Getting a hardware wallet doesn't mean your funds are completely safe

[DonBirb]

Also buy hardware wallets directly from the source. Don't trust eBay as resellers can be scammers trying to steal your hard earned cryptocurrencies. Also plenty of replica Ledger wallets from China and they most likely have a backdoor to steal your funds. Check out this article on how someone lost life savings of $34,000 because of this:

https://news.bitcoin.com/mans-life-savings-stolen-from-hardware-wallet-supplied-by-a-reseller/

[1715030676]

1715030676

[1715030676]

1715030676

[1715030676]

1715030676

[DdmrDdmr]

<…>

I can’t recall there being fake replicas of Ledger Nanos S (I do recall a 2018 article on Fake Trezor Ones): https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7). That does not mean it can’t happen, especially if the market on a bull run, and that is why it is essential, as you say, to purchase the devices on the official seller’s site (they will list official resellers if need be).

What we have seen are sites that allegedly sell Ledgers in bulk for a very low price (you’ll probably receive nothing at all there) and people that sell a preconfigured Ledger (as is described in the 34K$ case).

[Pmalek]

I can’t recall seeing any big sheet warning of these practices along with the product, but even so, boxes get set aside and instructions are often not revisited. Perhaps the devices themselves could engrave an "only visit [url]" on the device itself to mitigate people erroneously ending-up using a fake site,

When you buy a Ledger device you get 3 recovery sheets and a a Getting Started sheet. This sheet instructs you to visit the official site to configure your new device. At least that was the case in the past.

To configure your wallet, you should visit start.ledgerwallet.com
This is the old site, it now redirects to https://www.ledger.com/start/ when you visit it.
The site shows 4 steps you need to follow to set up your wallet and Ledger Live. They even posted videos of the entire setup process.

If users would just read about 10 sentences they would understand that Ledger says:
"Write down your recovery phrase".
"Never share it with anyone".
"Store it in a secure place".

For those who have used Ledger even once must have noticed that the seed words never appear on the computer screen. They are only visible on the small screen of your device. It's the same when creating a new wallet or recovering an old one from seed.

Point of the story: Ledger will not ask you to enter your seed anywhere and will never display your seed on your computer screen. Period.

[DonBirb]

<…>

I can’t recall there being fake replicas of Ledger Nanos S (I do recall a 2018 article on Fake Trezor Ones): https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7). That does not mean it can’t happen, especially if the market on a bull run, and that is why it is essential, as you say, to purchase the devices on the official seller’s site (they will list official resellers if need be).

What we have seen are sites that allegedly sell Ledgers in bulk for a very low price (you’ll probably receive nothing at all there) and people that sell a preconfigured Ledger (as is described in the 34K$ case).

What made me think Ledger Nano replicas exist is when i saw them on eBay for 20 usd each and they had lots of sales. It was also New in Box.  I just checked and they are no longer selling them that cheap, it was few months ago when I saw them.  Or they could have bought original ones and did the custom scratch card with their own personal seed like this and sold them cheap to attract buyers:

https://news.bitcoin.com/wp-content/uploads/2018/01/ledger-ebay-scam-628x1024.jpg

Either way we should all be careful. I personally own a Ledger Blue myself and that's where i keep my crypto but i got it directly on Ledger website.  

[Lucius]

What made me think Ledger Nano replicas exist is when i saw them on eBay for 20 usd each and they had lots of sales. It was also New in Box.  I just checked and they are no longer selling them that cheap, it was few months ago when I saw them.  Or they could have bought original ones and did the custom scratch card with their own personal seed like this and sold them cheap to attract buyers:

I don't think it pays for anyone to modify hardware wallets and then sell them somewhere as originals, because apart from such modifications requiring expertise - you can never know in whose hands such a device will fall, maybe to someone who will save a BTC worth $100 on it. What I think poses a greater danger is a targeted attempt to deliver such a modified device to a person who is already known to possess a significant amount of crypto - and the ideal targets for this are those who keep their crypto online.

Of course, I'm not referring to pregenerated seed here, but to modifying the hardware that could potentially allow an attacker to take possession of the seed - yet this is still an unexplored area where hackers are certainly working.

[ranochigo]

Hardware wallets are pretty much used for just hodling imo. If I were to frequently have the need to connect it to a device, I'd rather configure a laptop or a pc with my specifications, making it my wallet which I can connect to exchanges now and then and only that, nothing else would probably be done there to prevent myself from being swept up by possible malware/virus.

For which you'll be basically making your computer a less secure "hardware wallet" for being configured specifically for cryptos.

Hardware wallets are hardly designed to be used for hodling only. It's more suited for users who want security but doesn't want to take a super cautious approach to secure their computers beyond the basics. There's absolutely no problem with connecting the hardware wallet to a computer frequently; there isn't any known exploit that could compromise your device over USB and it is likely quite hard to do so. If you really want to have a wallet specifically for long term hodling, you won't have to spend large sums of money for a hardware wallet and it's fairly easy to spin up a LiveCD for a wallet seed.

[daneal stev]

I see that all wallets, regardless of their types and shapes, are vulnerable to hacking and theft, and that wallet hacks are often due to the wallet owner making many mistakes that may be unintentionally, such as putting passwords in places inside it. Everyone's access or words are placed and stored inside the internet or mobile phone
I won a Trezor Wallet a while ago, and I hope I can use it correctly and without making any mistakes in it.

[20kevin20]

I see that all wallets, regardless of their types and shapes, are vulnerable to hacking and theft, and that wallet hacks are often due to the wallet owner making many mistakes that may be unintentionally, such as putting passwords in places inside it. Everyone's access or words are placed and stored inside the internet or mobile phone
I won a Trezor Wallet a while ago, and I hope I can use it correctly and without making any mistakes in it.

Of course, there is no perfect hot/cold storage method. All you have to do is take maximum care whenever you use your wallet and make sure that you're keeping your seeds and private keys away from any visible/vulnerable spot, and that includes the Internet. Avoid custodial stuff as well, whenever possible.

It'd not that hard once you get the hang of it. Just spare a few more seconds making sure what you're doing is right, it usually solves and helps prevent a lot of issues and possible mistakes.

[daneal stev]

I see that all wallets, regardless of their types and shapes, are vulnerable to hacking and theft, and that wallet hacks are often due to the wallet owner making many mistakes that may be unintentionally, such as putting passwords in places inside it. Everyone's access or words are placed and stored inside the internet or mobile phone
I won a Trezor Wallet a while ago, and I hope I can use it correctly and without making any mistakes in it.

Of course, there is no perfect hot/cold storage method. All you have to do is take maximum care whenever you use your wallet and make sure that you're keeping your seeds and private keys away from any visible/vulnerable spot, and that includes the Internet. Avoid custodial stuff as well, whenever possible.

It'd not that hard once you get the hang of it. Just spare a few more seconds making sure what you're doing is right, it usually solves and helps prevent a lot of issues and possible mistakes.

I agree with you, but the problem with many members is that they do the opposite and do things that put them at risk, and I know a lot of people who store their passwords on the Internet and on mobile phones. Anyone can hack their accounts or their mobile devices I tried to give a lot of advice to them but they They ignore my words. Hope I convince them that what they're doing is totally wrong and untrue.
We must think rationally and intelligently so that we can guarantee and protect our money
As you said, my friend, all kinds of hot and cold wallets are at risk of being stolen and hacked at any time

[2double0]

I have been scammed many times and learnt every time that nothing can save us from cyber crime except ourselves and our decisions. I don't trust hardware as they are also vulnerable to many attacks online (heard many cases these days), I only trust paper wallets because they can be saved at our secure places and are not prone to online attacks as all they will have is our private keys.

[khaled0111]

I only trust paper wallets because they can be saved at our secure places and are not prone to online attacks as all they will have is our private keys.

Since there is no known vulnerability or a bug affecting the most popular hardware wallets that can result in your funds being stolen, I don't see how paper wallets can be more secure than hardware wallets!
By using a hw you can sign transactions without having to disclose your private keys. However, when using a paper wallet, you will have to import the private key into a third party software and you will have to take extra precautions to ensure your private key doesn't get leaked.

[o_e_l_e_o]

Since there is no known vulnerability or a bug affecting the most popular hardware wallets that can result in your funds being stolen, I don't see how paper wallets can be more secure than hardware wallets!

Trezor devices have an unpatchable vulnerability where an attacker with access to the device can extract the seed phrase.
Ledger devices were recently found to have a (now patched) vulnerability which allowed an attacker to make the device send bitcoin when the user was interacting with their altcoin wallets, which would have allowed bitcoin to be stolen.
There are undoubtedly bugs which we do not know about yet.
Hardware wallets are better than software wallets, but do not make the mistake of thinking they are infallible.

[khaled0111]

...

Thanks o_e_l_e_o for the info. I didn't know about these vulnerabilities.
I know that there is no 100% secure device but didn't expect there were a vulnerability which allows the attacker to steal funds remotely... this is a bit concerning!

AFAIK, vulnerabilties that require physical access to the device aren't that easy to exploit.

[Rengga Jati]

Everything related to the technology maybe not perfect, there will be always kind of error. Moreover, if it still relates tot he human, the error will still exist. Like here in the choice of the wallet. hardware wallet may still have any weakness, moreover when the owner makes some mistakes about it. However, at least, it is better than the software or online wallet. At least, it has a smaller chance to lose our funds here rather than the online or software one. This is the truth. You may not be able to get 100% security, but at least, you get it better.

[Kong Hey Pakboy]

No system or technology is perfect when it comes to security features. It is why we should avoid using our hardware wallet connected on the internet for a long time because hackers could easily have accessed in our hardware wallet if we are online or connected on the internet. We should also avoid downloading unsafe apps in our computers or laptop for our hardware wallet not to be traced.

[o_e_l_e_o]

AFAIK, vulnerabilties that require physical access to the device aren't that easy to exploit.

That's true provided you keep your hardware wallet physically secure, but the fact that such an exploit exists is very concerning. Trezor One was launched in January 2014. This bug was first published in July 2019. That means that the bug was not publicly known about for over 5 and a half years, and all Trezor devices could have had their seed phrases extracted and coins stolen in that time. It is almost certain that all hardware wallets currently have bugs of various significance which have not yet been discovered or publicly disclosed. I still use hardware wallets, but just be cautious with assuming they are impenetrable and make sure you still take standard security precautions when using them.

It is why we should avoid using our hardware wallet connected on the internet for a long time because hackers could easily have accessed in our hardware wallet if we are online or connected on the internet.

This is not true. The whole point of a hardware wallet is that it can be connected to an internet enabled computer without any additional risk to your coins. Even if you plug it in to the most unsecured and malware ridden computer in existence, the most the computer can do is push a malicious transaction to the device to be signed. As long as you read what is on the screen of the hardware wallet and don't just blindly accept everything, then the transaction cannot be signed and your coins cannot be stolen.

[blckhawk]

First of all, there's no such system or hardware that is immune to any kind of scheme. It is true that having a hardware wallet gives more security than a software wallet can provide. But this is not necessarily mean your money is in 100% percent because these hardware wallets can only be managed through a computer that can potentially be hacked or get malware upon download random software. Consequently, we must must beware of downloading stuff online, get your software in the official website if possible and secure your phrases, keys, and more away from online, make sure that you'll be only one know where it is stored.

[Assface16678]

First of all, there's no such system or hardware that is immune to any kind of scheme. It is true that having a hardware wallet gives more security than a software wallet can provide. But this is not necessarily mean your money is in 100% percent because these hardware wallets can only be managed through a computer that can potentially be hacked or get malware upon download random software. Consequently, we must must beware of downloading stuff online, get your software in the official website if possible and secure your phrases, keys, and more away from online, make sure that you'll be only one know where it is stored.

There are a lot of people think that if they have already a hardware wallet is there is no chance that their funds cannot be hacked anymore which is a misconception but still we must need to take aware and keep all the things safety there are a lot of people getting confident because of this kind of hardware wallet it's useless if the user of the account or computer is always activity clicking suspicious links, download unreliable sources and using a lot of third-party software.

[Febo]

Hardware wallet does perfectly well what is meant to. Keep your private keys safe from any possible malware on your computer or phone.  But that is it. It is not a magic box that can kill all dangers your coins can get into. It can never prevent your stupidity. You need to learn what are dangers and avoid them.

[aesma]

<…>

I can’t recall there being fake replicas of Ledger Nanos S (I do recall a 2018 article on Fake Trezor Ones): https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7). That does not mean it can’t happen, especially if the market on a bull run, and that is why it is essential, as you say, to purchase the devices on the official seller’s site (they will list official resellers if need be).

What we have seen are sites that allegedly sell Ledgers in bulk for a very low price (you’ll probably receive nothing at all there) and people that sell a preconfigured Ledger (as is described in the 34K$ case).

What made me think Ledger Nano replicas exist is when i saw them on eBay for 20 usd each and they had lots of sales. It was also New in Box.  I just checked and they are no longer selling them that cheap, it was few months ago when I saw them.  Or they could have bought original ones and did the custom scratch card with their own personal seed like this and sold them cheap to attract buyers:



Either way we should all be careful. I personally own a Ledger Blue myself and that's where i keep my crypto but i got it directly on Ledger website. 

I think a cheap new ledger nano S is indeed very likely to be a preconfigured one. Some scammers are ready to invest real money, if the potential gain is huge. You can generate a new seed and it will probably be safe to use, but why take the risk ? The ledger is quite cheap bought from the manufacturer... On the same line of thinking, I can see no good reason to sell it used either.