Warning to those Hardware Wallet Owners

[coinrifft]

https://x.com/DarkWebInformer/status/2035830713535111501?s=20

A cyber investigator recently revealed that threat actors are selling malicious Windows wallet sniffers targeting Trezor and Ledger users. So this is a warning for those who has either hardware wallets. Expect that in the next couple of months there could be a lot of phishing on your end and there are buyers of this sniffer underground. Be careful not to trust, verify everything first as you might be the next victims.

[PrivacyG]

Could this even do any thing dangerous other than asking you to insert your Seed in the Software or spying on your Balance for an eventual wrench attack?

[KiaKia]

Your hardware wallet sucks if you have to download any app on the PC to make use of the device, just throw into a bin.

A good hardware wallet needs nothing else to function normally, you can grab them the same way you grab your smartphone and do your things.

Hardware wallets should be able to have a operating screen where transaction will be made without connecting to computer, you should also be able to upgrade the device without having to connect to a computer.

Choose your hardware wallet devices carefully.

Make sure it's fully open source, airgapped, have it's own screen for making transactions.

[Cookdata]

Your hardware wallet sucks if you have to download any app on the PC to make use of the device, just throw into a bin.

So you are saying all Trezor and other hardware wallet users to discard their wallet? This isn't appropriate.

As far I know, this is a social engineered scam, scammers will always look for vulnerability to trick people. The more security are advance, more scammers(intelligence ones) find means to trick people.

A good hardware wallet needs nothing else to function normally, you can grab them the same way you grab your smartphone and do your things.

Can you mention a good of example of hardware wallet that has compatible software together to prepare transactions and sign on the same device along with internet? I'm trying to see the difference between these hardware wallets you are taking about and original wallet software(electrum, sparrow and the rest)

Hardware wallets aren't that perfect but they are safe if you are security conscious, they can keep your private keys offline but doesn't mean you are completely free from been compromised, this report is one way anyone can lose funds because of the "connection" to their compatible software or software wallets on PC.

Airgap wallet might not be all aesthetic and quick use, but it's the best way to avoid this. Even if you manage to download this wallet sniffer on your PC, you should be able to detect this before signing the transaction on an airgap device.

You don't even need any of the hardware compatible software if use airgap wallet, your phone can create a psbt transaction with watch only wallet, and transfer it to your airgap for sign and then broadcast with your phone, easy pizy.

Words of security, if you use a hardware wallets that use a compatible software, download only from the official website, avoid softwares that are not officially release by the hardware wallet companies.

[SquirrelJulietGarden]

A cyber investigator recently revealed that threat actors are selling malicious Windows wallet sniffers targeting Trezor and Ledger users. So this is a warning for those who has either hardware wallets. Expect that in the next couple of months there could be a lot of phishing on your end and there are buyers of this sniffer underground. Be careful not to trust, verify everything first as you might be the next victims.

The screenshot show that hackers set up Telegram notifications to trap Ledger and Trezor users. Let's ignore how they do that but as users of any wallet, don't rely on notifications for wallet upgrades.

Even if you receive wallet upgrade notification by the wallet itself, you must be careful and double check at the wallet website and github repo. It happened with Electrum wallet in the past.

Electrum vulnerability allows arbitrary messages, phishing.

Relying on notifications on Telegram is even more careless but contains more risk.

[JangoUnchained]

Users errors, this is the only way that hardware users can fall victim to this scam.

People need to verify apps or software before downloading and connecting your hardware wallet through them, users need to visit the hardware wallet first to verify if there is an update for the wallet.

I have this problem of updating wallet softwares via online, I don't always like it, which is why I like how keystone is allowing users to use SD card to update their wallet instead of usb connection.

The safest update is doing it offline, just verify the update data and copy to your sdcard and insert into your wallet then update, this is one way to also maintain the act of airgapped.

[Lakai01]

Could this even do any thing dangerous other than asking you to insert your Seed in the Software or spying on your Balance for an eventual wrench attack?

Generally speaking, no.

The hardware wallets themselves—at least at this point in time—are not vulnerable to attack, so it’s not possible to extract the private key. Ledger does offer the option, via Ledger Recovery, to split the key into so-called shards and send them to third parties, who can then restore it for you if the worst comes to the worst. However, the process has not (yet) been hacked, so it is currently not possible for the shards to be extracted by any other software except Ledger Live itself.

The attacks are always the same... the user is asked to enter the mnemonic code, which is then intercepted, and they lose their coins.

[pawanjain]

Your hardware wallet sucks if you have to download any app on the PC to make use of the device, just throw into a bin.

A good hardware wallet needs nothing else to function normally, you can grab them the same way you grab your smartphone and do your things.

Hardware wallets should be able to have a operating screen where transaction will be made without connecting to computer, you should also be able to upgrade the device without having to connect to a computer.

Choose your hardware wallet devices carefully.

Make sure it's fully open source, airgapped, have it's own screen for making transactions.

If it will be able to broadcast a transaction and upgrade without connecting to a computer then it will need internet connectivity within the device itself.
If the device will have internet connectivity then it won't be a secure device.
That's the reason why we have to connect the hardware wallet to a computer so that we can broadcast the transaction to the blockchain.

[Nathrixxx]

Everyday we keep seeing new updates on some of the route in which scam and have are taking place, this make me to think of what if we are not all here on this platform, maybe some of us would have lose interest in Bitcoin because those bad actors would have taken away our assets from us all of a sudden, we may not be able to trace or know the reason why this happened except we have been in front on some of their strategies being used.

[sunsilk]

Your hardware wallet sucks if you have to download any app on the PC to make use of the device, just throw into a bin.

A good hardware wallet needs nothing else to function normally, you can grab them the same way you grab your smartphone and do your things.

We'll still use it. These hardware wallets have their respective apps that we have to download from their official sources and websites for us to use.

Aside from that, unknown sources where asks us to download is the problem here.

If you're vigilant and always verify and checks those, you're not going to fall for it. And you don't connect your hardware wallet everyday which requires to sign and verify first the transaction through the hardware wallet before sending a transaction.

You only do it, when you're about to transact and not when someone gives you a notification that there's a need of urgency for you to do it.

[coinlary]

Your hardware wallet sucks if you have to download any app on the PC to make use of the device, just throw into a bin.

A good hardware wallet needs nothing else to function normally, you can grab them the same way you grab your smartphone and do your things.

These hardware wallets have their respective apps that we have to download from their official sources and websites for us to use.

Yeah they do , but some wallets like Electrum  also supports using hardware wallets  so If you don't feel like using the official, Electrum always  got you covered.

Apart from that u need to be watchful of maalwares that could change the receiving address of your constructed  transaction before signing, I've  seen some discussions regarding that on the forum. So, always verify the details before signing anything.

[joniboini]

Blocking the usage on a Russian-based machine sounds like a weird term. What's the goal of that? To avoid trouble from the government, or are there other reasons?

But anyway, if there's malware inside your computer that can kill legitimate processes and act as a replacement for that, I expect there'll be more trouble than just losing your funds. It doesn't help that Windows is terrible with updates, too. Personally, I only use apps like Ledger Live to update firmware and stuff, so I guess I have a long time to prepare for attacks like this.

[dkbit98]

Again, this crap is only targeting users of wind0ws os, so easy solution for everyone is to make a switch to good linux os that is safe from this.
That being said, many linux distros are slowly being invaded with age verification crap, so I would choose carefully.
As for hardware wallets, update only from official links bookmarked in your browser.

[Amphenomenon]

Again, this crap is only targeting users of wind0ws os, so easy solution for everyone is to make a switch to good linux os that is safe from this.
That being said, many linux distros are slowly being invaded with age verification crap, so I would choose carefully.

The first thought that came to me reading this. Switched to Linux if you want to use your wallet on pc. I recall last year when there was a security bug update on windows 10 and now this which is just targeting only windows shows that the number of vulnerabilities on windows is many.

As for hardware wallets, update only from official links bookmarked in your browser.

Also, be cautious of what you download on your device because looking at the attack, the malware running acted like a clone of the official installed wallet to request for the seed phrase again and thereby sending this to the attacker.

Your device with your wallet should have limited used including job interviews and other means used for social engineering attacks.

[Emjay24]

Airgap wallet might not be all aesthetic and quick use, but it's the best way to avoid this. Even if you manage to download this wallet sniffer on your PC, you should be able to detect this before signing the transaction on an airgap device.

I don't really see the possibility of downloading the wallet sniffer if he goes to the original site of an open-source decentralized wallet provider and downloads from there and verify the digital signatures if any to ensure authenticity, from then on remove every connectivity feature on the computer to make it completely air gapped and ensure it never goes online again, he can safely use this wallet like Electrum with his hardware wallet to sign tx.

You don't even need any of the hardware compatible software if use airgap wallet, your phone can create a psbt transaction with watch only wallet, and transfer it to your airgap for sign and then broadcast with your phone, easy pizy.

Exactly, that is the deal and you're free from any social engineering attack. Social engineering is weakened when devices are offline.

[sunsilk]

Your hardware wallet sucks if you have to download any app on the PC to make use of the device, just throw into a bin.

A good hardware wallet needs nothing else to function normally, you can grab them the same way you grab your smartphone and do your things.

These hardware wallets have their respective apps that we have to download from their official sources and websites for us to use.

Yeah they do , but some wallets like Electrum  also supports using hardware wallets  so If you don't feel like using the official, Electrum always  got you covered.

Apart from that u need to be watchful of maalwares that could change the receiving address of your constructed  transaction before signing, I've  seen some discussions regarding that on the forum. So, always verify the details before signing anything.

Yes, we need to be mindful and always verify before signing the transaction. Also be the user who's trying to avoid any websites that are unknown and you're not downloading files that you have no idea with.

Be careful with those because that's where it's mostly coming from to infect the victim's computers unknowingly.

Being aware of these tactics from them will help to be more vigilant and cautious.

[Charles-Tim]

Everyday we keep seeing new updates on some of the route in which scam and have are taking place

This forum really helped people to be aware of and to avoid malware, but this is phishing and it is not new at all. Although, the most common one for Trezor and Ledger Nano users are the one that will require someone to put his seed phrase on a scammer website which can be used to steal the person's coins, but this one is about malware. Just avoid  phishing attack is enough against this kind of attack.

[Out of mind]

It is very important for every user that fraudsters fall into traps in different ways, so we have to be careful to avoid them. Simply put, we have to use the wallet in such a way that we do not have to face losses in the future and do not fall into the trap of fraudsters. Basically, it would be best for us not to download anything except the official source and never share the seed phrase, but we can be careful. Or if we want to be careful, we have to use a separate clean PC only for crypto, it is capable of giving us maximum security, at present we have to be careful. If we want to do something about many things, we must verify it enough at the beginning, and then everything will be done, wallet-related issues are very important.

[Outhue]

Again, this crap is only targeting users of wind0ws os, so easy solution for everyone is to make a switch to good linux os that is safe from this.
That being said, many linux distros are slowly being invaded with age verification crap, so I would choose carefully.
As for hardware wallets, update only from official links bookmarked in your browser.

I was about to drop the same, it's always windows OS, it's the most targeted OS version by hackers and scammers today, and it remains so because people are still falling victim to their tricks, it's such a shame, I wish a day will come where a secured OS will take it over from windows OS, Linux could be a better option but its complicated to use if compre to windows OS.

[Yaunfitda]

Again, this crap is only targeting users of wind0ws os, so easy solution for everyone is to make a switch to good linux os that is safe from this.
That being said, many linux distros are slowly being invaded with age verification crap, so I would choose carefully.
As for hardware wallets, update only from official links bookmarked in your browser.

I was about to drop the same, it's always windows OS, it's the most targeted OS version by hackers and scammers today, and it remains so because people are still falling victim to their tricks, it's such a shame, I wish a day will come where a secured OS will take it over from windows OS, Linux could be a better option but its complicated to use if compre to windows OS.

That is the thing though with Unix and other Unix flavor OS, it will take sometime to really understand it. And if you are not that technical, you might really dump that idea and stick to Windows OS. And that's why up to this day, 80% of users are still into it and only few who learn how to use Unix. But we have a choice here, specially if we are crypto enthusiast. Sooner or later we will be the victim, and so with that, we don't want to wait for that day. So as much as we are not comfortable with Unix, we should and really learn how to used it to our advantage and not think that it's hard and difficult.