Another month, more news about hardware wallet incidents. A sad recurrence.

[greysonz]

We're facing a major crisis of trust in hardware wallets, which until relatively recently were considered the best way to store your bitcoins. Look at the picture and you'll see a new incident every month. And which wallet will we hear about in November? I'd prefer none at all. And if hardware wallet manufacturers don't take action now, the list will go on. They need to know every detail of their assembly lines and undergo code audits, both with the help of the latest AI models and with the help of specialists.
Mistakes are too costly.
And unfortunately, the ones who pay for them are the users who were careful and survived crises and market crashes.


https://x.com/SolanaSensei/status/2114257912424227152

[Upgrade00]

The recurrent problem with most cases is data leaks, some have suggested actions like anonymous shipping, which should be live in EU now for trezor users, if they kept to their timeline. This protects sensitive date from being available to multiple parties and potentially get leaked.

The issue with most consequence however is ones like the device tampering or faulty seed generation that directly leads to loss of funds without the user being able to protect themselves. Situations like that should never occur and it's down to the service to make sure that they do not. They should have open source codes and key guidelines for users to do after purchasing.

[Pmalek]

The core assumption hasn't changed. Hardware wallets remain a good and safe way to store your bitcoin and crypto. Other factors that can affect your security and privacy have changed, though. You can buy your device online and your data can leak. That affects your privacy, not the security of your coins. You can buy a modified device like we saw with Ledger and suffer financial losses. That affects the security of those units only. These things can be avoided, either with share luck or different planning (for buying and shipping hardware wallets).

The worst fu**up of all those cases mentioned is Coldcard. Their users did everything they could and should have and still lost money. The only other thing they could have done if they knew how to was to inspect the publicly available code, but no one did it properly. Coldcard's actions directly impacted the problems the users suffered. In all the other cases, it was an outside party that caused problems.

[greysonz]

The core assumption hasn't changed. Hardware wallets remain a good and safe way to store your bitcoin and crypto. Other factors that can affect your security and privacy have changed, though. You can buy your device online and your data can leak. That affects your privacy, not the security of your coins. You can buy a modified device like we saw with Ledger and suffer financial losses. That affects the security of those units only. These things can be avoided, either with share luck or different planning (for buying and shipping hardware wallets).

The worst fu**up of all those cases mentioned is Coldcard. Their users did everything they could and should have and still lost money. The only other thing they could have done if they knew how to was to inspect the publicly available code, but no one did it properly. Coldcard's actions directly impacted the problems the users suffered. In all the other cases, it was an outside party that caused problems.

Then we can compare the situation to what happens during an immune system test: the body gets sick, but then recovers and becomes stronger.
Perhaps I was too critical about hardware wallets, and perhaps this is all just a phase of their strengthening. And you were right to mention Coldcard, clarifying the details. And I want to add that they reacted completely inappropriately to the wave of hate in the comments.
In their situation, they should have remained as open as possible, but they chose this:

[The Cryptovator]

Perhaps I was too critical about hardware wallets, and perhaps this is all just a phase of their strengthening. And you were right to mention Coldcard, clarifying the details. And I want to add that they reacted completely inappropriately to the wave of hate in the comments.
In their situation, they should have remained as open as possible, but they chose this:

Everyone should be critical about their funds, so when funds have been stored into the hardware wallet, it means we have to be critical about the hardware wallet as well. Since incidents happen, they should be friendly enough to support and hear back from their users. Banning on social media won’t be a wise decision at all.

Back to the main post; it’s really disappointing how hardware wallets users have been suffering nowadays. If this kind of accident keeps happening, then how may we secure your funds? To be honest, these hardware companies should be more careful and open for discussion. How would we avoid such incidents? They shouldn’t store users' data to avoid leaking it and shouldn’t assign any reseller where it's even hard to trust delivery companies.

[Zaguru12]

Back to the main post; it’s really disappointing how hardware wallets users have been suffering nowadays. If this kind of accident keeps happening, then how may we secure your funds? To be honest, these hardware companies should be more careful and open for discussion. How would we avoid such incidents? They shouldn’t store users' data to avoid leaking it and shouldn’t assign any reseller where it's even hard to trust delivery companies.

I wouldn’t talk about the seed generation vulnerability with coldcard and the tampering of the ledger hardware wallets because this were rare cases that I would advice any one using any of this wallets should seriously consider throwing them away.

As for the data leaks I still understand why hardware wallets still do not seems to learn and stop keeping users data stored in their server but this to me should be a lesson to many buyers of hardware wallets to learn how to use burner details like throway emails, not giving the courier or the company your home address rather using Post offices very close to you or any company address not related to you, such that in case there is a data leak, the wrench attackers do not find themselves to your home or office.


Then another important thing I think most of us need to look into is trying to build our own cold wallets using airgapped device which we can make ourselves and getting this devices will definitely not be more expensive than getting an hardware wallet. One can use any of the reputable software wallet wallets that supports cold wallet like electrum although they are not totally free from vulnerabilities themselves but they are definitely better off than hardware wallets with reoccurring leaks of data and other informations

[Pmalek]

How would we avoid such incidents? They shouldn’t store users' data to avoid leaking it and shouldn’t assign any reseller where it's even hard to trust delivery companies.

They are required by law to store data on their customers for tax purposes, legal reasons, shipping, and other reasons. Hardware wallets have warranties. Usually 1-year warranties but maybe longer. If they deleted all data before that and someone contacted them complaining about their device not working while it's still under warranty, they wouldn't know who that is and when they purchased the wallet.

Resellers exist and are crucial in all industries, especially in regions a company can't reach for whatever reason.

[Meuserna]

All of this just reinforces my belief that DIY is the way to go for those who are able to do it.

And it isn't hard. Anybody who used a ColdCard already knows how to use an airgapped device and a real watch-only wallet app like Sparrow for desktop or BlueWallet for mobile. Pair that up with a SeedSigner and you're set.

Take one extra step by generating your own random seed phrase by hand and you've solved every vulnerability people are experiencing with hardware wallet thefts. Install ShieldSigner instead of SeedSigner and you've increased your security to a point that no commercially available hardware wallet can even match...

...airgapped, stateless, fully open source, encrypted seed QR, passphrase QR, and so much more...

...but for some reason, most people want to trust a company even though that goes against the entire ethos of Bitcoin.

I love Bitcoin so much, but often, I do not understand Bitcoiners.

Go DIY and you'll wonder why you didn't make that upgrade sooner.

[Dogedegen]

How would we avoid such incidents? They shouldn’t store users' data to avoid leaking it and shouldn’t assign any reseller where it's even hard to trust delivery companies.

They are required by law to store data on their customers for tax purposes, legal reasons, shipping, and other reasons. Hardware wallets have warranties. Usually 1-year warranties but maybe longer. If they deleted all data before that and someone contacted them complaining about their device not working while it's still under warranty, they wouldn't know who that is and when they purchased the wallet.

Resellers exist and are crucial in all industries, especially in regions a company can't reach for whatever reason.

Your points are all true, but there are ways to go around those issues if they really wanted to. Why does the data have to stay accessible in a digital form? Can't it be shortly be removed from those system and archived in an offline form? Surely the percentage of customers who actually go back there and whose data is needed actively is very very low, I would guess less than 1%. Wasn't there a VPN provider that does not even use emails and it is fully legal and in Europe? How are they able to sell the service without storing data about the customers? If there is a will, there is a way! Don't excuse laziness and incompetence.

All of this just reinforces my belief that DIY is the way to go for those who are able to do it.

Which is appropriate for what, like 1% or fewer users? We need to be sensible and stop talking about ideological solutions and ideas and talk about things that people actually can do. If we give a long guide on DIY for normal people, they will just say this looks too complex I will buy all my Bitcoin with an ETF and forget about it. Ideological solutions are good for nerd talk, but should be reserved for that otherwise we keep creating a worse and worse system where many people are relying on custodians who otherwise didn't need to do that.

I love Bitcoin so much, but often, I do not understand Bitcoiners.

Go DIY and you'll wonder why you didn't make that upgrade sooner.

It seems you don't understand normal humans..

[Meuserna]

All of this just reinforces my belief that DIY is the way to go for those who are able to do it.

Which is appropriate for what, like 1% or fewer users? We need to be sensible and stop talking about ideological solutions and ideas and talk about things that people actually can do. If we give a long guide on DIY for normal people, they will just say this looks too complex I will buy all my Bitcoin with an ETF and forget about it. Ideological solutions are good for nerd talk, but should be reserved for that otherwise we keep creating a worse and worse system where many people are relying on custodians who otherwise didn't need to do that.

We're not talking about dummies on Facebook or Xwitter. This is a Bitcoin forum specifically for hardware wallets.

I love Bitcoin so much, but often, I do not understand Bitcoiners.

Go DIY and you'll wonder why you didn't make that upgrade sooner.

It seems you don't understand normal humans..

Again, this is a forum for Bitcoin hardware wallets. I'd expect to find people here who understand how to secure Bitcoin and who prioritize minimizing risks.

There's no way, in a forum like this, that I can be the only one who thought through the ways trusting companies is dangerous.

I stopped letting hardware wallets generate seed phrases for me back in 2022 or 2023 (I don't remember which) because I couldn't prove the seed the device generated was truly random. Then, ColdCard users started getting robbed due to seeds that weren't truly random.

That danger was predictable, and solvable. But people want to trust companies.

People are getting robbed because of Ledger supply chain attacks. That danger was predictable, and solvable. But people want to trust companies.

Mailing lists get leaked, giving thieves names, phone numbers, email addresses and home addresses. That danger was predictable, and solvable. But people want to trust companies.

I don't expect the Facebook crowd to understand this stuff... but here? In a forum where longtime hodlers discuss Bitcoin security?!?

I'm not seeing anybody learning lessons.

P.S. Ledger's key extraction API will get hacked. That danger is absolutely predictable, and solvable. But people want to trust companies.

It's all going to get worse. The question is, is it going to get you? The danger is predictable, and solvable. But you want to trust companies, so you're bound to get caught in their errors and laziness.

These dangers are easily avoidable. Maybe not for Joe Shmoe on Facebook or Xwitter. But here? Easy.

[Pmalek]

...but for some reason, most people want to trust a company even though that goes against the entire ethos of Bitcoin.

When there is an easy way to do something and a difficult way (even if safer), most people will pick the easier one. That's just the way it is. Buying the individual components for a gaming PC and building it yourself at home is cheaper than buying a ready-to-use gaming PC in a popular shop. Despite that, most people will buy units they can just plug in and turn on, even if they are more expensive. It's the same thing with hardware wallets. A minority will be interested in building their own. A minority will use dice, coins, and other ways to generate seeds. A minority will want to deal with stateless signers and moving transaction data back and forth between online and offline devices. That's just human nature.

[joniboini]

These dangers are easily avoidable. Maybe not for Joe Shmoe on Facebook or Xwitter. But here? Easy.

I think you overestimate people who use this forum a bit. Yes this community can be considered niche and some people probably have more knowledge compared to some random Twitter user, but it doesn't mean they're that dedicated to security. To this day I still found people using exchange address to receive their sig payment, for example. Just a few days ago someone asked whether ditching hardwre wallet and sticking to exchange is the right move.

I do agree that it's probably easier to encourage people on this forum to move toward self-airgapped setup though. Especially those who visit and read board like this one regularly.

[Meuserna]

These dangers are easily avoidable. Maybe not for Joe Shmoe on Facebook or Xwitter. But here? Easy.

I think you overestimate people who use this forum a bit. Yes this community can be considered niche and some people probably have more knowledge compared to some random Twitter user, but it doesn't mean they're that dedicated to security. To this day I still found people using exchange address to receive their sig payment, for example. Just a few days ago someone asked whether ditching hardwre wallet and sticking to exchange is the right move.

I'm sure you're right, but this forum has existed since 2009. It was created by Satoshi himself. And we're in the hardware wallet section. I'd expect some of the most experienced people to be here.

As attack after attack on commercial products keeps happening (and they will get worse), it seems like the DIY spirit of Bitcoin itself should be flourishing here. Instead, this forum is mostly about gadgets.

That's what most hardware wallet are. They're just gadgets, and most of them encourage worst practices. They encourage saving seeds on a device that can be stolen and probably hacked. Hell, Ledgers have a key extraction API baked into the firmware. These devices make using a strong passphrase harder, not easier. They encourage putting your name and address on a mailing list that will get leaked. They encourage users to make themselves a target. Some of these companies encourage users to lock themselves into an ecosystem they can't even prove is safe.

Most of these stupid gadgets discourage users from learning the basics of what a Bitcoin wallet actually is, because the companies want you to need their product. That's why almost no hardware wallet users understand the device is actually a signer and the companion app is actually a watch-only wallet. It's why so many hardware wallet users think a seed phrase is like a big password. Yikes.

And because these hardware wallets encourage users to think in terms of gadgets instead of security, users often stick with unsafe products even after they see proof that the products aren't safe.

Ledger added key extraction to their firmware. Users shrugged it off. That's insane.

ColdCard's code is such trash it caused over a hundred million dollars worth of Bitcoin to be stolen. But the calculators are so cool, bro! Users keep using them. I'm stunned.

I do agree that it's probably easier to encourage people on this forum to move toward self-airgapped setup though. Especially those who visit and read board like this one regularly.

Stateless. Airgapped. Encrypted seed. Passphrase QR. Fully open source code. Off the shelf parts. Off the top of my head, those are my six must-have features.

Stateless: Your seed isn't saved on the device. That means, if the device gets stolen, there's nothing on it for a thief to find.

Airgapped: The device doesn't have the ability to connect to the internet. It can't even connect to a device that connects to the internet. Online thieves can't reach it.

Encrypted seed QR: Even if somebody gets into your home and finds your QR code, they can't scan it without the decryption key. They won't even know what the QR code is for. It's just a borked code that won't scan.

Passphrase QR: This enables the user to instantly load very strong passphrases. Remember: Even some ColdCard wallets with passphrases got robbed. How? If the thief knows there may be coins in a decoy wallet, weak passphrases are easy to crack.

Fully open source code: Closed source code can't be proven to be safe. Period. But even nonsense like ColdCard's "source verifiable" code prevents devs from using the code in their own work, which gives devs no incentive to battle-test the code, which is why they didn't. That's why the randomness bug existed for 5 and a half years.

Off the shelf parts: Build a ShieldSigner from a Raspberry Pi, or install Krux on a Yahboom K210 visual module. Thieves can't supply chain attack those devices because they're not Bitcoin devices. Ledgers are targeted because that hardware is specific to that purpose. Yahbooms are used in everything from toys and games to home automation. Raspberry Pis have seemingly unlimited uses. I'm using a Raspberry Pi as an Airplay streamer.

Off the shelf parts also keep you off mailing lists that thieves target people with.

And one more thing, since I'm on a roll...

Generating your own random seed instead of trusting a device is wise. It's easy. And it gives you the ability to prove your seed is truly random. I've been doing this since 2022 or 2023. Here's my method, but there are others:

Copy & paste the entire BIP39 wordlist into a text document with columns, so the words are in rows on the pages. Cut the pages up so each word is on a separate slip of paper. Dump the paper into a popcorn bowl and shake it up to scramble the words. Pick a word. Write it down. Put the word back in the bowl. Scramble 'em up again and pick again. Write it down. Do this 23 times. Use a hardware wallet to calculate the 24th word, which is a checksum. Enter the words into a second hardware wallet to confirm the checksum is correct.

Do this and you know for a fact your seed is safe and random. You know because you did the work yourself and you verified it.

I'm sure this is all TL:DR... and that's sad, because here's the thing... This forum was created by Satoshi himself back in 2009. Bitcoin is open source and DIY. It sure seems like this should be the place leading the charge to keep that open source and DIY spirit alive in order to help keep our fellow hodlers safe.

None of what I said on this page is hard to do, but this stuff does need to be taught. I learned most of it on Crypto-Guide's youtube channel and through online guides. Sadly, there's a reason I didn't learn any of it here.

[Dogedegen]

We're not talking about dummies on Facebook or Xwitter. This is a Bitcoin forum specifically for hardware wallets.

Most Bitcoin users are not able to do what you are suggesting, and many more are reading this forum than are capable of doing what you say. Because of that this kind of advice continues to create problems. Same how the previous advice just get a hardware wallet and you did everything perfectly caused the current situation. People read, they share, and we try to run away from the damage that we have caused. DIY would cause harm for more than 99 percent of the users than it would do good, that is a fact.

These dangers are easily avoidable. Maybe not for Joe Shmoe on Facebook or Xwitter. But here? Easy.

From the active users that I see, maybe 10 to 20 are able to do it securely. You are seriously overestimating capabilities of users online. If I post something smart that does not mean I am smart or that I wrote it.

These dangers are easily avoidable. Maybe not for Joe Shmoe on Facebook or Xwitter. But here? Easy.

I think you overestimate people who use this forum a bit. Yes this community can be considered niche and some people probably have more knowledge compared to some random Twitter user, but it doesn't mean they're that dedicated to security. To this day I still found people using exchange address to receive their sig payment, for example. Just a few days ago someone asked whether ditching hardwre wallet and sticking to exchange is the right move.

I do agree that it's probably easier to encourage people on this forum to move toward self-airgapped setup though. Especially those who visit and read board like this one regularly.

You understand it better, but I would not encourage people to go to self-airgapp. What that usually does for normal people is that eventually it frustrates them a lot, even more if they need to do some transaction fast and this will lead them to make an emotional decision or action that will destroy the whole security of the setup. Maybe leave that one only for the extra nerds.