Someone bought a hardware wallet from Tiktok

[gmaxwell]

I think people are being a little too cocky about official sources.   Supply chain and insider attacks are real and sadly often not too hard.

As the values in question go up and the easier paths are depleted criminals will move on to fancier attacks.

The fact is that losing your funds isn't something that happens as a result of being cheap.   The most *expensive* ways to store them can be the most vulnerable.   It can be a result of poor choices, for sure, but poor choices can happen at every price level.

For those of you who just blindly buy some hardware wallet from an "official source" and trust that thats good enough-- that's being cheap.  Not necessarily with your money, but with your time and attention.

There are plenty of very frugal wealthy people-- when you have enough money to do whatever you want, figuring out how to optimize things--- often spending way more time than justified -- just becomes a new game that you can play once you're at a point where you can pay to win all the other games.

[danherbias07]

It's an important thing that will save a lot of money, and you can buy it on TikTok. Yeah, that is not right. My goodness.

Anyway, everyone on top of me has already said it, and I think we are all doing the same. Using safe software instead of buying expensive hardware. I am not saying it's wrong. It's actually very right to buy a hardware wallet because it is secure, but it must be bought from the brand name itself.

It's like buying a cheap vault from a thrift shop where you will put in all your assets. i.e., Gold and different currencies. I bet whoever sold it will trace where it will go because they know how to open it.

[BitMaxz]

That's a terrifying story. You deposit a big amount after wallet creation, and it's gone after 1hr that's very frustrating. Why didn't this guy tested it out first by holding some amount first and hold it for a week to test if the hardware wallet is not compromised? Plus, I don't trust generating seed from hardware wallet; I am more confident generating seed using the iancoleman BIP39 seed on an offline PC than using the generated one from the hardware wallet.

The bad thing that guy did was easily trust the source, even though it is not a verified distributor. There are lots of scammers nowadays on social media, and most of them are driven by AI ads. If this guy was attracted to the ads created by AI and pointed to that TikTok shop, then for me, that's suspicious.

And the weird part is how this hardware wallet easily connected to the official software, like sample Trezor by default, the Trezor Suite has its own authenticity checker before he is able to use the wallet. Most of the hardware wallets have the same feature; it's a security measure to verify if it's not compromised or fake.

So, it looks like this is an inside job. What do you think? That's what I think.

Well, I am afraid of using hardware wallets, even if they are from official sites. I am more confident in building a cold storage wallet and only use the official wallet than any 3rd party wallet software to generate seed/keys in a secured cold storage PC.

[2Pizza410000BTC]

Do you know someone who is super cheap even when they may be well-off?

Yes. Me. I’m pretty sure I live the most frugal lifestyle of anyone I know. I still negotiate everything and do as many tasks as I can myself. My food choices are usually what is on sale or having a special. I exercise with my body weight instead of at a gym. I could go on and on… I actually despise people who waste money and view them as a weak link in their bloodline.

It is good to live frugally and God himself loves those who live frugally. I also always try to live as frugally as possible. Moreover, like you, I always do my own work myself. I never leave my work to others because I can do my work as well as I can, maybe others cannot do it as well as I can, so it is always good to do my own work and there is always joy in doing my own work. However, in some cases, everything should not be taken lightly. Here a person has decided to buy or bought a hardware wallet from TikTok. I do not welcome this decision because hardware wallets should not be bought from such cheap places because this hardware wallet will have the most valuable things.

[rdluffy]

I'm in a similar situation. I own an old ledger nano, but I use it only to hold 10% of my coins while the rest is safe on Electrum. I've used this wallet for more than 8 years and never faced any problems.

My setup is also pretty simple. I use a computer that I bought solely for the purpose of holding bitcoin. Clean system, no additional software, everything is offline unless I want to send a transaction. I keep the computer disconnected from power and network all the time.

Fun fact: I know people who hold bitcoin on their online computers and have done that for 5+ years. They just keep it clean - no porn, no torrents, no pirated software.

I can't believe someone had $5m and was looking for a discounted HW wallet. It's like buying a $100k car and getting the cheapest Chinese tyres on the market.
Not to mention that their first wallet of choice was a Ledger when there are so many better options.

I can relate to your post, as I went a few years without having a hardware wallet
I created and still have some wallets from 2017 and 2018, created with Electrum, with an online computer, and they are still intact today. I preferred to keep them that way because they are wallets with not-so-high balances

I also have some wallets that I created with a simple USB stick running Tails on an offline PC, and they are still intact today

If the user takes the necessary precautions, it is possible to create secure wallets using only a USB stick and Linux, but the hardwallet makes my life much easier

In the case of this user who lost his BTC, he would probably be safer with Electrum online and without taking any further precautions  

[GreatArkansas]

There are already some official shops on TikTok right now(non-hardware wallet shop). And some of these are legit, for example official store of X authorized reseller of Trezor wallets.
And some hardware wallets have a list of authorized resellers list from their website, for example is Trezor: https://trezor.io/resellers and there you can see some of their website or link to their official store in some 3rd party e commerce store.

[CryptoYar]

This stolen crypto story is powerful warning about trying to save little money can have huge devastating consequences especially with hardware wallet. It is classic example of being cheap other than frugal. And many rich people like Warren Buffett and late IKEA founder Ingvar Kamprad are known for being frugal mindfully avoiding waste and unnecessary spending person who lost millions was cheap. They took huge risk to save small amount and that bad decision cost them everything. Frugal habits mostly help people build and keep their wealth but being cheap can lead to costly mistakes.

[Darker45]

It isn't specifically mentioned in the article that the person bought it "to save a few bucks". I doubt the buyer bought it solely because it was cheap. I guess the buyer was simply negligent.

Anyway, his/her negligence is shown not just in buying a hardware wallet via a questionable seller on Douyin but also in probably sending the entire $6.5 million at once. If not at once, he/she wasn't sending a small amount first. He/she should have made tests first.

He/she wasn't even sure the backup he/she got from the device would work. It wasn't tested either. Considering that what he/she's keeping in it is in the millions, all precautionary measures should have been taken.

[Rustam Meraj]

It isn't specifically mentioned in the article that the person bought it "to save a few bucks". I doubt the buyer bought it solely because it was cheap. I guess the buyer was simply negligent.

Anyway, his/her negligence is shown not just in buying a hardware wallet via a questionable seller on Douyin but also in probably sending the entire $6.5 million at once. If not at once, he/she wasn't sending a small amount first. He/she should have made tests first.

He/she wasn't even sure the backup he/she got from the device would work. It wasn't tested either. Considering that what he/she's keeping in it is in the millions, all precautionary measures should have been taken.

Yes exactly buyer was very careless and did not follow basic security rules. It was huge mistake to buy hardware wallet from unverified seller on Douyin. Smart person would have also sent small test amount first instead of transferring all $6.5 million at once. Plus they should have checked if backup for wallet worked before putting such large amount of money on it. All of these actions show buyer did not understand how to safely handl large amount of cryptocurrency.

[gmaxwell]

Smart person would have also sent small test amount first instead of transferring all $6.5 million at once. Plus they should have checked if backup for wallet worked before putting such large amount of money on it.

I don't think we have any information if they did those things or not.

Sending a small amount does not work.  Even for leaked private keys where there is a lot of theft competition the theives hold off and don't steal small amounts.

For something like a backdoored wallet where there should be no competition there is just no reason for the thief to be hasty.

buyer did not understand how to safely handl large amount of cryptocurrency.

No one does, but especially people who think they know actually know the least.

[tottong]

To save a few bucks someone decided to buy a hardware wallet from a questionable non-official source.
I guess that didn't turn out to be such a great idea.

Do you know someone who is super cheap even when they may be well-off?

There is nothing wrong to buy something on social media but before buying it we need to check first.
I am sure he does not really understand so that the purchase is not the best because sometimes people are tempted by cheap prices instead of seeing the quality of the product.
For people who have quite a large amount of assets in Crypto should not be too difficult to buy hardware wallets from official sources and this looks strange to him who is too easy to believe in unofficial sources.

The most important part of this case is that the uncavity will always have a risk impact and he should be able to avoid the problem.
The idea always thinks of looking for cheap ones not at the quality stage so that someone actually experiences problems.

[headingnorth]

I think people are being a little too cocky about official sources.   Supply chain and insider attacks are real and sadly often not too hard.

As the values in question go up and the easier paths are depleted criminals will move on to fancier attacks.

The fact is that losing your funds isn't something that happens as a result of being cheap.   The most *expensive* ways to store them can be the most vulnerable.   It can be a result of poor choices, for sure, but poor choices can happen at every price level.

For those of you who just blindly buy some hardware wallet from an "official source" and trust that thats good enough-- that's being cheap.  Not necessarily with your money, but with your time and attention.

There are plenty of very frugal wealthy people-- when you have enough money to do whatever you want, figuring out how to optimize things--- often spending way more time than justified -- just becomes a new game that you can play once you're at a point where you can pay to win all the other games.

I think the best way to neutralize any such threats is to format or installing/reinstalling the firmware
(downloaded from the official source) immediately upon receiving the hardware wallet, before using it.

Do that even if your hardware wallet was delivered from the official source. So then you have
eliminated any tampered firmware that might be on there, before putting your funds on it.

If I'm not mistaken reinstalling or updating firmware completely overwrites the previous firmware.

[gmaxwell]

Unfortunately that really only works against lazy attacks-- but since lazy is good enough for the moment perhaps it's enough.  It's certainly better than *not* doing it.

The earliest hardware wallet 'hacks' were to simply shove a piece of paper in with the wallet: "For your security we have pre-generated the following secure seed phrase.  To use your wallet recover this phrase:". As time went on and people wised up the attacks have become more sophisticated.

Well designed malicious firmware can just pretend to upgrade and then not upgrade, or it can maliciously patch the incoming stuff.

Similarly, so far most hww hacks known have worked by tampering with seed generation (either in the simple way of that paper or more fancy means)-- and you can escape that by using dice/coin flipping to generate your seed manually.   ... But again this is really only a defense against lazy hacks--  more sophisticated hacks can exfiltrate your key material through the nonces in your signatures.


Using any product marketed for 'crypto' creates a distinctive risk of supply chain attacks.  In my view they should only be used with multisignature/threshold crypto along with another device, preferably one not sold or marketed to cryptocurrency use.

IMO you're better off using bitcoin core as an offline signer on an old laptop then any of the HWW products available, as at least there isn't any significant supplychain attack vector.

[headingnorth]

The earliest hardware wallet 'hacks' were to simply shove a piece of paper in with the wallet: "For your security we have pre-generated the following secure seed phrase.  To use your wallet recover this phrase:". As time went on and people wised up the attacks have become more sophisticated.

Well designed malicious firmware can just pretend to upgrade and then not upgrade, or it can maliciously patch the incoming stuff.

Wow that is devious. To potentially mitigate that threat I would take the extra step of formatting
or doing a factory reset before reinstalling firmware.

As another precaution put a smaller test amount of funds on the wallet and wait a few days. If it disappears then you know
it is compromised. The test amount should be enough for them to take the bait, maybe a couple hundred dollars or more.

Using any product marketed for 'crypto' creates a distinctive risk of supply chain attacks.  In my view they should only be used with multisignature/threshold crypto along with another device, preferably one not sold or marketed to cryptocurrency use.

IMO you're better off using bitcoin core as an offline signer on an old laptop then any of the HWW products available, as at least there isn't any significant supplychain attack vector.

Definitely. Hardware wallets with altcoin support are especially vulnerable to attack.
The number of attack surfaces goes up exponentially. The report says the victim lost $6.9M in crypto,
no mention of bitcoin. Another reason why I don't mess around with shitcoins.  

[adaseb]

Honestly if this was shown on TikTok, I am betting that its most likely fake. They show anything there for views.

You can make a video, "How to use a bitcoin hardware wallet" or you can make a video "I got scammed $7M by using a bitcoin hardware wallet" which video do you think will get more views?

Either way. When it comes to hardware wallets you need to buy from the official store. The scary part about this is what happened a few years ago when they had that leak. So what do you do? People want to buy on Amazon instead and there is some risk there. So you need to verify the firmware is legit and make sure that it wasn't tampered with. The most obvious is if they include a sheet of paper and they want you to use the seed words they chose for you, those are still happening these days.

[Furious 7]

In the end, it is important for us to be more careful because not only are we guarding our assets from theft in the form of subtle or crude words but nowadays thieves are outsmarting us with several options as happened in the case that OP narrated.

He could have had around $6.9 million but he couldn't really afford to buy a wallet from an authorized source which makes this not a little ridiculous but even a very reckless act.
In addition, looking at the twitt given saying the cold wallet is not secure and as if this came from his wallet being hacked is even more ridiculous because we know the original context of the victim not buying a wallet from an official distributor which ended up with an unofficial source that his wallet was compromised which made him lose his money.

[hero_the_bossman]

Honestly if this was shown on TikTok, I am betting that its most likely fake. They show anything there for views.

You can make a video, "How to use a bitcoin hardware wallet" or you can make a video "I got scammed $7M by using a bitcoin hardware wallet" which video do you think will get more views?

Either way. When it comes to hardware wallets you need to buy from the official store. The scary part about this is what happened a few years ago when they had that leak. So what do you do? People want to buy on Amazon instead and there is some risk there. So you need to verify the firmware is legit and make sure that it wasn't tampered with. The most obvious is if they include a sheet of paper and they want you to use the seed words they chose for you, those are still happening these days.

I definitely agree, the headlines are everything on Socials, Ticktock or not.

And buying from officials is a most, from a trusted vendor if possible, otherwise, the risks will always be there.. I would even say they are never at zero, but still

[X-ray]

To save a few bucks someone decided to buy a hardware wallet from a questionable non-official source.
I guess that didn't turn out to be such a great idea.

They trusted a sealed wallet from TikTok, and it cost them $6.9M


Do you know someone who is super cheap even when they may be well-off?

Frugal living is great to save money but being cheap on something that determines whether they gonna lose their millions of money or not seems plain dumb to me.

If i have 6.9 million dollar, I'd be willing to pay $100k to make sure it's safe and not getting hacked. Can't be cheap on something like this otherwise you gonna lose it all.

Once again it's reminder to buy from hardware maker directly when it come to something like this, even if the shipping fee costs a ton.

[fikrett]

To save a few bucks someone decided to buy a hardware wallet from a questionable non-official source.
I guess that didn't turn out to be such a great idea.

They trusted a sealed wallet from TikTok, and it cost them $6.9M


Do you know someone who is super cheap even when they may be well-off?

Frugal living is great to save money but being cheap on something that determines whether they gonna lose their millions of money or not seems plain dumb to me.

If i have 6.9 million dollar, I'd be willing to pay $100k to make sure it's safe and not getting hacked. Can't be cheap on something like this otherwise you gonna lose it all.

Once again it's reminder to buy from hardware maker directly when it come to something like this, even if the shipping fee costs a ton.

ESPECIALLY when you have so many funds to guard, basically.

I am not tired by the times we see how many funds just poof due to such factors..

[Z-tight]

I prefer setting up an airgapped wallet myself, rather than buying a hardware wallet. If you have the knowledge of making a device truly airgapped, then i would recommend it over a hardware walet, all you need do is to create a complementary online watch-only wallet to view your balance, create transactions and broadcast them to them network. Your seed never leaves the offline device and is never connected to the internet. Too bad for this person to lose this huge amount of money when trying to secure their funds better.