Nation-States hunting for SEEDs?

[satscraper]

Heads up, crypto users.

Things are getting serious.

Ledger’s CTO has raised alarms about “zero-click” spyware attacks ^{reportedly backed by nation-states} with the aim of stealing SEED phrases stored on mobile devices. In such cases hackers can compromise your device without you clicking anything and very often through apps like WhatsApp or Signal.

It goes without saying: if your seed phrase is exposed, your wallet will be emptied.

Stay alert and vigilant.

[Charles-Tim]

Ledger’s CTO has raised alarms about “zero-click” spyware attacks ^{reportedly backed by nation-states} with the aim of stealing SEED phrases stored on mobile devices. In such cases hackers can compromise your device without you clicking anything and very often through apps like WhatsApp or Signal.

It was noticed on iPhone, iPad and MacBook this year. But this is kind of different because the vulnerability about this one is caused by Apple's incompetence and which was fixed.

Another most important part is where I saw that people should not have huge amount of coins on a wallet on their online device. You can be an expert and still have a vulnerable wallet. You can read this about it:

Apple’s crypto users have been facing serious security threats. Last month, it was revealed that a zero-click vulnerability allows attackers to compromise iPhones, iPads and Macs without user interaction. Apple released security patches across multiple OS versions to fix the flaw.

What if you are a victim before the security patches.

So I do not expect anyone to still be using any online devices to hold their coins, it is highly dangerous. But I can have little amount of coins on a mobile wallet which I can afford to lose.

[ABCbits]

FYI, the source of this attack report comes from https://www.cisa.gov/news-events/alerts/2025/11/24/spyware-allows-cyber-threat-actors-target-users-messaging-applications. They don't mention cryptocurrency or financial app, although it makes sense to also steal any crypto/fiat the victim have.

These cyber actors use tactics such as:

    Phishing and malicious device-linking QR codes to compromise victim accounts and link them to actor-controlled devices.
    Zero-click exploits, which require no direct action from the device user.
    Impersonation of messaging app platforms, such as Signal and WhatsApp.

I expect many reader wouldn't fall for 1st and 3rd tactic. But for zero-click exploit, there's little we can do aside from making sure our device OS/software is up to date.

[CryptoATM]

When will people learn that hardware wallet is still the best way to keep your crypto safe? Seeds are far away from smartphones and your computers which makes hardware wallet the best way to keep your coins safe.

A time is coming where many will learn the hardway, because as crypto keeps having more value hackers won't put a full stop to finding new ways to steal people's crypto coins.

Standalone devices have lesser chances of getting compromised.

[Charles-Tim]

When will people learn that hardware wallet is still the best way to keep your crypto safe? Seeds are far away from smartphones and your computers which makes hardware wallet the best way to keep your coins safe.

Hardware wallet that are open source and highly reputed in community like this forum, Bitcointalk are highly good, safe and secure to use, but hardware wallet is not necessary if you have a device that you can spare for airgap in which the device WiFi and Bluetooth will not function or best to be removed. Having your wallet in such device just for signing transactions through the QR code are highly recommended.

[Lucius]

Ledger’s CTO has raised alarms about “zero-click” spyware attacks ^{reportedly backed by nation-states} with the aim of stealing SEED phrases stored on mobile devices.
~snip~

The people from this company should be the last people who should use these kinds of posts in order to appear smart and helpful, but on the other hand, they threaten their users by offering them a paid service of sharing their backup with third parties. That same Ledger who talks about some kind of security will hand over the stored seed to the authorities if they ever request it.

If we take into account that some countries want access to such data, which company do you think they will attack first?

[satscraper]

Ledger’s CTO has raised alarms about “zero-click” spyware attacks ^{reportedly backed by nation-states} with the aim of stealing SEED phrases stored on mobile devices.
~snip~

The people from this company should be the last people who should use these kinds of posts in order to appear smart and helpful, but on the other hand, they threaten their users by offering them a paid service of sharing their backup with third parties. That same Ledger who talks about some kind of security will hand over the stored seed to the authorities if they ever request it.

If we take into account that some countries want access to such data, which company do you think they will attack first?

In my view his main purpose in making this tweet was to enlist as many users as possible who still use mobile devices for storing crypto, hoping that they will choose Ledger wallet rather than anything else. Whatever we might say about this company  their products remain among the most hyped in the media, so most of those users are likely to lap it up.

Regarding which company is most likely to be attacked, I think the name doesn’t matter to attackers who simply want to hit the jackpot.

[NotATether]

Step number 1 for staying vigilant - Don't use WhatsApp. I mean come on. Its problems are well-documented.  Telegram isn't that much better unless you only use E2EE chats, but I would be surprised that Signal can make the user infected like this.

Through what I understand, people can collect data on your location and other info from the cell tower you're connected to, but it eludes me how people can craft a malware that defeats the hardware security module (HSM). Is that not impossible?

[Lucius]

~snip~
Whatever we might say about this company  their products remain among the most hyped in the media, so most of those users are likely to lap it up.

All those people who will build a house on a rotten foundation are truly lost because money shapes public opinion to the point that it presents bad people and their products as something good. Unfortunately for the Ledger, we can still warn all readers on this forum not to use their devices and not pay attention to what their people are saying.

Regarding which company is most likely to be attacked, I think the name doesn’t matter to attackers who simply want to hit the jackpot.

In this case, the name means a lot, because Ledger as a company has shown that it is not capable of protecting its users, and not only that, but it has decided to expose them to even more risk by offering them the service of sharing their seed with third parties. Given that this process takes place online - user device -> Ledger servers -> external companies, hackers look for their opportunity in this more than trying to attack any other company that produces hardware wallets.

Given that it is possible to extract the seed remotely, who can say with certainty that the same action requires the user's consent and that all the seeds ever generated are not already saved somewhere? That's why I say governments (and hackers) will target this company first.

[Bitcoin_Arena]

Earlier this year, I realized how dangerous it is to store any sensitive data on those messaging apps. I had a telegram account that I barely used and one day, I decided to check into my saved message section and privacy and security. I noticed that some fool had managed to silently gain access to my Telegram account but failed to get anything salvageable. Immediately deleted the app from my phone.

I am very certain he was looking for something like passwords or private keys.

[BitMaxz]

That's why I don't save my seed or have a wallet on the phone that is always connected to the internet because there are lots of possible ways to be compromised if your phone is visible online.

The only way to avoid this is to have an extra device with no plan to connect it to the internet forever, or having an open-source hardware wallet like Trezor is always a better option to avoid those online attacks, except for seed phrase brute-force attacks, but having an extra word or passphrase can give an extra layer of security to avoid all possible attacks.

[satscraper]

In this case, the name means a lot, because Ledger as a company has shown that it is not capable of protecting its users, and not only that, but it has decided to expose them to even more risk by offering them the service of sharing their seed with third parties. Given that this process takes place online - user device -> Ledger servers -> external companies, hackers look for their opportunity in this more than trying to attack any other company that produces hardware wallets.

You are right, but there was the talk of attacks aiming to steal sensitive data stored on mobiles rather than on servers. I don’t believe that Ledger itself or their third parties involved in storing those blobs relevant to the split SEED would be so careless that keep them on mobiles. I think they use  more sophisticated setup to store such blobs.

[Lucius]

You are right, but there was the talk of attacks aiming to steal sensitive data stored on mobiles rather than on servers. I don’t believe that Ledger itself or their third parties involved in storing those blobs relevant to the split SEED would be so careless that keep them on mobiles. I think they use  more sophisticated setup to store such blobs.

I don't believe it either, but after all, who can trust what they do? All I see coming from that company are lies and deception, instead of increasing security and better devices that they could offer on the market. Personally, I would feel safer storing my private keys anywhere else than on one of their devices - and as a user of air-gapped wallets you know what it means to use one such device compared to one that communicates with remote servers and shares the most sensitive data.

Smartphones are a major security risk, there's no doubt about it - but those risks can be significantly reduced if we're careful about what we click on and have good AV installed. I personally have AV on my smartphone, but I doubt that even 10% of users have any kind of protection of that type on their smartphones.

[Forsyth Jones]

It's very simple, the government can buy software to break the encryption of old smartphones and PC or those with outdated software. The brazilian government has already bought software to break the encryption of MacOS devices and the T2 chip.

I heard that devices up to the M1 generation are susceptible to this encryption break, meaning that if you have an Apple device that is up-to-date (or more up-to-date) than the M1 chip, you are safe!

The main excuse states use to acquire this software is to arrest criminals and corrupt individuals, but I have bad news for those who actually think that. That's naive.

Moral of the story: Keep your devices updated, with at least 5 or 6 generations of hardware.

And regarding the news, who guarantees that these aren't hackers hired by the states themselves?

[Pmalek]

Don't store your seeds on a hot wallet in your phone. Don't use your everyday computer for anything money and Bitcoin/crypto related. Get a separate device only for that. Don't use your bitcoin/money device for social media, online browsing, or anything else you might do on a daily basis. Buy one or multiple quality hardware wallets and use them only with this dedicated money and crypto computer. Stay away from 99% of altcoins, especially the shitcoins.

[ABCbits]

The people from this company should be the last people who should use these kinds of posts in order to appear smart and helpful
--snip--

Some Ledger public figure frequency making warning that other ways to store cryptcurrency is vulnerable, even when the source doesn't mention cryptocurrency or other financial usage. Sometimes i feel what they actually do is fearmongering.

It's very simple, the government can buy software to break the encryption of old smartphones and PC or those with outdated software. The brazilian government has already bought software to break the encryption of MacOS devices and the T2 chip.

I heard that devices up to the M1 generation are susceptible to this encryption break, meaning that if you have an Apple device that is up-to-date (or more up-to-date) than the M1 chip, you are safe!
--snip--

It's also one of reason why some people choose software-based encryption (such as LUKS) over hardware ones. Updating software is also generally easier than buying new hardware.

[Forsyth Jones]

Don't store your seeds on a hot wallet in your phone. Don't use your everyday computer for anything money and Bitcoin/crypto related. Get a separate device only for that. Don't use your bitcoin/money device for social media, online browsing, or anything else you might do on a daily basis. Buy one or multiple quality hardware wallets and use them only with this dedicated money and crypto computer. Stay away from 99% of altcoins, especially the shitcoins.

True, doing this procedure drastically reduces the chances of being robbed by malware. Most people buy hardware wallets, but they let their guard down to the point of becoming exceptionally trusting, losing their bitcoins to malware like Clipboard Hijacker because they use hardware wallets on malware-infested computers and don't check the sending addresses.

It's also one of reason why some people choose software-based encryption (such as LUKS) over hardware ones. Updating software is also generally easier than buying new hardware.

That's great you brought up the subject. Are there any cases where Linux encryption has been broken by any of these software programs? It's always good to keep the software updated and not install junk.

[pooya87]

Speaking of state sponsored attacks, the bigger risk is centralized products like hardware wallets that this man is advertising indirectly here. And unlike what people may think, the biggest risk is not a state sponsored attack on this company's database to steal people's seeds. The bigger risk is about a state forcing them to include backdoors in the devices they sell people! Which would then give them a false sense of security while leaving them wide open for all kinds of attacks by any entity...

[ABCbits]

It's also one of reason why some people choose software-based encryption (such as LUKS) over hardware ones. Updating software is also generally easier than buying new hardware.

That's great you brought up the subject. Are there any cases where Linux encryption has been broken by any of these software programs? It's always good to keep the software updated and not install junk.

I don't remember any claim or news LUKS is broken, unless when the password is weak or encryption/decryption key generated in not secure manner. But it's worth to mention that,
1. LUKS2 is more modern and secure than LUKS1.
2. The encryption/decryption key usually stored on either RAM or CPU, which makes it vulnerable to advanced attack/hack.

[Pmalek]

True, doing this procedure drastically reduces the chances of being robbed by malware. Most people buy hardware wallets, but they let their guard down to the point of becoming exceptionally trusting, losing their bitcoins to malware like Clipboard Hijacker because they use hardware wallets on malware-infested computers and don't check the sending addresses.

If you have a separate machine only for your financial needs and operations and you use it properly, it won't get infected with malware and crypto address hijackers. You wouldn't be interacting with anything that can cause that. Worst case scenario, such malware infects your day-to-day computer and unless the malware can spread all over your network and connected devices (unlikely), the most important machine stays safe.