I am panicking

[BitcoinGirl.Club]

I just saw this video. He hacked the hardware wallet and restored the seed. Goosebumps experience for me.

Consider, I created a bitcoin wallet. I have back up seed stored in physical form.
Situation 1. My desktop has broken and I can no longer use it. Which part of the device I need to burn to destroy all information from it or keep for safety.
Situation 2. I am not going to use the laptop anymore, I have reset my windows to remove all files. Is it safe to sell it or give it away to someone to use?

Consider, I have a hardware wallet and seed is backed up safely in physical form.
Situation 1: The hardware device is not functional anymore. Should I panic and burn it to destroy the data completely?
Situation 2: How safe it is to hand out a used and reset hardware wallet to someone else who does not know the seed I had for it?

How the fuck I never considered to think of these before?

[o_e_l_e_o]

Situation 1. My desktop has broken and I can no longer use it. Which part of the device I need to burn to destroy all information from it or keep for safety.

Any permanent storage devices, which will usually be HDDs or SSDs. However, just because the desktop doesn't work doesn't necessarily mean your storage drives have failed. You can probably strip them out and use them in another machine instead.

Situation 2. I am not going to use the laptop anymore, I have reset my windows to remove all files. Is it safe to sell it or give it away to someone to use?

Probably not. Wiping a drive doesn't actually delete the data on it, it just tells the OS that the data is unneeded and it can be written over whenever needed. Unless you actually write over the data though, then it still exists after being deleted. There are pieces of software out there which will write junk data to your hard drive to make it safe, but the best option is simply to remove and keep/destroy the hard drive and sell the laptop without it.

Situation 1: The hardware device is not functional anymore. Should I panic and burn it to destroy the data completely?

If it doesn't work anymore, then what do you have to lose by destroying it?

Situation 2: How safe it is to hand out a used and reset hardware wallet to someone else who does not know the seed I had for it?

Impossible to answer because it depends entirely on the hardware wallet, and most probably haven't been audited or examined thoroughly for such an attack vector. Safer not to, just as its safer not to use a hardware wallet given to you by someone else.

[jackg]

I think for giving away a hardware wallet to someone you might not trust to try to find your funds, just find a way to encrypt the data so they can't decrypt any that's left and then wipe the device and put new data on it. (you can put something like a randomly generated private key in the passphrase box as you normally don't need the passphrase to erase a device and you've got proof it should be secure then too - mnemonics are hard to use as passphrases have length limits).

If you burn an entire device (hardware wallet or computer) you might not be sure you've actually destroyed the data. If you instead just remove solid state drives, hard drives and sd cards from the device that no longer works and burn/keep safe/destroy that, you'll be a lot safer and won't be burning things that work and can be used again/recycled.

[NotATether]

In the case of PC wiping, you can simply use any software that wipes the entire hard disk with a Gutmann 35-pass algorithm, so that tere is no chane for the data to be read except for possibly a very powerful electromagnetic reader that is only available at data recovery labs, and are most likely very expensive. The average user isn't going to bother with that hassle right after bying a used PC.

Since the hardware wallets technicaly use a linux-like operating system, you could theoretically send commands to it using some library such as libusb that executes a wipe of the hardware wallet storage devices.

[o_e_l_e_o]

I think for giving away a hardware wallet to someone you might not trust to try to find your funds, just find a way to encrypt the data so they can't decrypt any that's left and then wipe the device and put new data on it.

For the vast majority of hardware wallets, there will be no way for the average user to access its storage directly and encrypt whatever you have stored on it. Further, resetting the device and putting a new seed phrase on it does not guarantee that the old one is permanently erased.

Since the hardware wallets technicaly use a linux-like operating system, you could theoretically send commands to it using some library such as libusb that executes a wipe of the hardware wallet storage devices.

Any good hardware wallet will prevent the average user executing arbitrary code on it.

For either of these approaches, you are looking at stripping down the wallet to access the necessary hardware directly. Once you've done that, you can't really give it to someone else, and no one else should want to accept it.

[BitcoinGirl.Club]

Probably not. Wiping a drive doesn't actually delete the data on it, it just tells the OS that the data is unneeded and it can be written over whenever needed. Unless you actually write over the data though, then it still exists after being deleted. There are pieces of software out there which will write junk data to your hard drive to make it safe, but the best option is simply to remove and keep/destroy the hard drive and sell the laptop without it.

I went to a hardware shop to consult with an expert to understand basics and suggestions. According to him there are no reason for me to panic. If I want to recycle a laptop then I can just take the SSD the storage component and sell the device or throw away without any worry. In my imagination I was expecting a huge box connected to the motherboard but when I saw the size of it I was surprised, it's even smaller that those RAMs back in 2000s 😂

He does not have much knowledge about hardware wallets but in general according to him there should be a storage and I need to destroy it for safety if the device is not in use.

If it doesn't work anymore, then what do you have to lose by destroying it?

On the video the wallet device was not destroyed then?

In the case of PC wiping, you can simply use any software that wipes the entire hard disk with a Gutmann 35-pass algorithm, so that tere is no chane for the data to be read except for possibly a very powerful electromagnetic reader that is only available at data recovery labs, and are most likely very expensive. The average user isn't going to bother with that hassle right after bying a used PC.

Formatting the entire drive means wiping out everything in it or still it is possible to recover data using proper data recovery tools?

[o_e_l_e_o]

If I want to recycle a laptop then I can just take the SSD the storage component and sell the device or throw away without any worry.

Pretty much.

In my imagination I was expecting a huge box connected to the motherboard but when I saw the size of it I was surprised, it's even smaller that those RAMs back in 2000s

Yeah, they are small. Usually just a screw or two and pop it out. Just make sure you don't have more than one drive!

He does not have much knowledge about hardware wallets but in general according to him there should be a storage and I need to destroy it for safety if the device is not in use.

Which would obviously destroy the hardware wallet, since you won't be able to insert a fresh storage chip.

On the video the wallet device was not destroyed then?

Obviously not if they managed to recover it. I was assuming in your hypothetical situation you had the seed phrase and could recover the coins to another wallet. If your broken hardware wallet is your only link to your coins then obviously don't destroy it in case someone can figure out a way to recover your data.

Formatting the entire drive means wiping out everything in it or still it is possible to recover data using proper data recovery tools?

It is still possible to recover the data. As I said above, you need to write over the whole drive with junk data.

[LoyceMobile]

Situation 1. My desktop has broken and I can no longer use it. Which part of the device I need to burn to destroy all information from it or keep for safety.

Anything that stores data. This is the reason I don't claim warranty on hard drives.

Situation 2. I am not going to use the laptop anymore, I have reset my windows to remove all files. Is it safe to sell it or give it away to someone to use?

Fill the drive with random data to overwrite your own data. Easy way: Linux shred.

Situation 1: The hardware device is not functional anymore. Should I panic and burn it to destroy the data completely?

Why not just keep it in a drawer? You never know when it comes in handy.

Situation 2: How safe it is to hand out a used and reset hardware wallet to someone else who does not know the seed I had for it?

It's probably riskier for them to accept it.

Formatting the entire drive means wiping out everything in it or still it is possible to recover data using proper data recovery tools?

Formatting is like replacing the index page in a book. The rest of the data is still there.

[n0nce]

I just saw this video. He hacked the hardware wallet and restored the seed. Goosebumps experience for me.

First of all, I'd like to point out that the video (and the attack) are very old and discussed on this forum already.

Situation 2: How safe it is to hand out a used and reset hardware wallet to someone else who does not know the seed I had for it?

How the fuck I never considered to think of these before?

Since you can't pull the storage chip off the wallet, in my opinion you should never sell a hardware wallet (reset or not, doesn't matter). It's simply unsafe. Always assume that a 'wiped drive' can be at least partly restored, in most cases.
The only reason where I'd say it should be fine is if you overwrite a HDD with a few passes.

That's because SSD controllers are smart and don't allow us to e.g. overwrite specific cells (unlike a HDD that goes from start to finish), and a lot of consumer hardware, like smartphones doesn't even allow to unmount the main drive and mount it on another machine / OS to fully wipe it.

Hence I say: unless we're speaking of a HDD in an off-the-shelf PC or laptop, that you can wipe with multiple passes, don't rely on the device's data being permanently deleted.


Honorable mention: if you have some sort of full disk encryption going on (like many Apple devices), in theory tossing the keys (which is what happens when hitting 'wipe' on those) should suffice. But since I can't check how they do their encryption, I wouldn't trust sensible data to that mechanism.

Certainly don't trust Bitcoin seeds to a 'wiped' storage medium that is not a HDD which you know you wiped (overwrote) fully from start to finish multiple times.

[suchmoon]

Wouldn't it be easier to just send the coins to a new wallet so that you don't have to worry about the old seed?

[n0nce]

Wouldn't it be easier to just send the coins to a new wallet so that you don't have to worry about the old seed?

I would absolutely do that. There's no real point importing an old device's seed, in my opinion. Especially if you're worried about the integrity and secrecy of the old seed.

[dkbit98]

I just saw this video. He hacked the hardware wallet and restored the seed. Goosebumps experience for me.

It's (very) old news and we talked about it before, and I honestly don't understand why would you panic about something that was fixed long time ago.
I guess this is how sensation video marketing works... getting you with your emotions.

I have reset my windows to remove all files. Is it safe to sell it or give it away to someone to use?

Simple. Just sell it without hard drive, and you can do whatever you want with it.
You can do secure SSD deletion (encryption is created) of hard drive letter, that makes it almost impossible to recover data after that.

How safe it is to hand out a used and reset hardware wallet to someone else who does not know the seed I had for it?

It's not safe to give anyone used hardware wallet, but you can do simple thing again, send all your coins to different wallet/device  and reset your hardware wallet.
Never again use seed words from previous hardware wallet.
If you want to be sure burn your seed words, use hammer to destroy your hardware wallet, and use hypnosis to forget everything.

Wouldn't it be easier to just send the coins to a new wallet so that you don't have to worry about the old seed?

Not if you watched that video like he did  
He made everything look so complicated, along with self-advertisement.

[n0nce]

How safe it is to hand out a used and reset hardware wallet to someone else who does not know the seed I had for it?

It's not safe to give anyone used hardware wallet, but you can do simple thing again, send all your coins to different wallet/device  and reset your hardware wallet.
Never again use seed words from previous hardware wallet.

In theory, if the device does get hacked though and memory is restored, the privacy of the previous owner would be broken. For sure regarding previous transactions and potentially for future transactions, for instance if the user didn't mix their coins in the transfer from the old to the new wallet.

[Pmalek]

The video of the Trezor seed extraction doesn't really have anything to do with the questions you asked.
That hack was only possible because the owner of the Trezor still had an old firmware installed on his device. That old firmware had a vulnerability where the PIN and seed were loaded into the RAM. What Joe did was find a way to access this information to get to the seed. Since that loading of sensitive information into RAM does no longer happen with the newer firmware versions, the same type of attack would no longer work. But the chip could potentially be vulnerable to other manipulations. Kraken and Ledger hacked the Trezor as well.  

It took a hardware hacker 3 months to extract the seed. It's safe to say, that it isn't something that too many people could do. I would still not be interested in giving away or selling my used hardware wallet.  

[n0nce]

The video of the Trezor seed extraction doesn't really have anything to do with the questions you asked.
That hack was only possible because the owner of the Trezor still had an old firmware installed on his device. That old firmware had a vulnerability where the PIN and seed were loaded into the RAM. What Joe did was find a way to access this information to get to the seed. Since that loading of sensitive information into RAM does no longer happen with the newer firmware versions, the same type of attack would no longer work. But the chip could potentially be vulnerable to other manipulations. Kraken and Ledger hacked the Trezor as well.   

It took a hardware hacker 3 months to extract the seed. It's safe to say, that it isn't something that too many people could do. I would still not be interested in giving away or selling my used hardware wallet. 

It's also worth mentioning this is a device without secure chip and one of the world's best hardware hackers still spent 3 months on it. I don't think anyone should 'panic' because of that. Especially if you're in physical control of your hardware wallet.

[m2017]

Situation 1. My desktop has broken and I can no longer use it. Which part of the device I need to burn to destroy all information from it or keep for safety.

Anything that stores data. This is the reason I don't claim warranty on hard drives.

Returning your hard drive to the manufacturer (even after formatting the disk) under warranty with your seed-pharse is the last thing. Therefore, when choosing a hard drive to work with crypto, it is preferable to buy more reliable devices, despite the fact that they will be more expensive. So it will be possible to at least reduce the likelihood of a hard drive disk failure, and in this case it is better to forget about the warranty.

Situation 1: The hardware device is not functional anymore. Should I panic and burn it to destroy the data completely?

Why not just keep it in a drawer? You never know when it comes in handy.

Precisely, it can be used as spare parts in the event of a breakdown of the same device model. For some manufacturers, hardware device breakdowns have already become normal.

[LoyceMobile]

Returning your hard drive to the manufacturer (even after formatting the disk) under warranty with your seed-pharse is the last thing.

Usually, when a drive breaks, format isn't possible anymore. If it still works I'd overwrite it a few times.

[m2017]

Returning your hard drive to the manufacturer (even after formatting the disk) under warranty with your seed-pharse is the last thing.

Usually, when a drive breaks, format isn't possible anymore.

For more paranoid confidence and peace of mind, you can "format" a broken hdd with a regular hammer, as already suggested above. It is desirable to "format" the physical disk itself (a metal plate inside the hdd), because even from broken hhd, in some cases (when the disk is not damaged), it is theoretically possible to recover information.

After that, you can safely throw such a hdd into the trash without fear that someone will find it and restore your data from it.

If it still works I'd overwrite it a few times.

How about installing encrypted version linux/ubuntu on hdd, which will also make it impossible to restore the old data?

[LoyceMobile]

Instead of a hammer, I'd use an angle grinder. But even then it's theoretically still possible to find back some bits. It just became a lot harder.

Even with full disk encryption, I still wouldn't send it for warranty.

[DireWolfM14]

This topic is closely related to something that's been occupying my mind lately.  I recently bought a ColdCard, and I've spent a few hours tinkering with it before I christen it "The Hardware Wallet."  One of the things about the ColdCard that I like (it's a Mk4, btw,) is that it has a small amount of storage that can be mounted when plugged into a computer's USB port.  The storage can be used to transfer wallet files to the PC after generating them in the cold card.  When the ColdCard is unplugged all the data that was stored in said mount is automatically erased.

What I'm wondering, is if the data is just merely erased, or is completely purged?  I doubt it's overwritten, but since it appears to be RAM is it completely unrecoverable when it loses power?  The device also erases any Bip39 passphrase that's been entered when it's logged off or disconnected from power.  I wonder how secure the device's memory features are.

As for BitcoinGirl.Club's panic attack; The Trezor and it's clones have open source hardware, which is partially why they are vulnerable to this attack vector, but the risk can largely be mitigated by adding a Bip39 passphrase to your hardware wallet.  This is especially important for the Trezor wallets, and any that use their source code.  Even if the hacker is able to steal your hardware, and break into it to extract your seed phrase, there's no way for him to get to your funds if they are locked behind a strong passphrase.  I certainly wouldn't consider this a cure, more like buying you a little bit of extra time to create a new seed and transfer all the funds.

I use passphrases on all my hardware wallets now, even if they are not vulnerable to the attack vector demonstrated in that video.