Just a friendly reminder, cold wallet vs hardware wallet, Windows malware

[5W-KILO]

This is just a friendly reminder as why it's still better you invest in a open source hardware wallet first before buying your Bitcoin, things are changing so fast that if what you are using to store your Bitcoin or crypto isn't made specifically ( hardware device ) for this reasons you are taking a big risk.




https://x.com/i/status/2067653691633459575

The day you chose to get a good hardware wallet that's open source is where you mind still stop skipping when such similar news like this shows up online.

A airgapped, open source, hardware wallet is a good investment, that costs less than most mid range smartphones, how you lay your bed is how you will sleep on it.

[Charles-Tim]

Why not add the link?

According to what I found out about it, it is true:
https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/

According to Microsoft Threat Intelligence and Microsoft Defender Experts, users devices have beenn infected by the malware since February of this year.

This malware comprises of a worm component that ensures propagation and a clipper/stealer component that harvests and exfiltrates cryptocurrency wallet information.

[Alpha Marine]

I think it's unrealistic to expect people to buy a hardware wallet first before they buy their Bitcoin. As much as I agree that it is better for security, people who are buying Bitcoin newly need time to understand all these, how to get them and how they are different.
I think if they just know not to put untrusted apps, extensions, videos and things like that on their phone and don't click phishing links, etc, you should be fine, if you use a trusted open source wallet.
Using a hardware wallet alone doesn't keep you safe. There are still security guidelines you need to follow.

[Mia Chloe]

~snip

Hardware wallets are really good but honestly they are not mandatory although it's crucial that if you ever intend on getting one it's best you get an open source one. The only problem I see with airgapping is little mistakes can literally mess everything up and not everyone can walk through the process cleanly.

Nevertheless news like these sadly don't surprise me anymore and one of the reasons they'll continue to come up aside from human errors is the fact that hot wallets will always be a thing. It's similar to how people get defrauded from their banks.

[Cricktor]

I don't say Linux or MacOS is safer than Windows, but still Windows has the largest market share and is therefore very relevant and interesting for malware creators. The more users you can attack, the better. It's a rather simple logic. And because there are significantly less Linux users to attack, it's not very likely that malware will focus on a niche user group. Therefore a Linux setup is very likely a more safer one to handle your crypto stuff.

Same applies likely to MacOS users, though they may be a bit more interesting to target because they might have more money to afford the expensive Fruit gear. Frankly, I don't know if this assumption really holds water.

Why people infect their devices where they handle their crypto wallets? Likely because they use their daily driver also to handle their wallets. Not a particularly safe setup, to be honest.

Likely also some people are reckless and use cracked Windows software, games or whatnotelse on their devices where they handle their wallets. Definitely not a safe setup for sure if you run cracks or warez from shady sources.

A decent hardware wallet protects your private keys from malware. It only protects your transactions when you carefully verify ALL details of a transaction on the independant display of the hardware wallet BEFORE you sign and later broadcast the transaction. NEVER skip to check all details of your transaction carefully before you sign it. This avoids that malware replaces output addresses to ones that you didn't chose to send coins to.

[promise444c5]

This isn’t different to the famous  clipboard malware[ replace your copied address with attacker’s] and it’s quite simple to avoid.. Don’t trust, always verify.. and you will detect such. But it’s still classified as malware and could always be capable of more than just address replacement .

Thus, cold storage is very important but the ‘verify’ aspect still remains same. Remember , you can do everything right and still end up losing it all.

[salad daging]

I think it's unrealistic to expect people to buy a hardware wallet first before they buy their Bitcoin. As much as I agree that it is better for security, people who are buying Bitcoin newly need time to understand all these, how to get them and how they are different.
I think if they just know not to put untrusted apps, extensions, videos and things like that on their phone and don't click phishing links, etc, you should be fine, if you use a trusted open source wallet.
Using a hardware wallet alone doesn't keep you safe. There are still security guidelines you need to follow.

Beginners usually won't think about hardware wallets because what they think about is where to buy bitcoin safely, I used to do that too, after understanding for a few years I finally decided to buy hardware for high security again.

Yep as long as our devices are not infected with unclear applications everything will be fine, as long as you don't click too carelessly, especially in accessing phishing sites or pirated sites where there are advertisements that require you to download unclear files automatically then it needs to be aware.

As long as they understand the use of bitcoin, I think they will think about HW for their own assets.

[EluguHcman]

This is just a friendly reminder as why it's still better you invest in a open source hardware wallet first before buying your Bitcoin, things are changing so fast that if what you are using to store your Bitcoin or crypto isn't made specifically ( hardware device ) for this reasons you are taking a big risk.

I will take your advice to be a lesson for beginners to be aware of the risk of using the mobile wallets which generates and connects the recovery keys online. And with this modernity, there could be loopholes for malwares programs to penetrate in the users wallets and steal their funds or steal their personal data.
Hardware wallets makes it safer because they are offline store devices which also have the recovery keys stored online.

The news of the Microsoft with the malicious program being replaced the original wallet address of the users clip board to the scammers wallet address is neither not a new scheme.

[Catenaccio]

This is just a friendly reminder as why it's still better you invest in a open source hardware wallet first before buying your Bitcoin, things are changing so fast that if what you are using to store your Bitcoin or crypto isn't made specifically ( hardware device ) for this reasons you are taking a big risk.

Hardware wallets are best and are wallets people should aim at for storing and securing their cryptocurrency funds in long term but when they start and it's not feasible for them, they can use open-source non-custodial wallets like Bitcoin Core, Electrum wallet. Use strong passwords for encrypting their wallet files.

Then, if they want to get more security, they can use multisig (multi-signature) wallets but I would like to recommend newbies to use single signature wallet first. After they master it, they can try with multisig wallets and the principle is the same: create a wallet, make a wallet backup, test the wallet backup for recovery, and fund a wallet with small fund first. When every steps are good, it's time to use that wallet with full funds.

How to back up a seed phrase?
[LIST] Open Source Hardware Wallets.
[GUIDE] How to buy a Hardware Wallet the right way.

[uchegod-21]

Using an airgapped open source hardware wallet is good, but it is not enough to protect anyone from the security risks associate with investing in bitcoin, good security practice is the most important thing that should never be ignored. No wallet is 100% immuned to risks.

Proper backup of seeds, conscious privacy protection, and your ability to avoid scammers and phishing sites will help keep you stay protected too. No security practice should be ignored because they are all important. I wouldn't want newbies to only invest in hardware wallets and feel relaxed that they are safe.

[joniboini]

The news of the Microsoft with the malicious program being replaced the original wallet address of the users clip board to the scammers wallet address is neither not a new scheme.

Yes, we have lots of cases like this. Either a clipboard scanner, text replacer, and so on. The key is always be aware what attack vectors exist and how to avoid them. I think knowing or reading some of them would drastically reduce the chance of someone clicking some random links and getting their device compromised with a malware. Even if they use a HW and they don't bother verifying everything as said above, it'll be useless too. I think reading security news website once a day is a good habit to help (or just visit this board regularly since some of them are posted here anyway).

[BitBrainers]

Honestly the part that saves you here is the screen on the device itself. The clipper swaps the address on your PC, but your hardware wallet still shows the real address it's signing, and the malware can't touch that screen. So if you actually look at it and it doesn't match, you catch it right there before signing. That's the real reason cold storage helps with this, not just keys being offline. People still lose money though because they get lazy and just sign without reading it.

[Mitchell]

I've changed the topic title, since the old one said nothing. Feel free to improve it further.

[Outhue]

Very close to that famous clipboard malware, but your point is well understood, they can only happen on your PC/Laptops and Smartphones, and if you aren't running a crypto wallet on these devices you will be saved, it's like one threat down out of others, I still don't know why hardware wallet aren't be compulsory yet, it seems many have become a fan of those mobile wallets like Electrum wallets and others like Unstoppable wallet, I don't hate these myself but running them on a unreliable hardware device is where the problem lies, hardware wallet cuts alot of these nonsense problems away, honestly no one should be told, everyone should be running for a hardware wallet but it's fine, everyone has their choices to make.

[Obim34]

~snip

Hardware wallet is not 100% scam proof, proper wallet security, goes beyond using hard ware wallet, making use of hardware wallet is only a step ahead of one of the many things to do in order to protect our investment, while it is a solid advantage, it is not to where get relaxed.

Yet, I will advise newbies not to use Hardware wallet at first, starting with software (hot) wallet before advancing to hardware wallet, by then they should be familiar with wallet security, seed phrases protection and how to avoid online attacks.

[sokani]

Yet, I will advise newbies not to use Hardware wallet at first, starting with non custodial wallet before advancing to hardware wallet, by then they should be familiar with wallet security, seed phrases protection and how to avoid online attacks.

Stop confusing yourself, man. A hardware wallet is also a non-custodial wallet because you are in charge of the private keys. And I don't see the reason why newbies cannot kickstart their crypto journey by using a hardware wallet. Using a hardware wallet is really not that difficult.

[The Cryptovator]

Yet, I will advise newbies not to use Hardware wallet at first, starting with software (hot) wallet before advancing to hardware wallet, by then they should be familiar with wallet security, seed phrases protection and how to avoid online attacks.

I won't be agree with you at this point. I always advise everyone to practice open-source hardware wallets. For storing crypto, it's always better to do good practices. I am not saying all the wallet software is bad, but using a non-custodial software wallet is more risky than a hardware wallet. You can't ignore securing your seed phrase on both wallets; at least the hardware device will allow you to handle funds, unless you lose it or damage it.

On the other hand, let's say you lost your phone and lost the seed as well; this means you can't access your funds anymore. But if you lost your phone and seed phrase for the hardware wallet, but you still have the hardware wallet with you and it is not damaged, you can still access your funds and move to another wallet. Later you can create another seed phrase for the hardware wallet.

[ColdLava40]

The day you chose to get a good hardware wallet that's open source is where you mind still stop skipping when such similar news like this shows up online.

A airgapped, open source, hardware wallet is a good investment, that costs less than most mid range smartphones, how you lay your bed is how you will sleep on it.

Considering how expenses hardware wallets are, investors would hesitate to Invest in them first.

It's a good idea, since we need to take security to it's peak when investing in Bitcoin or cryptocurrency. But how many investors would bother about this? Some sees this kinds of news everyday but ignores them thinking it's not possible to happen to them.

Even the best still could be a victim when he's not careful, so no one should think they are in a better position. even with a hardware wallet you could still be vulnerable.

[Cricktor]

Considering how expenses hardware wallets are, investors would hesitate to Invest in them first.
...

If there are investors or users who think like this, I'd say: they are plain stupid!

Hot software wallets aren't guaranteed to keep safe due to attack surfaces of OS, browsers and whatnot software else is involved AND habits of their users, especially if those users handle their crypto wallet stuff on their daily drivers where they do all their internet shit.

Compare the cost for a decent hardware wallet to the value of your coins. I would argue that if the value of your coins exceed very few thousands of $$$, a decent hardware wallet for something around $100 to maybe max. $300-400 (for the most expensive ones) is totally justified and a no-brainer. I mean, c'mon, even as low as $2000 in coins, I'd buy e.g. a Trezor Safe 5 for $129 (excl. shipping) to have a much safer setup if properly used than any hot software wallet...

A cold wallet setup with a used decent business-grade laptop is in the same ballpark price-wise.

But hey, everybody is responsible for their own crypto and wallet security setup. People can do stupid things or can go safer paths.