ZachXBT called out Hardware Wallets

[cryptoaddictchie]

With regards to recent Coldcard and Safepal incidents. It seems that 8 cases has been recorded this year and one ongoing. An X Kol Zachxbt whose known to share compromise and hack incident shared his enthusiast and called out everyone one of them. Users make this feel unsafe! Are we expecting more news?

ZachXBT called every hardware wallet garbage on 16 July.

SafePal made it eight incidents on 16 August.

Every one of them, and how it broke 👇

→ SafePal : order-tracking plug-in
→ Trezor : fulfillment provider
→ Ledger : e-commerce partner
→ Coldcard : five year old firmware bug
→ Tangem : laser through the secure element
→ Trezor Safe 7 : laser through a different one
→ Injective SDK : hijacked npm maintainer
→ Postal phishing : printed letters with QR codes

7 of the 8 had nothing to do with the hardware.

https://x.com/0xchainink/status/2088974760931942643

[PX-Z]

It seems like, day by day, hardware wallet users are becoming increasingly exposed to privacy risks due to data breaches involving companies and third-party services in the hardware wallet connected shits. Coldcard incident is not privacy related buts the worst one.

[SFR10]

Are we expecting more news?

I wouldn't be surprised to see similar incidents against other hardware wallet manufacturers, but I really hope this is the last one, since even the privacy-related ones can endanger someone.
^{- Concerning what ZachXBT said last month, I remember he specifically named Ledger after it seemed he was referring to all HWs (FWIW, I don't consider all HWs as garbage and if you take precautions, the attack surface becomes way smaller, while there are going to be some workarounds as well).}

[Meuserna]

My hope is that all of this causes more people to take free and open source projects like SeedSigner, ShieldSigner, Krux, and Kern more seriously. These offer better security anyway, though they do require the user to learn a little more up front.

I think ShieldSigner is currently the best hardware wallet available at any price, and it's free plus the cost of a Raspberry Pi Zero, camera, LCD hat and case.

Go this route and you won't be on anybody's mailing list.

Take it a step further and generate your own random seed phrase so you'll know your seed isn't vulnerable to a ColdCard-style attack.

[Yamane_Keto]

→ Tangem : laser through the secure element
→ Trezor Safe 7 : laser through a different one

Nanosecond laser pulse attacks are specialized attacks that require hardware wallet to be lost or stolen, sent to a specialized laboratory, and cost more than $200,000. The success of these attacks is almost impossible. SafePal, Trezor, Ledger are not attacks linked to physical devices.

[dkbit98]

ZachXBT is a silly social media clown, and according to him everything purchased with leak personal information is garbage.
If he thinks this data leaks are going to be restricted only to crypto and hardware wallets, than he is a bigger idiot than I thought.

[bitbollo]

potentially hardware wallets offer more point of attack than a self custody solution.
I would see as non-sense any claims to "better entropy". I don't know how it can be possible to generate a number safer included in a range of 2^256 ... any number is already safe in this range unless you use a weak system to genearte it (or a rigged system like coldcards).
In this list I would not mix the various issues we have seen. Distributors leaks or lasers are completely different.
Probably more others could emerge in a secondary time. It has always been assumed that certain solutions are "safe" but probably it could be just an assumption