ZachXBT called out Hardware Wallets

[cryptoaddictchie]

With regards to recent Coldcard and Safepal incidents. It seems that 8 cases has been recorded this year and one ongoing. An X Kol Zachxbt whose known to share compromise and hack incident shared his enthusiast and called out everyone one of them. Users make this feel unsafe! Are we expecting more news?

ZachXBT called every hardware wallet garbage on 16 July.

SafePal made it eight incidents on 16 August.

Every one of them, and how it broke 👇

→ SafePal : order-tracking plug-in
→ Trezor : fulfillment provider
→ Ledger : e-commerce partner
→ Coldcard : five year old firmware bug
→ Tangem : laser through the secure element
→ Trezor Safe 7 : laser through a different one
→ Injective SDK : hijacked npm maintainer
→ Postal phishing : printed letters with QR codes

7 of the 8 had nothing to do with the hardware.

https://x.com/0xchainink/status/2088974760931942643

[PX-Z]

It seems like, day by day, hardware wallet users are becoming increasingly exposed to privacy risks due to data breaches involving companies and third-party services in the hardware wallet connected shits. Coldcard incident is not privacy related buts the worst one.

[SFR10]

Are we expecting more news?

I wouldn't be surprised to see similar incidents against other hardware wallet manufacturers, but I really hope this is the last one, since even the privacy-related ones can endanger someone.
^{- Concerning what ZachXBT said last month, I remember he specifically named Ledger after it seemed he was referring to all HWs (FWIW, I don't consider all HWs as garbage and if you take precautions, the attack surface becomes way smaller, while there are going to be some workarounds as well).}

[Meuserna]

My hope is that all of this causes more people to take free and open source projects like SeedSigner, ShieldSigner, Krux, and Kern more seriously. These offer better security anyway, though they do require the user to learn a little more up front.

I think ShieldSigner is currently the best hardware wallet available at any price, and it's free plus the cost of a Raspberry Pi Zero, camera, LCD hat and case.

Go this route and you won't be on anybody's mailing list.

Take it a step further and generate your own random seed phrase so you'll know your seed isn't vulnerable to a ColdCard-style attack.

[Yamane_Keto]

→ Tangem : laser through the secure element
→ Trezor Safe 7 : laser through a different one

Nanosecond laser pulse attacks are specialized attacks that require hardware wallet to be lost or stolen, sent to a specialized laboratory, and cost more than $200,000. The success of these attacks is almost impossible. SafePal, Trezor, Ledger are not attacks linked to physical devices.

[dkbit98]

ZachXBT is a silly social media clown, and according to him everything purchased with leak personal information is garbage.
If he thinks this data leaks are going to be restricted only to crypto and hardware wallets, than he is a bigger idiot than I thought.

[bitbollo]

potentially hardware wallets offer more point of attack than a self custody solution.
I would see as non-sense any claims to "better entropy". I don't know how it can be possible to generate a number safer included in a range of 2^256 ... any number is already safe in this range unless you use a weak system to genearte it (or a rigged system like coldcards).
In this list I would not mix the various issues we have seen. Distributors leaks or lasers are completely different.
Probably more others could emerge in a secondary time. It has always been assumed that certain solutions are "safe" but probably it could be just an assumption

[PrivacyG]

ZachXBT writing these complaints and frustration on a platform that had the data of its own users leaked multiple times in the past is ironically funny.

Some of them will use mistakes as an opportunity.  Others will use that as their down fall.  If we are supposed to only use things that are never compromised or whose companies never make any mistake then we should all throw our devices and computers out through the window and never trust or use any thing else ever again.  Hell.  We should all maybe go outside and watch grass grow at that point.

[ABCbits]

Are we expecting more news?

Whether it's hardware wallet company or something else, it won't be the last incident. If you visit website such as https://haveibeenpwned.com/PwnedWebsites, such thing happen regularly.

ZachXBT is a silly social media clown, and according to him everything purchased with leak personal information is garbage.
If he thinks this data leaks are going to be restricted only to crypto and hardware wallets, than he is a bigger idiot than I thought.

I was wondering if that X post exaggerate what he said. But after searching on other news, i found this link that show his actual statement is worse.

Hot take: All hardware wallets are complete garbage and l do not advise using them for important tasks like signing transactions or storing funds.

Much better to have a separate iPhone with its only purpose being to use as your hardware wallet.

Ledger is the worst and Ledger Live has regular updates for UI / apps for no good reason that break simple actions.

(Only do this if you are not low iq)

[Lucius]

ZachXBT writing these complaints and frustration on a platform that had the data of its own users leaked multiple times in the past is ironically funny.
~snip~

He has to be a little hypocritical to survive in his job, because if he judged everyone by the same standards, he would have a hard time communicating at all. However, I don't see how an ordinary smartphone would be more secure than a hardware wallet that is open source and has developers who know what they are doing.

It is true that Ledger is garbage that should be ignored, and that the people behind coldcard did something idiotic, but it is also true that these are not the only hardware wallets that exist. Buy a hardware wallet for cash or order it at a PO Box, and protect each seed with a strong passphrase - is that something the average person can't learn and apply?

[Yamane_Keto]

I was wondering if that X post exaggerate what he said. But after searching on other news, i found this link that show his actual statement is worse.

At least he wasn't wrong about Ledger. compared to android there are a few wallets for iPhones, and ZachXBT definitely can't name 3 of them. I don't know why he prefers iPhone over android.

[X-ray]

I was wondering if that X post exaggerate what he said. But after searching on other news, i found this link that show his actual statement is worse.

At least he wasn't wrong about Ledger. compared to android there are a few wallets for iPhones, and ZachXBT definitely can't name 3 of them. I don't know why he prefers iPhone over android.

Closed ecosystem, TRNG from Secure Enclave chip, and absolutely no side loading outside EU. Android is not as secure and statistically suffer more attacks.

Though, I don't agree with his take on iphone being considered better than hardware wallets, lets not forget the fact that App store has allowed more than 26 fake wallet apps and caused millions losses.

Even recently, DeFiLlama fake app is circulating on the app store and iOS also occasionally have some critical bugs.

Just because he's famous KOL doesn't mean he's always right.

[ABCbits]

I was wondering if that X post exaggerate what he said. But after searching on other news, i found this link that show his actual statement is worse.

At least he wasn't wrong about Ledger.

Yeah, Ledger is really bad. Although i would say private key/seed can be extracted is much worse than poor UI.

I don't know why he prefers iPhone over android.

Who knows, maybe he mention the reason elsewhere, but i don't bother searching it.

I was wondering if that X post exaggerate what he said. But after searching on other news, i found this link that show his actual statement is worse.

At least he wasn't wrong about Ledger. compared to android there are a few wallets for iPhones, and ZachXBT definitely can't name 3 of them. I don't know why he prefers iPhone over android.

Closed ecosystem, TRNG from Secure Enclave chip, and absolutely no side loading outside EU.

FWIW, some android device have similar feature such as
1. phone maker usually don't release source code of their firmware or modified android OS
2. some device use device that offer TRNG
3. you can setting to prevent apps installed from source outside google play

I'm not sure it's as "secure" as iphone, but it's probably similar enough.

Android is not as secure and statistically suffer more attacks.

Such statistic have limited reliability, because some phone use outdated Android or phone maker may late when releasing security update.