Loss of assets in hardware wallets?!

[Walter66]

Hello. I'm just thinking about buying a hardware wallet and I'm a bit skeptical and inexperienced in this field. I used coinomi until now.
I have three questions. Help me please.

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet? I know that should not buy a second-hand hardware wallet and should buy it from the manufacturer or its authorized representative. I mean, is it possible that the manufacturing company (like Ledger, safepal or whatever) tampered with the product from the first? For example, in the production line. For example, the manufacturing company may have stored the words of the device, and after someone makes a purchase and transfers the balance to the hard wallet, the manufacturing company steals them. Has anyone ever reported that they lost their cryptos stored in hardware wallets?

2- How do I know that the words I received will not be assigned to another user after some time in a hot or cold wallet?

3- I want to buy ledger nano s plus or safepal s1.  which one is good? (I only want for bitcoin)

please guide me.
Thank you very much

[Lucius]

~snip~

1. People lose their cryptocurrencies regardless of how they store them, whether it's hacking a CEX, downloading a fake wallet, clipboard malware, or exposing their backup or maybe losing it after a while. When it comes to HW, there is always the possibility that at some point someone malicious did something wrong, which means that it could be someone in the factory or the one who delivers the package.

As far as I know, none of the companies that have gained a reputation have ever been accused of such things, but when it comes to HW, people mostly lose their cryptocurrencies because they enter seeds into fake wallets or are victims of clipboard malware that changes the coin address without them knowing.

2. You can't know that, the only thing you can do is trust that the company you bought the device from has no bad intentions. However, if the device is open source, then I think there is a possibility to verify the method by which the seed is created, i.e. that this method is safe and random.

3. For me, Ledger lost its reputation a long time ago, which you can read about in many threads in this board, and as for the second choice, I can't say anything because I'm not familiar with how good or bad it is. The prevailing opinion right now is that best HW for Bitcoin is Passport, which of course has a price that you should be ready to pay.

[Faisal2202]

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet? I know that should not buy a second-hand hardware wallet and should buy it from the manufacturer or its authorized representative. I mean, is it possible that the manufacturing company (like Ledger, safepal or whatever) tampered with the product from the first? For example, in the production line. For example, the manufacturing company may have stored the words of the device, and after someone makes a purchase and transfers the balance to the hard wallet, the manufacturing company steals them. Has anyone ever reported that they lost their cryptos stored in hardware wallets?

I think it is possible for the manufacturers to tamper with their products. But till now I haven't heard or read any news about which someone who bought a ledger, and safepal from the official platforms and faced hacking issues. Plus after reading the policy of Ledger hardware wallets, you can claim the warranty within the timespan of 2 years if your wallets do not follow conformity. Point is, you can claim a defected hardware wallet but I think you can not claim the funds that you lost in that defect wallet.

2- How do I know that the words I received will not be assigned to another user after some time in a hot or cold wallet?

The words cannot be same, as ledger uses true random number generator (TRNG). Point is you have to understand how seed phrases are generated to get the answer to your query. Small explanation is, there are 2048 words from which different words will be made and if you are using a 24 words (seed phrase) then the combination is 2048^*24. Which is equals to 3,320,769,675,556,062,850,796,210,216,064,294,951,921,238,704,640,860,049,951,290,741,255,962,051,166,208
Now, it depends on the random number generator you are using. As if you are using hardware wallets then those wallets come with their own random number generators to provide the element of uniqueness.
And for claim purposes, you can use the ledger's policy

Your recovery phrase is unique. It is only communicated to you once when your Ledger Product is first activated. It consists of a random sequence of 24 words.

3- I want to buy ledger nano s plus or safepal s1.  which one is good? (I only want for bitcoin)

I think safepal is better than ledger as ledger hardware wallet provides a feature of recovery option which means they must have inscribed some type of code in the hardware wallet that could let them in or any other entity. The point is it hurts the main meaning of using a hardware wallet. But there are many features that are not present in Safepal but are present in Ledger. For example the following features.

https://www.crypto-hardware.com/compare-hardware-wallets/

[m2017]

Hello. I'm just thinking about buying a hardware wallet and I'm a bit skeptical and inexperienced in this field. I used coinomi until now.
I have three questions. Help me please.

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet? I know that should not buy a second-hand hardware wallet and should buy it from the manufacturer or its authorized representative. I mean, is it possible that the manufacturing company (like Ledger, safepal or whatever) tampered with the product from the first? For example, in the production line. For example, the manufacturing company may have stored the words of the device, and after someone makes a purchase and transfers the balance to the hard wallet, the manufacturing company steals them. Has anyone ever reported that they lost their cryptos stored in hardware wallets?

There are cases when people lost their crypto stored in a hardwarewallet, but the cause of these losses was always the owner of the wallet. I want to say that at this moment there are no known cases of hacking of HW devices. Except when this was done by engineers to identify vulnerabilities (like a bounty program), but all these vulnerabilities were eliminated.

It is possible that the manufacturing company initially interfered with the product and left the opportunity for subsequent access to all crypto assets of all users of their devices. This can't be verified due to the closed source code, for example, from Ledger. In theory, this is possible, but in practice, so far, no such cases have been identified (this doesn't mean that this can't happen in the future).

2- How do I know that the words I received will not be assigned to another user after some time in a hot or cold wallet?

No way.
You will know about it, but it will be too late to change anything.

3- I want to buy ledger nano s plus or safepal s1.  which one is good? (I only want for bitcoin)

please guide me.
Thank you very much

Both of these options are closed source (exactly what scares you). There are other HW devices on the market. Look on their side, not this garbage.

[Meuserna]

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet?

All the time, but it's not the hardware wallet's fault.  A hardware wallet is irrelevant if somebody finds your seed words.

Your seed words are your keys.  Let's say you mention to somebody that you own Bitcoin and they go snooping in your home to see if they can find where you hid your seed words.  If they find 'em, they can put your words in their wallet to get access to your coins.

Hardware wallets are awesome, but even if you own one, you still have to secure your seed words.

3- I want to buy ledger nano s plus or safepal s1.  which one is good? (I only want for bitcoin)

DON'T BUY A LEDGER.

Ledger is adding key extraction APIs to their wallets, which means they're not truly safe anymore.  Ledger says their key extraction code won't work with the Nano S, but their code isn't open, so they can't prove it.  Don't trust closed-source code.  Seriously, take it from somebody who owns Ledger wallets: don't buy a Ledger.  They've become untrustworthy.

I'm not familiar enough with SafePal stuff to say whether it's good or not, but Ledger has become a terrible company.

[Yamane_Keto]

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet? I know that should not buy a second-hand hardware wallet and should buy it from the manufacturer or its authorized representative. I mean, is it possible that the manufacturing company (like Ledger, safepal or whatever) tampered with the product from the first? For example, in the production line. For example, the manufacturing company may have stored the words of the device, and after someone makes a purchase and transfers the balance to the hard wallet, the manufacturing company steals them. Has anyone ever reported that they lost their cryptos stored in hardware wallets?

If you are skeptical, there is an option of setting up a multi-signature wallet, as you will not have to trust a single manufacturer and thus there is less possibility that more than one manufacturer will be scammer, but I do not know if you have sufficient knowledge to do this.

You can set up cold storage so that you can ensure that you do not need to buy a hardware wallet, but the main purpose of hardware wallets is to reduce complexity in exchange for giving you relative security, as long as you buy a reliable hardware wallet from the manufacturer, verify everything, and use it on a clean computer (new device or delete your old OS with a new open source OS used only with the hardware wallet) then you will be safe. knowledge will not harm you. Start reading more about Bitcoin and cold storage, and when you are ready, your security will be taken to a higher level.

[BitMaxz]

The first question could be possible since you mentioned ledger as we all know ledger wallets do not have open-source code we do not know what exactly happening on the device itself.

However, if you do not trust any of these manufacturers you can set up your own hardware wallet like the above said you can set up a cold storage like Electrum.
Actually, I do not trust any of the hardware wallet manufacturers even if it is open-source code or not. It all depends on how we protect our wallet from any attacks.

[LoyceMobile]

Hardware wallets have risks, but they're several orders of magnitude saver than using Coinomi or any other hot wallet.
And with both, people have been scammed by simply entering their seed phrase into a phishing site.

[m2017]

Hardware wallets have risks, but they're several orders of magnitude saver than using Coinomi or any other hot wallet.

Storing crypto on any wallet is fraught with risks: be it an accidental bug in the program code or a backdoor left by a developer in a closed-source hardware wallet. The question is where the risks will be minimal. Certainly not on a closed source device, or are we still overestimating the value of open source code? Here, too, there may be errors in the code, allowing to lose crypto assets.

And with both, people have been scammed by simply entering their seed phrase into a phishing site.

But in this case, the loss was not due to a “bad” device, but due to the gasket between the monitor and the chair.

[NeuroticFish]

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet? I know that should not buy a second-hand hardware wallet and should buy it from the manufacturer or its authorized representative.

Yes. PS. The HW keeps only seed, not the actual coins.

I mean, is it possible that the manufacturing company (like Ledger, safepal or whatever) tampered with the product from the first? For example, in the production line. For example, the manufacturing company may have stored the words of the device, and after someone makes a purchase and transfers the balance to the hard wallet, the manufacturing company steals them. Has anyone ever reported that they lost their cryptos stored in hardware wallets?

It is possible they would tamper, but quite unlikely too. No reports on that direction anyway (and it would not be easy to prove either).

2- How do I know that the words I received will not be assigned to another user after some time in a hot or cold wallet?

It's not "assigned". Even more, if your HW already has a seed, be wary.
However, you can generate new seed whenever you want (just make sure you keep safe the seed you have money on and not another seed words) and the chance of collision with somebody else's seed is so small it can be safely considered 0.

3- I want to buy ledger nano s plus or safepal s1.  which one is good? (I only want for bitcoin)

I have a Nano S. No issues for years. But: since then Ledger has proven itself risky in handling users' addresses. Since then Ledger came with "seed recovery" feature I am not comfortable with.
So.. choose wisely.
Even more, if you are afraid the manufacturer would tamper with the device, you may also consider adding to the list SeedSigner. It's not a HW "by the book" (for example you will have to do some actions and generate the seed yourself), also I don't own one yet, but imho it worth a look.

[dkbit98]

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet?

Yes.
You can lose anything even if you keep it in most secure place in the world, if you give the keys (seed words) to someone else.

For example, the manufacturing company may have stored the words of the device, and after someone makes a purchase and transfers the balance to the hard wallet, the manufacturing company steals them. Has anyone ever reported that they lost their cryptos stored in hardware wallets?

Not from direct sales, but anything that has closed source firmware could do that in theory because you can't verify the code.

2- How do I know that the words I received will not be assigned to another user after some time in a hot or cold wallet?

You are not receiving anything with wallet, you should be the one who is generating random seed words.

3- I want to buy ledger nano s plus or safepal s1.  which one is good? (I only want for bitcoin)

Both of them are bad, but safepal is probably one of the worst hardware wallet, closed sourced and dirt cheap junk.
New model Safepal X1 could be a bit better, but it's still new and I wouldn't risk it until I see some reviews.
I am only recommending hardware wallets with open source firmware, that can be Passport, Jade or Bitbox if you only want to use it for storing Bitcoin.

[The Sceptical Chymist]

3- I want to buy ledger nano s plus or safepal s1.  which one is good? (I only want for bitcoin)

I'm just going to reply to this part of your question list and suggest NOT buying any Ledger wallets either.  They probably still are the leader in the HW wallet space, but after their Recover "option" debacle I'm not sure how long they're going to maintain that standing, nor do I trust them anymore.  If they can access your private keys, forget about it.  The same is probably true of other HW wallets with secure elements (or so I've heard) regardless of whether the code is open source or not....but I don't know.  I'm done playing around with them altogether.

If you read Ledger's subreddit, you'd think coins are lost from their wallets all the time, but I think in most cases it's due to operator error.  As far as any of them getting hacked, none of the big brand name ones have.  Not sure about any scams going on with the crappier ones sold on eBay and the like, but just be careful and read up on what's available before making a purchase--and not just forum posts, either.

[NotATether]

1- Has anyone ever lost cryptocurrencies stored in a hardware wallet? I know that should not buy a second-hand hardware wallet and should buy it from the manufacturer or its authorized representative. I mean, is it possible that the manufacturing company (like Ledger, safepal or whatever) tampered with the product from the first? For example, in the production line. For example, the manufacturing company may have stored the words of the device, and after someone makes a purchase and transfers the balance to the hard wallet, the manufacturing company steals them. Has anyone ever reported that they lost their cryptos stored in hardware wallets?

There are a few ways without even connecting your wallet to a device.

First one is if you store your seed phrase on a cloud service and it gets hacked, then you've been drained.

Second is if you by accident use a seed phrase generated with weak random numbers, such as the one generated by the private key 1, 2, 3, ... and there are automated sweepers running on hackers' computers to steal these funds automatically.

Third, if the hardware device has a vulnerability that lets someone extract things like PINs, decryption keys etc. wirelessly.

PS. just like everyone else said, do not buy a ledger wallet, it is no longer a cold wallet because they admitted it is possible to extract the seed phrase from the secure chip.

[satscraper]

I would add the forth point to those three emphasized by NotATether. Using your hardware wallet's SEED phrase to create accounts with alternative  wallets could  also threaten  your stash as those wallets from other developers/manufactures may have backdoors, be compromised or just imitate the real stuff.

Each wallet should rely on its own SEED.

[sokani]

- Has anyone ever lost cryptocurrencies stored in a hardware wallet?

A hardware wallet is the most secured and reliable place to store your crypto assets, however you can lost your funds by connecting it to a malware infected computer. A malware could target your clipboard and replace the copied address with the hacker address.

I mean, is it possible that the manufacturing company (like Ledger, safepal or whatever) tampered with the product from the first?

Your crypto assets are safe when you buy directly from the manufacturing company or through its authoritized vendors. Never buy from any online merchant like Amazon, ebay etc. because the hardware wallet could be tempered with. Here's a story of a victim who lost his funds through the hardware he bought on ebay.