Hardware wallets - should they still be recommended as safe?

[d5000]

If hardware wallet manufacturers and resellers had the same quality standards than other security-relevant devices (e.g. ATMs or privacy phones), then they should be considered safe. Unfortunately probably they aren't in the same quality category, according to the last incidents.

The challenge is probably that their devices have to be cheap (and thus quality control can't be that extensive like in an ATM, it would be too expensive) but the attack target (the Bitcoins a hacker could steal) is very attractive, potentially similar to an ATM's content.

Anyway I wonder if stock hardware (PCs, phones etc.) couldn't be targeted in a similar way, like with spy chips. In the current market it wouldn't be worth it probably (if a malicious company installs such chips on their devices, probably only a low percentage of their customers even would use crypto) but if Bitcoin became very popular, this is perhaps a real danger in the low price device segment. Thus, trust will always be an issue, regardless of the device, and even paperwallets are only 100% safe if you do the key generation math with pen and paper ...

So in the end, IMO there is always a very small chance that you are using a device with compromised hardware. And thus, hardware wallets are probably not significantly less safe than other devices. Personally, I do have some "bad feeling" about them, and thus I don't use them, but that may be paranoia ...

[alastantiger]

Hardware wallets may have faced a lot of hacks recently but that doesn't make them outrightly bad and not seen as a suitable option for saving bitcoin. The number of continuous hack just keeps telling and emphasising that not all hardware wallet should be trusted blindly. The issue arising here is that third parties that are having access to this wallets are the ones infiltrating into them, can’t this hardware companies look for an alternative to that, to deliver these devices to their customers directly. This will further secure the wallet and their reputation. And for this that has happened, the companies will be blamed for it and let them take actions on the third party delivery companies.

When I joined this market it was hardware wallets that everybody was talking good about and people did not even what to hear when  you talk about online wallets hence hardware wallets has always been what I knew and consider to be the best types of wallets. I have seen reason why hardware wallets are the best even though I have not used one before but it will be impossible for me to say they are now bad, types of wallet's because the things happening can also happen to other type of wallets.

Why hardware wallet is better is because of the features of the wallet and if you can afford one then buy it. Why I did not own one was because I could not afford it and then after using what I own. I fell in love with the wallet I was using and since it was a non custodial wallets and have not given me any issues, I did not think about changing it but still hardware wallets are still the best type of wallets.

[pawel7777]

(...)
If you buy a good hardware wallet straight from the manufacturer,  chances are basically zero you will lose money.

Those ledger wallet bought from a shady third party were modified hardware. It is not fair to blame ledger.

I disagree. You cannot exclude the possibility of dishonest employee(s) tampering with devices. Even if that's not the case, manufacturers do not deliver themselves. Whoever collects parcels from them (to be sent out to buyers) probably knows what kind of product they are dealing with. It doesn't take much to replace a legit device in a package with a tampered one.

And it's definitely not just a case of one "shady" reseller.
The scale of the incident seems to be much greater than initially reported. Mediamarkt (a major European electronics retailer) today decided to pull out Ledger wallets after there have been reports of people finding implants in them (bought in Mediamarkt stores at different locations):
a major European electronics retailerhttps://cointelegraph.com/news/mediamarkt-pulls-ledger-wallet-security-incident

Even our good friend Mak Karpeles is reporting on finding a spying chip on a Ledger wallet bought at Singapore airport:
https://x.com/MagicalTux/status/2109916873689280900
credit to cygan for posring this in another thread

[BitMaxz]

This part got my attention. We always advocate for an open source wallet, but not everyone can actually read the code even when it's made public and most of us, including myself, trust the review and audits done by others on the code to know how trustworthy the code is and most of the time what's mostly looked at is if there is no backdoor on the code which extract information of users etc. 

Well, most people that do not understand coding will just agree that the open-source code is safe. Actually, even if it is safe and reviewed by other people who understand the code, the hackers still can make some ways to crack it. They always scan or look for weaknesses of the hardware wallet since the hardware wallet always has OTA updates; the chances of vulnerabilities are high until the hacker finds holes to exploit and steals funds.

There's no perfect security in the online world; everything is possible if your device is connected to the internet. Buying a hardware wallet with open-source isn't enough to say you are safe. All hardware wallets can still possibly be hacked, exploited, or brute-forced.

I think those who manufacture hardware wallets, I think, scan QR codes, which is way better, I guess, way safer. At least it can't reach the internet, but it only scans QR codes to sign a transaction and generates a signed QR code and scans it to another device to broadcast the transaction.
Bluetooth or infrared are also not safe to use because on the past they generated some viruses before.

So the airgap seems more secure, one via QR code, and the hardware wallet has a summary of the transaction once it scans the unsigned transaction via QR code.

The ledger still needs to connect via USB to sign a transaction. The problem is if the device is connected to the internet or usually used online, the hardware wallet can be infected. 
So air gap would be a better solution that I think to avoid internet.

[Pmalek]

So can you atleast name few alternative cold wallets you are referring to?
I really want to see the names you have in mind.

Paper wallet, wallet on airgapped device and seedsigner. There are still one or two more that I have seen user like Pmalek posted about but I am not able to remember their names and I am unable to see the post. As I mention him on this thread, he will give you more alternatives.

I saw the tag.

Seedsigner and its fork Shieldsigner are two good options. They are stateless and airgapped. You can input your own entropy from dice rolls or coin tosses. Shieldsigner also supports smart cards like Satochip.
Another airgapped and stateless signer is Krux. Then there is Jade (can be both a classic hardware wallet and a stateless device). Other popular brands include Passport Prime, Specter, Keystone, and Keycard Shell.

[The Cryptovator]

In case you missed it, there's a fresh warning regarding one of the "official authorised resellers" of Ledger wallets going rogue and secretly installing microchips that would allow the perpetrators to steal private keys.

Are there any steps a user can take to make sure his funds on a hardware wallet are truly safe, or should they only be used like mobile phone wallets - only for storing small amounts?

Day by day it’s been becoming more risky to use a hardware wallet unless we can verify it was bought from the official website. Current Ledger hack push to think twice before using a hardware wallet. I can recall I bought my first Ledger Nano from the official Amazon Ledger store. Later bought from their official website the latest device, the Ledger X.

I have also bought Trezor from their official website. I will advise purchasing only open-source hardware wallets from the official website and creating your own seed. We can't even trust delivery companies nowadays; they might also tamper with the device or pre-generate the seed. Make sure the device is original and hadn't been tempered and that there's no pre-generated seed there.

[bitbollo]

hardware wallets have many ways to be used.
probably the worst would be something related key generation or just storing/connecting directly online.
meanwhile it's always interesting have an hardware wallet that could easily sign a tx. probably this could be the best "real use" for a bitcoiner.
or just as collectible . some of these have a niche area of interest - I have fews from various makers only for this purpose.

[Aanuoluwatofunmi]

The coldcard recent experience, together with that of Ledger, is discouraging enough, but we don't deserve to neglect our preference to use a hardware wallet if it really applies to our own condition or preference in using cold storage.

Anyone who has been consistent about this forum and always follows up with the necessary updates and information being passed across will know that Ledger is not a wallet that should have been recommended in the first place; there are so many reputable hardware wallets we can trust that are open source and reliable to use.

[m2017]

Day by day it’s been becoming more risky to use a hardware wallet unless we can verify it was bought from the official website.

The Coldcards were purchased from the official website, yet that didn't save their buyers \ owners.

Using hardware wallets is becoming riskier by the day, as malicious actors have launched a veritable "hunt" for the contents of these wallets.

Current Ledger hack push to think twice before using a hardware wallet.

This is not the only attack that prompts consideration of alternative ways to store crypto assets.

I can recall I bought my first Ledger Nano from the official Amazon Ledger store. Later bought from their official website the latest device, the Ledger X.

New crypto owners, who are far removed from technology and poorly informed about incidents (and the potential threats posed by resellers and intermediaries) are more likely to buy a HW device at a nearby electronics store (like Mediamarkt - by the way, Ledger has temporarily suspended sales to this reseller) than to go through the hassle of purchasing one from the official manufacturer.

I have also bought Trezor from their official website.

And they put their personal data at risk for 90 days (with the possibility of a data breach).

I will advise purchasing only open-source hardware wallets from the official website and creating your own seed.

But you still remain the owner of ledger HW, right?

By the way, how much do you trust this devices you bought earlier? What portion of your portfolio is stored on those wallets?

We can't even trust delivery companies nowadays; they might also tamper with the device or pre-generate the seed. Make sure the device is original and hadn't been tempered and that there's no pre-generated seed there.

It is time for HW manufacturers to rethink their device design strategy: specifically, to prevent unauthorized tampering with internal components, they should start making HW device casings out of solid metal so that the internal circuit board can't be accessed without damaging the housing. This would eliminate the risks associated with tampering by resellers, intermediaries, carriers, and delivery services. Of course, this assumes that bad actors don't figure out how to completely counterfeit the outer casing - opening the original, installing additional internal modules, and then re-encasing the unit in a replica housing. All in all, manufacturers have some food for thought here.