = tr; break; }\n        }\n        return;\n      }\n      var p = stream.indexOf(f, cursor); if (0 > p) { return; }\n      segs.push({ i: idx, a: p, b: Math.min(p + len, stream.length) }); cursor = p + len;\n    });\n    var si = 0;\n    nodes.forEach(function(nd){\n      var frag = document.createDocumentFragment(), raw = nd.node.nodeValue, rawPos = 0, any = false;\n      for (var k = si; segs.length > k; k += 1) {\n        var sg = segs[k]; if (sg.a >= nd.b) { break; } if (nd.a >= sg.b) { continue; }\n        var s = Math.max(sg.a, nd.a), e = Math.min(sg.b, nd.b);\n        var rs = nd.keep[s - nd.a], re2 = nd.keep[e - nd.a - 1] + 1;\n        if (rs > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos, rs))); }\n        var span = document.createElement('span'); span.className = 'msq-s'; span.setAttribute('data-i', sg.i); span.textContent = raw.slice(rs, re2);\n        frag.appendChild(span); rawPos = re2; any = true;\n        if (sg.b > nd.b) { break; }\n      }\n      while (segs.length > si && nd.b >= segs[si].b) { si += 1; }\n      if (!any) { return; }\n      if (raw.length > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos))); }\n      nd.node.parentNode.replaceChild(frag, nd.node);\n    });\n    var starts = map.map(function(m){ return m[0]; }), curIdx = -1, lastUser = 0, timer = null, autoUntil = 0, dragging = false;\n    function idxAt(t){ var lo = 0, hi = starts.length; while (hi > lo + 1) { var mid = (lo + hi) >> 1; if (t + 0.15 >= starts[mid]) { lo = mid; } else { hi = mid; } } return (t + 0.15 >= starts[0]) ? lo : -1; }\n    function setNow(i){\n      if (i === curIdx) { return; }\n      Array.prototype.forEach.call(scope.querySelectorAll('.msq-now'), function(el){ el.classList.remove('msq-now'); });\n      curIdx = i; if (0 > i) { return; }\n      var els = scope.querySelectorAll('[data-i=\"' + i + '\"]'); if (!els.length) { return; }\n      Array.prototype.forEach.call(els, function(el){ el.classList.add('msq-now'); });\n      var r = els[0].getBoundingClientRect(), now = Date.now();\n      if (!dragging && now > lastUser + 2500 && (80 > r.top || r.bottom > window.innerHeight - 140)) {\n        var reduce = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;\n        autoUntil = now + (reduce ? 400 : 1600);\n        els[0].scrollIntoView({ block: 'center', behavior: reduce ? 'auto' : 'smooth' });\n      }\n    }\n    function tick(){ if (!audio.paused) { setNow(idxAt(audio.currentTime)); } }\n    function userScrolled(){ lastUser = Date.now(); }\n    ['wheel', 'touchmove', 'keydown'].forEach(function(ev){ window.addEventListener(ev, userScrolled, { passive: true }); });\n    window.addEventListener('scroll', function(){ if (Date.now() > autoUntil) { userScrolled(); } }, { passive: true });\n    window.addEventListener('mousedown', function(e){ if (e.clientX >= document.documentElement.clientWidth) { dragging = true; userScrolled(); } }, { passive: true });\n    window.addEventListener('mouseup', function(){ if (dragging) { dragging = false; userScrolled(); } }, { passive: true });\n    audio.addEventListener('play', function(){ if (timer) { clearInterval(timer); } timer = setInterval(tick, 150); tick(); });\n    audio.addEventListener('pause', function(){ if (timer) { clearInterval(timer); timer = null; } });\n    scope.addEventListener('click', function(e){\n      if (e.target.closest('a, button, input, select, textarea, label, summary, .msq, .msq-tool, .msq-end, .msq-audio, .msq-bar')) { return; }\n      var sel = window.getSelection ? String(window.getSelection()) : '';\n      if (sel && sel.trim()) { return; }\n      var el = e.target.closest('[data-i]'); if (!el) { return; }\n      var i = parseInt(el.getAttribute('data-i'), 10); if (isNaN(i)) { return; }\n      if (!audio.paused && i === curIdx) { return; }\n      lastUser = Date.now();\n      audio.currentTime = starts[i];\n      var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n      try { if (typeof gtag === 'function') { gtag('event', 'audio_chapter', { article: location.pathname, source: 'sentence', start: Math.round(starts[i]) }); } } catch (err) {}\n    });\n    audio.addEventListener('seeked', tick);\n    audio.addEventListener('ended', function(){ setNow(-1); });\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', start); } else { start(); }\n})();<\/script>\n<\/div>\n\n\n\n<p class=\"msq-hook wp-block-paragraph\">On this page: the sentence in Phantom&#8217;s own 7 June 2024 audit that puts malware outside the threat model, the Trustpilot score read on 8 October 2026 and what the accounts behind it actually describe, the hardware wallet list with Trezor and Tangem on the unsupported side, and the one allegation in the lawsuit that its own cited audit contradicts.<\/p>\n\n\n\n<div class=\"msq\" id=\"ms-quiz\" data-slug=\"phantom-crypto-wallet\" data-category=\"self custody and wallets\" data-list=\"1\">\n<style>.msq,.msq-hook,.msq-box,.msq-end,.msq-tool{--msq-accent:#1F4E79;--msq-accent-text:#FFFFFF;--msq-line:#CBD8E6;--msq-warn:#B4531A;--msq-muted:#4A5560;--msq-tint:#EEF3F8;--msq-base:#FFFFFF}\n.msq{margin:1.25em 0 1.75em}\n.msq-hook{border-left:3px solid var(--msq-accent);padding:6px 14px;color:var(--msq-muted);font-size:.97em}\n.msq-box{background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px;padding:0}\n.msq-box>summary{cursor:pointer;list-style:none;padding:14px 18px;font-weight:700;color:var(--msq-accent)}\n.msq-box>summary::-webkit-details-marker{display:none}\n.msq-box>summary::before{content:\"+\";display:inline-block;width:1.1em;font-weight:800}\n.msq-box[open]>summary::before{content:\"\\00d7\"}\n.msq-body{padding:2px 18px 18px}\n.msq-intro{margin:0 0 12px;font-size:.95em;color:var(--msq-muted)}\n.msq-list{margin:0;padding:0;list-style:none}\n.msq-q{margin:0 0 18px;padding:0}\n.msq-question{font-weight:700;margin:0 0 8px}\n.msq-options{display:flex;flex-direction:column;gap:8px}\n.msq-opt{text-align:left;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;padding:10px 12px;font:inherit;font-size:.95em;color:inherit;cursor:pointer;line-height:1.35}\n.msq-opt:hover{border-color:var(--msq-accent)}\n.msq-opt[disabled]{cursor:default}\n.msq-opt.is-right{border-color:var(--msq-accent);background:var(--msq-line);font-weight:700}\n.msq-opt.is-wrong{border-color:var(--msq-warn);color:var(--msq-warn)}\n.msq-explain{margin:8px 0 0;font-size:.92em;padding:10px 12px;border-left:3px solid var(--msq-accent);background:var(--msq-base);border-radius:0 8px 8px 0}\n.msq-explain[hidden]{display:none}\n.msq-verdict{font-weight:700}\n.msq-result{margin-top:14px;padding:14px 16px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:10px}\n.msq-result[hidden]{display:none}\n.msq-result h3{margin:0 0 6px;font-size:1.1em}\n.msq-result p{margin:0 0 8px}\n.msq-jump{margin:0 0 8px;padding-left:1.2em}\n.msq-form{margin-top:10px;display:flex;flex-wrap:wrap;gap:8px;align-items:center}\n.msq-form input[type=email]{flex:1 1 220px;padding:10px 12px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-btn{background:var(--msq-accent);color:var(--msq-accent-text);border:0;border-radius:8px;padding:11px 18px;font:inherit;font-weight:700;cursor:pointer}\n.msq-btn:hover{filter:brightness(.92)}\n.msq-btn[disabled]{opacity:.7;cursor:default}\n.msq-no{font-size:.9em;color:var(--msq-muted);margin-left:4px}\n.msq-privacy{margin:6px 0 0;font-size:.82em;color:var(--msq-muted);flex-basis:100%}\n.msq-hp{position:absolute;left:-5000px;width:1px;height:1px;overflow:hidden}\n.msq-msg{margin:8px 0 0;font-size:.92em}\n.msq-end{margin:1.5em 0;padding:18px;border:1px solid var(--msq-accent);border-radius:12px;text-align:center;background:var(--msq-tint)}\n.msq-end p{margin:0 0 12px}\n.msq-end .msq-body{text-align:left;padding:16px 0 0}\n.msq-end .msq-start-test[hidden]{display:none}\n.msq-tool{margin:1.5em 0;padding:18px 20px;background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px}\n.msq-tool h3{margin:0 0 6px;font-size:1.15em}\n.msq-tool p{margin:0 0 10px}\n.msq-tool .msq-note{font-size:.85em;color:var(--msq-muted);margin:10px 0 0}\n.msq-check label{display:flex;gap:10px;align-items:flex-start;padding:9px 0;border-bottom:1px solid var(--msq-line);cursor:pointer;line-height:1.4}\n.msq-check label:last-of-type{border-bottom:0}\n.msq-check input{margin-top:5px;flex:0 0 auto;width:18px;height:18px;accent-color:var(--msq-accent)}\n.msq-check-count{font-weight:700;margin:10px 0 0}\n.msq-verdict-box{margin:12px 0 0;padding:10px 14px;border-radius:8px;background:var(--msq-base);border-left:3px solid var(--msq-warn)}\n.msq-verdict-box[hidden]{display:none}\n.msq-calc{display:grid;grid-template-columns:1fr 1fr;gap:10px 16px}\n.msq-calc label{display:flex;flex-direction:column;gap:4px;font-size:.92em}\n.msq-calc input,.msq-calc select{padding:8px 10px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-calc-out{grid-column:1 \/ -1;margin-top:6px;padding:12px 14px;background:var(--msq-base);border-radius:8px;border:1px solid var(--msq-line)}\n.msq-calc-out strong{font-size:1.15em}\n.msq-choose label{display:block;padding:9px 12px;margin:0 0 8px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;cursor:pointer}\n.msq-choose input{margin-right:8px;accent-color:var(--msq-accent)}\n.msq-choice-result{margin-top:10px;padding:12px 14px;background:var(--msq-base);border-left:3px solid var(--msq-accent);border-radius:0 8px 8px 0}\n.msq-choice-result[hidden]{display:none}\n@media (max-width:600px){.msq-calc{grid-template-columns:1fr}}\nh2.wp-block-heading[id]{scroll-margin-top:24px}<\/style>\n<noscript><style>.msq-explain{display:block !important}<\/style><\/noscript>\n<details class=\"msq-box\">\n<summary>Think you already know this? Five questions, one minute.<\/summary>\n<div class=\"msq-body\">\n<p class=\"msq-intro\">Every answer is on this page. Answer from what you know now; the page fills in the rest.<\/p>\n<ol class=\"msq-list\">\n<li class=\"msq-q\" data-q=\"1\" data-answer=\"b\" data-title=\"What does the Phantom crypto wallet actually protect?\" data-section=\"#what-does-the-phantom-crypto-wallet-actually-protect\">\n<p class=\"msq-question\">1. What did the independent audit find in Phantom&#8217;s key handling code?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 1 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Several critical issues that were never fixed<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">No issues, and two suggestions that are both marked Resolved<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">The audit never looked at key storage<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The <a href=\"https:\/\/leastauthority.com\/phantom-wallet-final-audit-report\" target=\"_blank\" rel=\"noopener\">Least Authority report dated 7 June 2024<\/a> reports no issues and two suggestions, a missing BIP32 validity check and a stronger key derivation, both marked Resolved. <a class=\"msq-section\" href=\"#what-does-the-phantom-crypto-wallet-actually-protect\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"2\" data-answer=\"c\" data-title=\"What does Phantom&#x27;s own security audit leave out?\" data-section=\"#what-does-phantom-s-own-security-audit-leave-out\">\n<p class=\"msq-question\">2. Which of these sits outside the threat model the audit was given?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 2 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">A flaw in how the recovery phrase is generated<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">A weakness in the encryption of stored keys<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Malware already running on the user&#8217;s own computer<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The report states that &#8220;the threat model does not include compromised devices (e.g., malware being present)&#8221;, physical access or network attacks, and says users should ensure those are prevented by other measures. Read it in the <a href=\"https:\/\/leastauthority.com\/phantom-wallet-final-audit-report\" target=\"_blank\" rel=\"noopener\">threat model section<\/a>. <a class=\"msq-section\" href=\"#what-does-phantom-s-own-security-audit-leave-out\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"3\" data-answer=\"b\" data-title=\"How do people actually lose coins from a Phantom wallet?\" data-section=\"#how-do-people-actually-lose-coins-from-a-phantom-wallet\">\n<p class=\"msq-question\">3. In the Bitcointalk thread from 7 February 2025, what had to happen before the fake update pop up appeared?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 3 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Nothing, it appeared on its own inside the real extension<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">The user had to visit a fake airdrop site, connect and sign a message<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">The user had to install an old version of the extension<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>Posters in <a href=\"https:\/\/bitcointalk.org\/index.php?topic=5529335.0\" target=\"_blank\" rel=\"noopener\">that thread<\/a> worked the sequence out between them, and several pointed out that a genuine update never needs the recovery phrase at all. <a class=\"msq-section\" href=\"#how-do-people-actually-lose-coins-from-a-phantom-wallet\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"4\" data-answer=\"a\" data-title=\"Can you pair Phantom with a hardware wallet?\" data-section=\"#can-you-pair-phantom-with-a-hardware-wallet\">\n<p class=\"msq-question\">4. Which hardware wallets does Phantom list as supported?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 4 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Ledger only, with named models<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Ledger, Trezor and Tangem<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Any device that speaks BIP39<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>Phantom&#8217;s <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/46593089236627-Supported-hardware-wallets-in-Phantom\" target=\"_blank\" rel=\"noopener\">supported hardware wallets article<\/a>, read on 8 October 2026, lists named Ledger models and puts all Trezor models, all Tangem models and the Ledger Nano Gen5 on the unsupported side. <a class=\"msq-section\" href=\"#can-you-pair-phantom-with-a-hardware-wallet\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"5\" data-answer=\"b\" data-title=\"What does the lawsuit against Phantom claim?\" data-section=\"#what-does-the-lawsuit-against-phantom-claim\">\n<p class=\"msq-question\">5. Which allegation in the complaint is contradicted by the audit the complaint itself cites?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 5 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">That the theft took place on 20 January 2025<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">That users had no way to opt into hardware wallet integration<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">That the swap feature was used to liquidate the tokens<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>Paragraph 49 of the <a href=\"https:\/\/business.cch.com\/srd\/20250414_Murphy-v-PhantomTechnologies_complaint.pdf\" target=\"_blank\" rel=\"noopener\">complaint<\/a> says there was no such option, while the General Comments of the 7 June 2024 <a href=\"https:\/\/leastauthority.com\/phantom-wallet-final-audit-report\" target=\"_blank\" rel=\"noopener\">Least Authority audit<\/a> state that Phantom &#8220;also supports hardware wallets&#8221;. The rest of the complaint is untested. <a class=\"msq-section\" href=\"#what-does-the-lawsuit-against-phantom-claim\">Read the section<\/a><\/p>\n<\/li>\n<\/ol>\n<div class=\"msq-result\" hidden><\/div>\n<\/div>\n<\/details>\n<script>(function(){\n  if (window.__msqInit) { return; }\n  window.__msqInit = true;\n  var root = document.getElementById('ms-quiz');\n  if (!root) { return; }\n  var meta = { slug: root.getAttribute('data-slug'), category: root.getAttribute('data-category'),\n               list: root.getAttribute('data-list') || '1' };\n  function qs(el, s){ return el.querySelector(s); }\n  function qsa(el, s){ return Array.prototype.slice.call(el.querySelectorAll(s)); }\n  function track(name, params){\n    try { if (typeof gtag === 'function') { var p = params || {}; p.article = meta.slug; gtag('event', name, p); } } catch (e) {}\n  }\n  function jumpList(missed){\n    if (!missed.length) { return ''; }\n    return '<ul class=\"msq-jump\">' + missed.map(function(q){\n      return '<li><a href=\"' + q.getAttribute('data-section') + '\">' + q.getAttribute('data-title') + '<\/a><\/li>';\n    }).join('') + '<\/ul>';\n  }\n  function emailForm(){\n    return '<div class=\"msq-sub\"><p><strong>Get the next one.<\/strong> We publish new articles on ' + meta.category\n      + ' most weeks and recheck this page on Sundays. Email me when a new article goes up or this page changes.<\/p>'\n      + '<form class=\"msq-form\" method=\"post\" action=\"\/mail\/form.php\" novalidate>'\n      + '<input type=\"hidden\" name=\"list\" value=\"' + meta.list + '\">'\n      + '<input type=\"hidden\" name=\"name\" value=\"\">'\n      + '<label class=\"msq-hp\" aria-hidden=\"true\">Leave this empty<input type=\"text\" name=\"website\" tabindex=\"-1\" autocomplete=\"off\"><\/label>'\n      + '<input type=\"email\" name=\"email\" placeholder=\"you@example.com\" required aria-label=\"Email address\" autocomplete=\"email\">'\n      + '<button type=\"submit\" class=\"msq-btn\">Email me the updates<\/button>'\n      + '<a href=\"#\" class=\"msq-no\">No thanks<\/a>'\n      + '<p class=\"msq-privacy\">We store your email and this page\\'s topic, nothing else. Unsubscribe any time.<\/p>'\n      + '<\/form><p class=\"msq-msg\" aria-live=\"polite\"><\/p><\/div>';\n  }\n  \/* The autoresponder always answers 200 with its own page. A \".msg.err\" box means the\n     address was rejected, \"You're subscribed\" means accepted, and a redirect only happens\n     after a successful subscribe. Same reading as the landing pages on the other sites. *\/\n  function sendForm(form){\n    return fetch(form.getAttribute('action'), { method: 'POST', body: new FormData(form), credentials: 'same-origin', redirect: 'manual' })\n      .then(function(res){\n        if (res.type === 'opaqueredirect') { return { status: 'ok' }; }\n        if (res.status === 404) { return { status: 'notlive' }; }\n        if (!res.ok) { throw new Error('HTTP ' + res.status); }\n        return res.text().then(function(t){\n          var doc = new DOMParser().parseFromString(t, 'text\/html');\n          var err = doc.querySelector('.msg.err');\n          if (err) {\n            var m = err.textContent.trim();\n            if (\/something went wrong\/i.test(m)) { throw new Error(m); }\n            return { status: 'rejected', message: m };\n          }\n          if (\/you.re subscribed\/i.test(doc.body.textContent)) { return { status: 'ok' }; }\n          return { status: 'unknown' };\n        });\n      });\n  }\n  function wireForm(sub){\n    var form = qs(sub, '.msq-form'), msg = qs(sub, '.msq-msg');\n    qs(form, '.msq-no').addEventListener('click', function(e){\n      e.preventDefault();\n      sub.innerHTML = '<p class=\"msq-msg\">No problem. The Sunday refresh keeps this page current either way.<\/p>';\n      track('quiz_email', { result: 'declined' });\n    });\n    form.addEventListener('submit', function(e){\n      e.preventDefault();\n      var input = qs(form, 'input[name=email]'), btn = qs(form, '.msq-btn');\n      var email = input.value.trim(); input.value = email;\n      if (!\/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$\/.test(email)) { msg.textContent = 'That email does not look right.'; return; }\n      btn.disabled = true; btn.textContent = 'Sending';\n      function reset(){ btn.disabled = false; btn.textContent = 'Email me the updates'; }\n      sendForm(form).then(function(r){\n        if (r.status === 'ok' || r.status === 'unknown') {\n          sub.innerHTML = '<p class=\"msq-msg\"><strong>Done.<\/strong> We will email you when the next article on ' + meta.category\n            + ' goes up and when this page changes. If a confirmation email arrives, click it.<\/p>';\n          track('quiz_email', { result: r.status });\n          if (r.status === 'ok') { track('generate_lead', { method: 'quiz' }); }\n        } else if (r.status === 'notlive') {\n          msg.textContent = 'Sign up is not switched on yet for this site. Nothing was stored.'; reset();\n          track('quiz_email', { result: 'notlive' });\n        } else {\n          msg.textContent = r.message || 'Please check the email address and try again.'; reset();\n          track('quiz_email', { result: 'rejected' });\n        }\n      }).catch(function(){\n        msg.textContent = 'Could not reach the sign up service just now. Nothing was stored.'; reset();\n        track('quiz_email', { result: 'error' });\n      });\n    });\n  }\n  function finish(container, mode, score, total, missed){\n    var result = qs(container, '.msq-result');\n    track('quiz_complete', { mode: mode, score: score, total: total });\n    var h;\n    if (mode === 'pre') {\n      h = '<h3>You knew ' + score + ' of ' + total + ' before reading.<\/h3>';\n      h += (score === total) ? '<p>All of them. Read on anyway; the sections below carry the detail behind each answer.<\/p>'\n                             : '<p>The rest is below. Jump straight to what you missed:<\/p>' + jumpList(missed);\n      try { sessionStorage.setItem('msq-pre-' + meta.slug, String(score)); } catch (e) {}\n    } else {\n      var pre = null;\n      try { pre = sessionStorage.getItem('msq-pre-' + meta.slug); } catch (e) {}\n      h = '<h3>You got ' + score + ' of ' + total + '.<\/h3>';\n      if (pre !== null) { h += '<p>Before reading you had ' + pre + ' of ' + total + '.<\/p>'; }\n      if (missed.length) { h += '<p>Worth a second look:<\/p>' + jumpList(missed); }\n      h += emailForm();\n    }\n    result.innerHTML = h; result.hidden = false;\n    if (mode !== 'pre') { wireForm(qs(result, '.msq-sub')); }\n    result.scrollIntoView({ behavior: 'smooth', block: 'nearest' });\n  }\n  function setup(container, mode){\n    var qEls = qsa(container, '.msq-q'), answered = 0, score = 0, missed = [];\n    qEls.forEach(function(q){\n      var answer = q.getAttribute('data-answer'), opts = qsa(q, '.msq-opt'), explain = qs(q, '.msq-explain');\n      q.removeAttribute('data-done'); explain.hidden = true; qs(explain, '.msq-verdict').textContent = '';\n      opts.forEach(function(b){ b.disabled = false; b.classList.remove('is-right', 'is-wrong'); });\n      opts.forEach(function(b){\n        b.addEventListener('click', function(){\n          if (q.getAttribute('data-done')) { return; }\n          q.setAttribute('data-done', '1');\n          var ok = b.getAttribute('data-opt') === answer;\n          opts.forEach(function(o){ o.disabled = true; if (o.getAttribute('data-opt') === answer) { o.classList.add('is-right'); } });\n          if (ok) { score += 1; } else { b.classList.add('is-wrong'); missed.push(q); }\n          qs(explain, '.msq-verdict').textContent = ok ? 'Right. ' : 'Not quite. ';\n          explain.hidden = false;\n          answered += 1;\n          track('quiz_answer', { mode: mode, question: q.getAttribute('data-q'), correct: ok ? 1 : 0 });\n          if (answered === qEls.length) { finish(container, mode, score, qEls.length, missed); }\n        });\n      });\n    });\n  }\n  var box = qs(root, '.msq-box');\n  setup(root, 'pre');\n  if (box) { var skipFirst = box.hasAttribute('data-default-open'); box.addEventListener('toggle', function(){ if (!box.open) { return; } if (skipFirst) { skipFirst = false; return; } track('quiz_open', { mode: 'pre' }); }); }\n  \/* The end block sits far below this script, so it does not exist yet while this runs\n     during parsing. A delegated listener finds it at click time. *\/\n  document.addEventListener('click', function(e){\n    var startBtn = (e.target && e.target.closest) ? e.target.closest('.msq-start-test') : null;\n    if (!startBtn) { return; }\n    var end = startBtn.closest('.msq-end');\n    if (!end) { return; }\n    var mount = qs(end, '.msq-mount');\n    var clone = qs(root, '.msq-body').cloneNode(true);\n    var intro = qs(clone, '.msq-intro');\n    if (intro) { intro.textContent = 'The same five questions, now that you have read the page.'; }\n    var res = qs(clone, '.msq-result'); if (res) { res.hidden = true; res.innerHTML = ''; }\n    mount.innerHTML = ''; mount.appendChild(clone);\n    setup(mount, 'test');\n    startBtn.hidden = true;\n    track('quiz_open', { mode: 'test' });\n    mount.scrollIntoView({ behavior: 'smooth', block: 'start' });\n    var first = qs(mount, '.msq-opt'); if (first) { first.focus({ preventScroll: true }); }\n  });\n  \/* Shared tool behaviour: checklists remember their ticks on this device, and a chooser\n     shows the result for the option picked. Calculators carry their own small script. *\/\n  function initTools(){\n    qsa(document, '.msq-check').forEach(function(box){\n      var key = 'msq-check-' + meta.slug + '-' + (box.getAttribute('data-id') || 'x');\n      var boxes = qsa(box, 'input[type=checkbox]'), count = qs(box, '.msq-check-count');\n      var yes = qs(box, '.msq-verdict-yes'), no = qs(box, '.msq-verdict-no');\n      var saved = {};\n      try { saved = JSON.parse(localStorage.getItem(key) || '{}'); } catch (e) {}\n      boxes.forEach(function(cb, i){ if (saved[i]) { cb.checked = true; } });\n      function refresh(){\n        var n = boxes.filter(function(cb){ return cb.checked; }).length, state = {};\n        boxes.forEach(function(cb, i){ if (cb.checked) { state[i] = 1; } });\n        try { localStorage.setItem(key, JSON.stringify(state)); } catch (e) {}\n        if (count) { count.textContent = n + ' of ' + boxes.length + (box.getAttribute('data-verb') || ' done'); }\n        if (yes && no) { yes.hidden = n === 0; no.hidden = n !== 0; }\n      }\n      boxes.forEach(function(cb){ cb.addEventListener('change', function(){ refresh(); track('tool_check', { tool: box.getAttribute('data-id') }); }); });\n      refresh();\n    });\n    qsa(document, '.msq-choose').forEach(function(box){\n      var results = qsa(box, '.msq-choice-result');\n      qsa(box, 'input[type=radio]').forEach(function(r){\n        r.addEventListener('change', function(){\n          results.forEach(function(el){ el.hidden = el.getAttribute('data-for') !== r.value; });\n          track('tool_choose', { tool: box.getAttribute('data-id'), choice: r.value });\n        });\n      });\n    });\n  }\n  \/\/ read progress: how far down the article the reader has scrolled, fired once per quarter\n  (function(){\n    var art = root.closest('article') || root.parentNode, fired = {};\n    function check(){\n      var top = art.getBoundingClientRect().top + window.pageYOffset, h = art.offsetHeight || 1;\n      var seen = (window.pageYOffset + window.innerHeight - top) \/ h * 100;\n      [25, 50, 75, 100].forEach(function(m){ if (seen >= m && !fired[m]) { fired[m] = true; track('read_progress', { percent: m }); } });\n    }\n    window.addEventListener('scroll', check, { passive: true }); window.addEventListener('load', check);\n  })();\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', initTools); } else { initTools(); }\n})();<\/script>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-the-phantom-crypto-wallet-actually-protect\">What does the Phantom crypto wallet actually protect?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Phantom is software: a browser extension and a phone app. It generates your keys on your own device and hands you a secret recovery phrase that is yours to look after. Nobody at Phantom can move your coins, and nobody at Phantom can give them back either. That is the trade every <a href=\"https:\/\/getbitcoin.guide\/articles\/non-custodial-crypto-wallet\/\">non custodial wallet<\/a> asks you to accept, and Phantom accepts it cleanly. Some phone wallets soften the trade with a cloud copy of the keys, and <a href=\"https:\/\/getbitcoin.guide\/articles\/rainbow-wallet-crypto\/\">how the Rainbow wallet backup and its password work<\/a> shows what that copy still leaves to you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What it protects well is the key at rest. The independent audit published by <a href=\"https:\/\/leastauthority.com\/phantom-wallet-final-audit-report\" target=\"_blank\" rel=\"noopener\">Least Authority on 7 June 2024<\/a> examined the vault, the BIP39 and BIP32 packages, the mnemonic code and the two storage files, and reported no issues at all. It raised two suggestions, both marked Resolved: a missing validity check in the BIP32 implementation, and a storage encryption key derived with PBKDF2 at 10,000 iterations, SHA256 and a 16 bit salt, which the auditors wrote &#8220;does not conform to best practices&#8221; because an attacker holding the ciphertext could brute force the password &#8220;relatively fast&#8221;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What it does not protect is the moment of use. To sign anything, the key has to be decrypted in the memory of the machine in front of you. The audit records two approaches: on mobile, the React Native library expo-secure-store, and in the browser, &#8220;their own secure storage, which is a wrapper of the underlying extension storage&#8221;. Both are reasonable engineering. Neither does much if the computer is already working for somebody else. Most pages ranking for this wallet will walk you through the swap screen and the staking tab, and very few mention which of your two devices is actually holding the bag.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/writing-backup-keys-for-phantom-crypto-wallet.jpg\" alt=\"A close-up of hands writing backup keys to secure a phantom crypto wallet on paper.\" class=\"wp-image-477\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/writing-backup-keys-for-phantom-crypto-wallet.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/writing-backup-keys-for-phantom-crypto-wallet-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/writing-backup-keys-for-phantom-crypto-wallet-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/writing-backup-keys-for-phantom-crypto-wallet-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">Physical backups remain the most critical layer of defense.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-phantom-s-own-security-audit-leave-out\">What does Phantom&#8217;s own security audit leave out?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the sentence worth more than every feature tour written about this wallet. From the threat model section of the 7 June 2024 report: &#8220;the threat model does not include compromised devices (e.g., malware being present), physical access to the user&#8217;s device by the attacker, network attacks&#8221; and vulnerabilities on devices more than two stable versions behind.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Least Authority called that scope reasonable, adding that users should &#8220;responsibly ensure that attacks outside of this threat model are prevented by other measures&#8221;. That is a courteous way of saying the laptop is your department. This is not a Phantom peculiarity: every browser wallet audit draws the line somewhere, and <a href=\"https:\/\/getbitcoin.guide\/articles\/metamask-wallet-review\/\">the same reasoning applies to MetaMask<\/a>. But it does mean a clean audit of a hot wallet is not a statement about the risk you are carrying, and that is the part the review sites leave on the cutting room floor.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Threat<\/th><th>Inside the audited threat model<\/th><th>Who carries it in practice<\/th><\/tr><\/thead><tbody> <tr><td>Flaw in key generation or derivation<\/td><td>Yes, and no issues were reported<\/td><td>Phantom<\/td><\/tr> <tr><td>Flaw in the encrypted storage of the key<\/td><td>Yes, one suggestion, marked Resolved<\/td><td>Phantom<\/td><\/tr> <tr><td>Malware already running on your computer<\/td><td>No, explicitly excluded<\/td><td>You<\/td><\/tr> <tr><td>Someone with physical access to the device<\/td><td>No, explicitly excluded<\/td><td>You<\/td><\/tr> <tr><td>A fake page that asks for your recovery phrase<\/td><td>No, not a software flaw<\/td><td>You<\/td><\/tr> <tr><td>Approving a transaction that drains an approval<\/td><td>No, you authorised it<\/td><td>You<\/td><\/tr> <\/tbody><\/table><figcaption class=\"wp-element-caption\">Scope taken from the threat model section of the Least Authority report dated 7 June 2024.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">One piece of housekeeping, because the review sites keep garbling it. The seed phrase flaw people attribute to Phantom was <a href=\"https:\/\/halborn.com\/disclosures\/demonic-vulnerability\/\" target=\"_blank\" rel=\"noopener\">Halborn&#8217;s &#8220;Demonic&#8221; disclosure<\/a>, CVE-2022-32969, published in June 2022. The cause sat in the browser: session restore saved the contents of non password input fields to disk unencrypted, so a phrase typed into an ordinary field could be left lying there in plain text. Phantom&#8217;s <a href=\"https:\/\/phantom.com\/learn\/blog\/keeping-phantom-safe-from-the-demonic-critical-vulnerability\" target=\"_blank\" rel=\"noopener\">own post<\/a> says Halborn alerted it in late September 2021 and that &#8220;fixes began rolling out in January 2022, and by April, Phantom users became protected&#8221;. You will see it quoted as a January 2025 vulnerability report. It is not. January 2025 is the month of the theft in the lawsuit below, which is a different thing entirely.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-people-actually-lose-coins-from-a-phantom-wallet\">How do people actually lose coins from a Phantom wallet?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every guidance page says the same things. What none of them carries is what the people who lost money say happened, so we read it on 8 October 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Phantom&#8217;s <a href=\"https:\/\/www.trustpilot.com\/review\/phantom.app\" target=\"_blank\" rel=\"noopener\">Trustpilot profile<\/a> scores 1.5 out of 5 across 103 reviews, 88 percent of them at one star and 8 percent at five. Hold that loosely: the page itself says the profile is unclaimed, reviews are not fact checked and the company has not invited customers to review. People who lose money write reviews; people who quietly keep their coins mostly do not. We read the six most recent reviews there, nineteen replies in one Bitcointalk thread, a second Bitcointalk thread and one discussion on Phantom&#8217;s own developer board.<\/p>\n\n\n\n<ul class=\"wp-block-list\"> <li>A reviewer on 6 September 2026 reports being hacked for roughly 2,000 dollars of bitcoin and blames the browser extension.<\/li> <li>A reviewer on 1 June 2026 reports depositing 100 dollars of SOL, paying a 7 dollar fee, and ending up holding a token that Phantom itself later flagged as a scam.<\/li> <li>A <a href=\"https:\/\/bitcointalk.org\/index.php?topic=5529335.0\" target=\"_blank\" rel=\"noopener\">Bitcointalk thread opened on 7 February 2025<\/a> runs to nineteen replies about a fake extension update pop up asking for the recovery phrase. The posters pin the mechanism down between them: it only appears after the user visits a fake airdrop site, connects and signs a message. Several note that an update never needs the phrase, which is exactly why the request should stop you cold.<\/li> <li>A developer <a href=\"https:\/\/bitcointalk.org\/index.php?topic=5502817.0\" target=\"_blank\" rel=\"noopener\">posting on 12 July 2024<\/a> downloaded an executable advertised on GitHub as a trading bot, ran it, and three days later found both his MetaMask and his Phantom wallet emptied. He had connected only to official sites. No figure is given in the post.<\/li> <li>On <a href=\"https:\/\/github.com\/orgs\/phantom\/discussions\/331\" target=\"_blank\" rel=\"noopener\">Phantom&#8217;s GitHub discussions on 5 December 2024<\/a>, a user whose transactions were being blocked was told &#8220;For this request please contact our support team directly via settings in your Phantom wallet&#8221;. Two follow up comments in April 2025 went unanswered. The board is for developers, so the routing is correct, but it is also how a loss feels from the outside.<\/li> <\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The pattern is consistent, and it cuts against the headline score. In almost every account where coins actually moved, the compromise happened outside the wallet: a phrase typed into a convincing fake, or malware the reader installed themselves. The accounts that run the other way are about fees, failed swaps and slow support, not stolen keys. This is testimony, not evidence, and a star rating is not a security assessment. What it does tell you is where the risk actually lives.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/connecting-hardware-device-to-phantom-crypto-wallet.jpg\" alt=\"A woman taps a small hardware signing device to her phone to use a phantom crypto wallet.\" class=\"wp-image-478\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/connecting-hardware-device-to-phantom-crypto-wallet.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/connecting-hardware-device-to-phantom-crypto-wallet-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/connecting-hardware-device-to-phantom-crypto-wallet-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/connecting-hardware-device-to-phantom-crypto-wallet-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">Pairing a signing device moves the approval off the browser.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-chart.png\" alt=\"Bar chart of Trustpilot star ratings for the phantom crypto wallet, mostly one star\" class=\"wp-image-481\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-chart.png 1600w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-chart-300x169.png 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-chart-1024x576.png 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-chart-768x432.png 768w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/phantom-crypto-wallet-chart-1536x864.png 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><figcaption class=\"wp-block-image__caption\">Trustpilot reports the 2 star and 4 star shares as under 1 percent each, drawn here as 1. A 1.5 average hides the shape of the data: it is an unclaimed, unverified profile where almost everyone who writes is someone who lost money. Useful for finding out how losses happen, not for scoring the software.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"can-you-pair-phantom-with-a-hardware-wallet\">Can you pair Phantom with a hardware wallet?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, and only with Ledger. Phantom&#8217;s <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/46593089236627-Supported-hardware-wallets-in-Phantom\" target=\"_blank\" rel=\"noopener\">supported hardware wallets page<\/a>, read on 8 October 2026, is unusually specific, and the exclusions matter more than the inclusions.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Device<\/th><th>Status in Phantom<\/th><th>How it connects<\/th><\/tr><\/thead><tbody> <tr><td>Ledger Nano X<\/td><td>Supported, mobile app<\/td><td>Bluetooth<\/td><\/tr> <tr><td>Ledger Stax, Ledger Flex<\/td><td>Supported, mobile and extension<\/td><td>Bluetooth or cable<\/td><\/tr> <tr><td>Ledger Nano S, Nano S Plus<\/td><td>Supported, extension<\/td><td>Cable<\/td><\/tr> <tr><td>Ledger Nano Gen5<\/td><td>Listed as unsupported<\/td><td>Not applicable<\/td><\/tr> <tr><td>Trezor, all models<\/td><td>Listed as unsupported<\/td><td>Not applicable<\/td><\/tr> <tr><td>Tangem, all models<\/td><td>Listed as unsupported<\/td><td>Not applicable<\/td><\/tr> <tr><td>Solana Saga Seed Vault<\/td><td>&#8220;Saga is end of support&#8221;<\/td><td>Not applicable<\/td><\/tr> <\/tbody><\/table><figcaption class=\"wp-element-caption\">From Phantom&#8217;s supported hardware wallets help article, read 8 October 2026. The Nano X appears on the mobile row only.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Two lines there are worth a second read. If you own a Trezor, Phantom will not pair with it, and the same goes for <a href=\"https:\/\/getbitcoin.guide\/articles\/tangem-crypto-wallet\/\">a Tangem card<\/a>, which is one reason the device you already own decides more than the app you prefer. If you are buying a Ledger to pair, check the model against that list rather than against a review, <a href=\"https:\/\/getbitcoin.guide\/articles\/ledger-flex-review\/\">ours included<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pairing changes the threat model in the only way that matters: signing moves to a device with its own screen, and the recovery phrase never goes near the browser. There is a cost, and Phantom publishes it. Its <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/42292249388307-Trade-perps-in-Phantom\" target=\"_blank\" rel=\"noopener\">perps help page<\/a> states that &#8220;Perps are not available when using Ledger wallets&#8221;. This site does not recommend perps, staking, lending or any yield product, and nothing here is a view on whether anyone should touch them. The practical point is narrower: the safer key and the busiest screens in the app do not fully coexist, so decide what the account is for before you fund it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-the-lawsuit-against-phantom-claim\">What does the lawsuit against Phantom claim?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Murphy and thirteen others sued Phantom Technologies in the Southern District of New York on 14 April 2025, case 1:25-cv-03060-MMG. The <a href=\"https:\/\/business.cch.com\/srd\/20250414_Murphy-v-PhantomTechnologies_complaint.pdf\" target=\"_blank\" rel=\"noopener\">complaint is public<\/a>, so it is worth quoting rather than paraphrasing through a news desk. It alleges that on 20 January 2025 an attacker took the decrypted private key &#8220;from his browser&#8217;s working memory&#8221;, reached more than 500,000 dollars across three Phantom wallets, and inside five minutes liquidated the lot for 37,537 dollars using the wallet&#8217;s own swap feature. Paragraph 4 pleads that Phantom &#8220;has long known that its browser application stores decrypted private keys in volatile memory&#8221;. The claims are negligence, fraud and deceptive practices. Phantom told <a href=\"https:\/\/decrypt.co\/314783\/phantom-wallet-sued-500k-meme-coin-theft-alleged-security-flaw\" target=\"_blank\" rel=\"noopener\">Decrypt<\/a> they are &#8220;entirely without merit&#8221;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These are allegations and they are untested. One of them can be checked today, and it does not survive the check. Paragraph 49 asserts there was &#8220;no ability for users to opt into safer alternatives like hardware wallet integration or encrypted local storage&#8221;. Phantom&#8217;s help centre documents Ledger pairing for both the extension and the mobile app, and the General Comments of the very audit the complaint relies on state that Phantom &#8220;also supports hardware wallets&#8221;. That audit is dated 7 June 2024, more than seven months before the theft. On that one point the pleading and its own cited source disagree, and we flag it because nothing else covering the case has. It is not a defence of anything else in the complaint.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Status, as far as we could establish on 8 October 2026: a Law360 case report dated 28 September 2026 says the court ruled the plaintiffs&#8217; attorney must arbitrate his claims against Phantom. We could not read the order itself, so treat that as reported rather than confirmed and check the <a href=\"https:\/\/dockets.justia.com\/docket\/new-york\/nysdce\/1:2025cv03060\/640468\" target=\"_blank\" rel=\"noopener\">public docket<\/a> for where it stands.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-a-hot-wallet-hygiene-check-look-like\">What does a hot wallet hygiene check look like?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">None of this needs a view on what anyone should own. It is housekeeping, and it is the part that decides whether the accounts above happen to you.<\/p>\n\n\n\n<ul class=\"wp-block-list\"> <li><strong>Nothing legitimate ever needs the phrase.<\/strong> Phantom&#8217;s help centre states that Phantom Support will never ask you to share your secret recovery phrase. An update does not need it. A revoker does not need it. If a page asks, the page is the attack.<\/li> <li><strong>Disconnecting is not revoking.<\/strong> Phantom&#8217;s own wording: <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/19888567849107-How-to-Disconnect-your-Wallet-from-dApps\" target=\"_blank\" rel=\"noopener\">disconnecting<\/a> removes an app&#8217;s ability to view your wallet, while <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/19142125651731-Revoke-token-approvals\" target=\"_blank\" rel=\"noopener\">revoking<\/a> removes its permission to move certain tokens. Two different buttons, and most people only ever press the first.<\/li> <li><strong>Use the revokers Phantom points at.<\/strong> Its guidance names Famous Fox Revoker for Solana and Revoke.cash for EVM networks. Both ask you to connect a wallet. Neither asks for a phrase.<\/li> <li><strong>Keep a separate wallet for risky connections,<\/strong> holding only what that one job needs. Phantom&#8217;s <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/37416944587795-Tools-to-help-you-avoid-crypto-scams\" target=\"_blank\" rel=\"noopener\">scam avoidance article<\/a> says the same, and adds not to reach apps through paid search results. Its article on <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/38409446731539-What-if-I-see-an-unfamiliar-token-or-NFT-in-my-Phantom-wallet\" target=\"_blank\" rel=\"noopener\">unfamiliar tokens<\/a> says not to click links inside them: an unexpected token is not a gift.<\/li> <li><strong>Treat an exposed phrase as public.<\/strong> If it has ever been a screenshot, a note app entry or a file in a cloud drive, it is not a backup. Move the coins to a wallet built from a new phrase on a machine you trust.<\/li> <\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If the worst has already happened, Phantom&#8217;s <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/5487893286291-What-to-do-if-I-was-scammed\" target=\"_blank\" rel=\"noopener\">page on being drained<\/a> is honest about the limits: it cannot reverse blockchain transactions, freeze assets or recover stolen funds. Its <a href=\"https:\/\/help.phantom.com\/hc\/en-us\/articles\/5488511865619-How-to-report-a-scam\" target=\"_blank\" rel=\"noopener\">reporting guidance<\/a> points to the FBI&#8217;s Internet Crime Complaint Center at ic3.gov and says to collect the scam links, the destination address and the transaction IDs first. If you are weighing where a hot wallet belongs at all, our guide to <a href=\"https:\/\/getbitcoin.guide\/articles\/best-crypto-wallet\/\">choosing a wallet<\/a> works through it by threat rather than by brand.<\/p>\n\n\n\n<div class=\"msq-tool msq-check\" data-id=\"hot-wallet-hygiene\" data-verb=\" done\">\n<h3>Hot wallet hygiene check<\/h3>\n<p>Six things to settle before a hot wallet holds anything you would miss. None of them is a view on what you should own, and none of them ever involves typing your recovery phrase into anything.<\/p>\n<label><input type=\"checkbox\">Recovery phrase is offline, and has never been a screenshot, a note app entry or a file in a cloud drive<\/label>\n<label><input type=\"checkbox\">Token approvals reviewed and the ones you do not recognise revoked, which is a different button from disconnecting<\/label>\n<label><input type=\"checkbox\">Apps you no longer use disconnected in the wallet&#8217;s settings<\/label>\n<label><input type=\"checkbox\">A Ledger model from Phantom&#8217;s supported list paired, if you are keeping anything long term<\/label>\n<label><input type=\"checkbox\">A separate wallet kept for risky connections, funded with only what that one job needs<\/label>\n<label><input type=\"checkbox\">The rule memorised: no update, revoker, support agent or giveaway ever needs your recovery phrase<\/label>\n<p class=\"msq-check-count\"><\/p>\n<p class=\"msq-note\">Ticks are saved on this device only. This is a security checklist, not financial advice.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-q-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is the Phantom crypto wallet custodial?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. Phantom generates and stores the keys on your own device and gives you the secret recovery phrase, so it cannot move your coins and cannot restore them for you. That also means a loss has no customer service route back.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can anyone independently check Phantom&#8217;s code?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Only partly. The 7 June 2024 Least Authority report names the repositories and git revisions it reviewed, and treated any dependency or third party code as out of scope unless named. Phantom has said it intended to open source its BIP39 seed generation package after audits. Whether the shipping extension can be rebuilt from public source is not something that audit establishes, and we could not confirm it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does Phantom support Bitcoin as well as Solana?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. Phantom&#8217;s supported networks help article lists Bitcoin, in Native SegWit and Taproot form, alongside Solana, Ethereum, Base, Polygon, Sui and others, and lists several EVM chains as unsupported. Network settings apply to the whole wallet, including accounts added from a Ledger.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can Phantom freeze or recover coins after a theft?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. Its own help article states it cannot reverse blockchain transactions, freeze assets or recover stolen funds. Its advice is to disconnect unfamiliar apps, revoke approvals, move anything left to a new wallet and report the incident.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does pairing a Ledger stop a drainer?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Not on its own. Hardware pairing stops the key being read out of browser memory, which is the attack the lawsuit describes. It does not stop you approving a malicious transaction, because you still confirm that on the device. Reading what the device screen says before pressing the button is the defence there.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is a 1.5 Trustpilot score a verdict on Phantom&#8217;s security?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No, and treating it as one would be a mistake. It reflects 103 self selected reviews on an unclaimed, unverified profile against a user base in the millions, and most of the accounts describe phishing or malware on the reviewer&#8217;s own machine rather than a flaw in the wallet. It is useful for learning how losses happen, not for scoring the software.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<div class=\"msq-end\" id=\"ms-quiz-end\">\n<p><strong>Finished the page?<\/strong> The same five questions from the top, to see what stuck.<\/p>\n<button type=\"button\" class=\"msq-btn msq-start-test\">Test Your Understanding of This Article<\/button>\n<div class=\"msq-mount\"><\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>General information about wallet security, not financial advice. Theo Brandt holds no financial qualification and nothing here is a recommendation to buy, sell or hold any asset, or to use any yield, lending, staking or leverage product. Claims were verified on 8 October 2026 against the sources linked above. For your own situation, speak to a qualified professional.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The phantom crypto wallet keeps keys on your own device, and its own June 2024 audit excludes malware from the threat model. Here is what that leaves you.<\/p>\n","protected":false},"author":1,"featured_media":476,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","rank_math_title":"Phantom Crypto Wallet: The Threat Model It Leaves to You","rank_math_description":"The phantom crypto wallet keeps keys on your own device, and its own June 2024 audit excludes malware from the threat model. Here is what that leaves you.","rank_math_focus_keyword":"phantom crypto wallet","rank_math_canonical_url":"","rank_math_breadcrumb_title":"","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_facebook_image":"","rank_math_twitter_title":"","rank_math_twitter_description":"","rank_math_twitter_image":"","rank_math_pillar_content":"","rank_math_robots":[],"rank_math_advanced_robots":[]},"categories":[2],"tags":[],"class_list":["post-479","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wallets"],"_links":{"self":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/comments?post=479"}],"version-history":[{"count":4,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/479\/revisions"}],"predecessor-version":[{"id":784,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/479\/revisions\/784"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media\/476"}],"wp:attachment":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media?parent=479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/categories?post=479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/tags?post=479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}