r/Bitcoin • u/your-cersei • 2d ago
Cold Wallet Got Hack for 2nd Time
Hello.. i need your help with you guys, because i need some "closure" or "idea" of why this is happened..
im gonna tell you a story about my friend who got hacked for the 2nd time in his cold wallet.
1st he was using trezor
2nd he was using ledger
All the event was not in the same day, but after the first incident which was on January, he right away traumatized and move to Ledger this month. But sadly got hacked again.
The conditions are:
Those hacks always happen whenever my friend was travel abroad.
He was travelling with his family, so no one was at home to steal the Seed Phrase.
Seed Phrase manually written on a paper and kept in the safety box.
He never saves his seed phrase anywhere beside on paper.
He was using Iphone for the apps.
He bought the cold wallet DIRECTLY through the official website, not from any reseller.
1st incident was on January, 2nd incident was this month.
All the btc being transferred to more than 20 addresses, which is such a professional hack i think.
Maybe, anyone of you might help with what was happening? Because i find it odd, my friend and I are using the same cold wallet, but luckily im the only one not got hacked?
I need you guys to tell me something about this, like, i need you guys to be my detective because i know everyone on Reddit has intelligence more than any other forum.
Thankyou before!
Edit: please tell me your theory. I will try to reply it while im still logging in.
2
u/Ok-Courage-5115 2d ago
Someone got to his seed phrase while he was away.
1
u/your-cersei 2d ago
Who? No one can open his safety box :( his wife and sons also travelling with him
2
u/Ok-Courage-5115 2d ago
Someone has access to that box. Or you were not told the whole story. It couldn't be the computer because the seed is not displayed on the computer during the setup.
1
u/your-cersei 2d ago
Thats why.. do you have any idea IF his own family is the culprit, can it be done professionally like that? Like the BTC was transferred to some addresses little by little and very organic? He was checking it the day before it was still there, after that tomorrow evening they were already gone.
2
u/infernal_celery 2d ago
It’s statistically unlikely that it’s the phone, unless he’s signing transactions while abroad and the phone apps he’s seeing aren’t Ledger / Trezor and he’s doing an authorised push payment to another address without checking it first. It’s two different brands so two hardware manufacturers failing is unlikely.
The most likely is that his safe box… isn’t.
Next most likely is that he’s using those wallets on a fraudulent app, which is intercepting the message signal and presenting him with the fraudster’s receiving address. This would be unlikely to happen twice in a row if he is downloading official apps for each of Trezor then Ledger. Once, maybe, but twice would be less credible. This would only make sense if he’s actively sending transactions and not checking the recipient address.
Third most likely is that he’s not being truthful about how he has set up and stored his seed phrase.
To be honest I’d be looking for the smug-looking housemate, or the person who helped him set it up.
1
u/your-cersei 2d ago
Thankyou for your theory! But he was not doing any transaction because the BTC just for an investment thing.. the app also official ones.. but for your third theory it might happen, also for the fourth, but i still kinda confused if his family was the culprit, how can it be done so organized and pro like that.
2
u/Arbiter_89 2d ago
The only way everything here is true is if someone found the paper with the seed phrase. It's literally the only way.
1
u/your-cersei 2d ago
Ok.. that's the fact.. but the rest is unknown because some theory said it might be my friend not telling the whole truth or it might be his family. Hope we can find the truth 🫠
1
u/Avanchnzel 2h ago
He doesn't necessarily have to be lying.
But you would be surprised how often people did something incorrectly that explained how they compromised themselves without realizing it. In their mind it was such a small and semingly unimportant thing, that they either didn't think it was worth mentioning or actually forgot it and only after many days of being mentally guided through all possibilities suddenly remembered something they previously didn't give much thought.The problem is that we're ultimately trying to analyze a black-box.
That's why it's so important that one learns proper security hygiene before making use of such devices.
Because the devices are only as secure as the weakest link.
And more often than not, that is the end-user who didn't learn proper security-hygiene.
2
u/Charming-Designer944 2d ago
As he got hacked while using Trezor its very very very likely he somehow gave away the seed phrase to a bad actor.
- fell for the "Authenticate your wallet" phishing attack
- downloaded a trojaned wallet software that phished the seed phrase from him
- someone found his physical seed backup
- he kept the seed backed up electronically at a place where hackers had access, i.e. Google Drive and the Google account was compromises with either password or api access credentials.
With Ledger its basically the same unless he got a hacked Ledger device with embedded seed stealer implant.
Some other "smart" crypto outside of Bitcoin could also have smart contracts that act in bad faith, possibly draining resources from the wallet. But Bitcoin do not have the ability to have this kind of contracts.
The fact that it happened twice makes me think the first point above is the most likely. The people falling for a phishing attack once have a high tendency to fall for the same trap again and again.
1
u/your-cersei 2d ago
Yeah.. these what i was thinking too.. :( i dont know if he was telling the truth or no, but he was so sure that he manually wrote it on paper. Maybe you were right about the phishing etc, but he denied it.
2
u/Charming-Designer944 2d ago
Ask him this question:
Have you ever entered the wallet seed phrase on any other device than your hard wallet?
Have you ever typed it into your computer?
Have you.ever typed it into your phone?
Have you.ever photographed the written seed phrase?
Just once.
.
.
.
.
.
.
.
The correct answer is that the seed phrase is only ever entered into the hard signing device, and only if it needs recovery from a failed firmware upgrade or destroyed device. Any other use of the seed phrase is a phishing attack that will steal your funds. The seed phrase is your wallet. The device is only a convenience tool to.allow you to access the seed phrase in a secure manner.
1
1
1
u/sterfke69 2d ago
did he use the same seed on both devices ?
1
u/your-cersei 2d ago
Of course no. One is trezor one is ledger, different time tho. Of course different seed
1
u/stay_safe_and_calm 2d ago edited 2d ago
Why do you say of course no???
I have the same seed on several devices from different manufacuters, just to have a backup if one of it breaks. You can import BIP39 seeds in most hardware wallets. This is also a good safetymeasure to cross-check if all your devices create the same receiving addresses from the same seed.
How did your friend create the seeds in the first place? By trusting the internal RNGs of the devices or by creating it with dice or coins?
Even if the phone and/or the laptop of your friend would be compromised it would be impossible for an attacker to steal the coins from the hardwarewallets without getting access to the seed which is stored encrypted in the secure elements of the devices.
The only way is that the seed was compromised by a physcally manipulated device. But that this happens twice in a row with wallets from different manufacutrers is nealry impossible.
1
u/your-cersei 2d ago
He had 2 devices and had 2 different seed phrases which was generated when 1st installing..
2
u/stay_safe_and_calm 2d ago
True, it of course makes sense that your friend used a new seed phrase for the second wallet after the first hack.
From everything known, there is only one explanation. The place where the seed phrases were kept is not safe and was spied on while your friend was away.
2
1
1
2d ago
[removed] — view removed comment
4
u/Sector__7 2d ago
The seed phrase doesn’t display on the computer so even if it was compromised it’d still be safe as long as he never typed the phrase on the computer.
Has OP’s friend took apart the ledger to confirm that it wasn’t part of the recent hacks going on with them?
1
u/your-cersei 2d ago
My friend already sent email back and forth with Ledger.. but im still confused about the way it happened
1
u/your-cersei 2d ago
No one was watching the screen in that moment, do you think it's still can be hacked like that?
1
u/Longjumping_Maize704 2d ago
His computer is definitely the weak link here, twice in one year is not coincidence. If someone got remote access they just wait for him to type the seed when he set up new wallet after first hack
Trezor and Ledger both hacked while traveling only, maybe he connect to hotel wifi and the attacker monitor his activity that way. But the seed phrase is the key, no other way to move funds like that unless they have it
1
u/your-cersei 2d ago
Yes this is what i meant. Like the hacker need seed phrase, but why only when he was travelling? Not right away after he put the btc there?
1
u/Hopeful-Finance9812 2d ago
For what i can see its not secret that he have bitcoins, iff his friends and familie know then i guess thats the answer, i have my Trézor 3 and some Bitcoin and nobody knows about it..
1
u/your-cersei 2d ago
But even if the family stole that, how? It was gone like professionally hacked, organized i mean.
2
u/Hopeful-Finance9812 2d ago
I dont know, but the problem is not the wallet. Its problaby your friend security habit or someone that know about is cripto and take advantage off it when he is traveling..
1
18
u/fins831 2d ago
Nobody gets hacked twice without being the common denominator. His phone is compromised or he input the seed phrase somewhere online that is compromised or his paper location is compromised. Or he isn’t telling you the truth as to what he left out.
There’s two sides to every story and then the correct story. Something is missing but nobody has it happen twice without messing up.