← Back to context

Comment by ebiester

12 hours ago

So what happened with all of those with hardware wallets that have been pwned?

There apparently is no such thing as “your crypto” with how many security problems there are.

38 comments

ebiester

Reply
caymanjim  11 hours ago

By the nature of blockchain, it's never, ever your crypto. It's allocated to whichever bucket the majority of participants in a given network agree to allocate it to.

  • dlubarov  9 hours ago

    Well, not exactly. A malicious majority of miners could rewind the chain as they please. They could indirectly steal some funds by undoing certain transfers, but they couldn’t just directly reassign funds to themselves.

weird-eye-issue  12 hours ago

Back around 2012 I created a paper wallet using an offline website (it was HTML and JS downloaded locally that worked without internet. I put it on a USB stick and then use it in a laptop without internet), printed it out and put it in a safe

  • trollbridge  10 hours ago

    I did a similar stunt with an old PowerBook where I electrically disabled the WiFi/Bluetooth so it wouldn’t be online unless I plugged in Ethernet, generated keys, and played around with mining. This was back in 2010 when this was all just basically toys for fun. I also encrypted it all with FileVault.

    Then I forgot my pass phrase and have never been able to recover any of it. I don’t even know how many btc were mined/lost.

    Before anyone asks, no, there aren’t any usable exploits / vulns found for the encryption methods used. And from what I can tell the coins in question have still sat frozen for going in a decade and a half now. I suspect many other hackers did the same thing…

    • weird-eye-issue  10 hours ago

      If you were attempting to mine Bitcoin with a PowerBook I can confidently say you mined zero Bitcoin

      Edit: I thought he was talking about 2012 but yeah in 2010 CPU mining was still a thing

      4 replies →

  • paulpauper  10 hours ago

    bitaddresses .org? If the JS code was defective, the coins can still be stolen later if the hacker can recreate the keys by going through the small key space, despite the coins being created being offline.

xmcp123  12 hours ago

I keep a modest amount in Cake Wallet, not on an exchange. No hardware needed.

Tbh the biggest problem is platforms deciding you’re buying drugs because you purchase and transfer out (thanks Venmo)

extraextra  11 hours ago

Technically you can literally memorize your secret key

A paper wallet works as well

A hardware wallet is just a tradeoff between convenience and an extra security risk

  • paulpauper  10 hours ago

    insufficient entropy is the real problem. this is why coldcard was hacked

    • extraextra  1 hour ago

      Care to explain?

      Let's say I use an open source wallet, generate the keys, send there a few Bitcoin and then I print the wallet

      Now the Bitcoin is on a paper wallet, where's the vulnerability here? (except a crazy ex burning it down, but that's besides the point haha)

NoidFonsense  12 hours ago

idk the whole point of hardware wallets is that they are supposed to be a simpler stack. But if you're using a closed source hardware wallet...

An old laptop with the wifi card taken out is more transparent and auditable. It just runs the ordinary open source code

But I just keep all my funds in a hot wallet, no multisig. And if I get hacked I lose it all. I think the answer is just have good security and dont get hacked. The risk of losing cryptocurrency will encourage security advances across the whole ecosystem. I think I will set up multisig eventually

  • lxgr  11 hours ago

    How do you update that open source code without network connectivity? How do you securely input long transaction data to sign?

    > I think the answer is just have good security and dont get hacked.

    So you proposed a way to be more secure, only to discard it yourself in favor of “just having good security”?

    • trollbridge  10 hours ago

      You don’t. It’s not networked. It doesn’t need updates.

      In fact, updates are only a risk. You physically remove anything that can allow updates to happen + anything that allows wireless networking.

      4 replies →

  • razodactyl  10 hours ago

    I wonder if wallet is not a good or bad analogy considering it would make sense to have many wallets to distribute potential damage instead of being taken out in a single hit... UX issue?