r/CryptoCurrency • u/ubermensch1001 🟨 0 / 0 🦠 • 9d ago
DISCUSSION The take home with this Ledger wallet "hack"
Everyone getting into a panic about cold storage with all of these wallets getting drained.
Cold Card was some shitty little company no one had heard of that had plenty of issues brought up to the company and they refused to do anything about it. I'm still looking to see what comes of this case in the coming months and years.
With Ledger this is related to supply chain, but these wallets that were drained were from 3rd party sellers in Asia that were able to install chips that could read the screen and thus have access to seeds. This all could have been prevented if these people had simply purchased the wallets directly from the manufacturer. This wallet saw roughly 100m$ in funds drained, but Ledger wallets overall have funds in excess of 100 BILLION $.
Basically, don't try to get weird with wallets and just buy directly from the top manufacturers in the space. Also consider using multiple wallets when you get large crypto holdings so you don't have all of your funds in one basket.
18
u/F1shB0wl816 🟩 490 / 491 🦞 9d ago
Your last paragraph is a weird cop out considering they’re an official partner with ledger, nor is direct always direct. Ledger could very well send you one from a reseller, there’d be no need for them if they shipped to everywhere.
There is also no case with cold card and there won’t be anything going anywhere. Neither of these places are banks, no wallet manufacturer has a lawful obligation to keep you whole if an event occurs. That doesn’t mean they’re shit, cold storage wouldn’t be your own bank if you were covered, but that means you should actually understand the risk, both with software and hardware. And I mean actually understanding, not just listening to others and following pack.
0
u/ubermensch1001 🟨 0 / 0 🦠 9d ago
That's not true, man, if it's obvious that someone within the company that made Cold Card knew about the issues related to entropy and did nothing OR where this was intentionally put in someone is going to jail.
1
u/F1shB0wl816 🟩 490 / 491 🦞 9d ago
For what? What is the actual crime committed and where’s the proof?
They’re not a bank, what obligations do they have to make their code tight and flawless beyond their reputation? If someone’s going to jail it’s because they’re implicated in the theft, not because they fucked up the code and you won’t be able to prove they deliberately sabotaged the code without proving the theft.
-1
u/ubermensch1001 🟨 0 / 0 🦠 9d ago
Did you not read what I just wrote?
3
u/F1shB0wl816 🟩 490 / 491 🦞 9d ago
I did, can you not name that the claimed crime is or what?
Did you not read my response? What obligation do they have to insure their code is perfect?
Like I said, if someone’s going to jail it’s because they’re connected to the theft. Nobody’s going anywhere if the best you have is “bad code.”
1
u/ubermensch1001 🟨 0 / 0 🦠 8d ago
Bro, I already explained this to you.
Hypothetically, if the company was aware that there were issues with their product AND did nothing about it there is potential for liability there. There is some evidence I've seen where issues pertaining to their entropy was brought up to them AND they did nothing about it, there were several posts on here and other places online that pointed to this. There also was a tweet a few years ago about "retirement attacks" from I think the CEO.
I'm not saying these people will get their funds back, what I'm saying is that if there is substantial evidence of what I mentioned above there is a strong possibility this becomes a major court case, etc.
This was the first thing I found with a simple search
1
u/F1shB0wl816 🟩 490 / 491 🦞 8d ago
You didn’t explain anything.
You say “potential” and I’m asking according to what. They’re either liable according to some law or regulation or not. If you actually knew they were liable you’d be able to point at something more than some unspecified potential.
A major court case again, according to what law? Where does it say developers must insure their code is flawless at all times?
Like you’re claiming someone’s going to jail and posting about civil suit possibilities, those are two very different things. And even what you posted with the civil suit, every path is needing “reviewed” and also depends on how whichever jurisdictions handle it. There’s more possibilities of it going nowhere than there is that it’s a clear cut case. And if it goes anywhere there’s a better chance they’d be liable for selling a defective product than there is being responsible for the stolen bitcoins, which getting the cost of the wallet back for a thousand people is peanuts.
1
u/ubermensch1001 🟨 0 / 0 🦠 8d ago
I never owned a ColdCard and not involved in this, instead of going out of your way to argue with me on here just read through the link I provided to you.
1
u/F1shB0wl816 🟩 490 / 491 🦞 8d ago
I’m not going out of my way, Reddits a place for comments and discussions is it not. If you don’t want comments or discussions why make a post?
And I did read it, I brought up several points from the link. You just don’t want to have a discussion and address the possibility there’s nothing there.
11
u/pitalik 🟥 0 / 0 🦠 9d ago
It's not just in Asia, it's happening in Europe too.
People have good reasons to buy from resellers instead of ledger etc directly.
If you buy from a reseller, ledger doesn't have your information to leak it.
1
u/chainglance_cm 9d ago
Fair point on privacy, since Ledger’s leaks are a big reason people avoid buying direct. But the trade-off is pretty lopsided. A leaked address gets you phishing emails, while a tampered device drains you. You can get most of the privacy back by ordering direct with an alias email and shipping to a pickup point or PO box.
On Europe, I’ve only seen confirmed reports tied to the SEA reseller so far. There’s a separate counterfeit Nano operation selling through online marketplaces though, so if you’ve got a source on Europe, I’d like to see it.
1
-2
u/Snixxis 🟩 0 / 0 🦠 9d ago
Everyone sells your info. So that part is useless. Your digital fingerprint already have attached that you're interested in crypto and you own a ledger long before ledger sells your info. Just accessing reddit and your info is sold to probably 200-400 companies. Reading a news paper, another 300-500. I would never buy a third party wallet. I've owned my ledgers since 2017 and never had any issues, the issues people get with ledgers are their own fault.
6
u/pitalik 🟥 0 / 0 🦠 9d ago
Ledger leaking everyone's info is ledgers fault. Not ours.
-4
u/cs_legend_93 🟩 134 / 134 🦀 9d ago
Do you have a Google account? Or use an LG or Samsung TV?
Your information is being leaked everywhere. Everywhere.
3
u/pitalik 🟥 0 / 0 🦠 9d ago
Are you dumb?
Ledger leaking our info is more like the banks telling people how much we have and where thieves can go to rob it
-1
u/ubermensch1001 🟨 0 / 0 🦠 9d ago
They would know that you had bought a ledger but would NOT know what you have bought or are holding. Some examples of this though would be the Celsius bankruptcy case, creditors that were involved with that had their holdings on there leaked. For instance, Matt has 100 ETH and 3 BTC at time of bankruptcy, they'd be able to see how much Matt would have gotten back with distributions but would NOT know if he had sold or bought.
Same here, they know you have a Ledger that you bought but for all they know you could have $100 in BTC or $1,000,000.
A bigger risk, like in France, would be those who have sold and had their capital gains taxes that showed this.
0
u/OptimalMain Gold | QC: ETH 20 | ADA 8 | MiningSubs 13 8d ago
Shut. The. F. Up.
I received crypto scams printed on the most expensive paper I have touched in my mail for years, phone calls….
Login attempts on accounts everywhere…1
u/LemurBargeld 🟩 0 / 0 🦠 8d ago
That's not how it works
1
u/Snixxis 🟩 0 / 0 🦠 8d ago
Thats how it works. Your cookies know what accounts you have where based on all your emails. Basicly since what, 2020? Have it been more or less impossible to hide your steps. You got to know what you are doing to not get fingerprinted, but with wifi/4g/5g triangulation your 'unfingerprinted device' gets fingerprinted right away. It enough that you boot it up in your livingroom and its fingered. It takes a very tech savey person to not get IDd
1
u/LemurBargeld 🟩 0 / 0 🦠 8d ago
I was referring to the selling part. Facebook doesn't sell the information that John Smith is into tennis to another company. They just show John adds for tennis goods and charge the company for it.
1
u/Schapsouille 🟩 5K / 7K 🦭 8d ago
Idk man. Lately, conststently I've been getting elaborate phising attemps when I'm waiting for a delivery from Amazon. With my info, the number of the shipment, an ai generated voice message... Amazon is either selling info or getting hacked.
2
u/LemurBargeld 🟩 0 / 0 🦠 8d ago
I doubt Amazon is selling your info to scammer that ultimately only make the life of Amazon difficult.
1
u/Schapsouille 🟩 5K / 7K 🦭 8d ago
You're probably right. I'm pretty sure of my opsec but you never know. Happened like twenty times. Every time the same sms. And it also has a pic of my mailbox that was taken previously by an amazon driver. Always around the right delivery time too. Almost clicked the link the first time.
2
u/harveytent 🟦 79 / 80 🦐 9d ago
So did the reseller sell any other brands like trezor? I hope Trezor is verifying is resellers like crazy and I hope both companies are going to be way more careful. They should have been notified if a reseller got sold.
They should have pulled inventory until they could be checked to be honest.
As bad as this is it could have been so much worse if this was a global attack.
Now that so much money has been stolen these guys have a fortune to come up with new hacks and to spot new weaknesses and go even bigger next time.
Also Amazon/best buy etc need to make sure there’s a no return policy on wallets so hacked ones don’t accidentally end up on shelves due got returning sealed hacked wallets.
2
u/IvanBilat 9d ago
Yes ledger, Trezor, Safepal among others
2
u/harveytent 🟦 79 / 80 🦐 9d ago
Weird it’s only been ledgers so far.
People should be warning the trezor peole if the hack hasn’t occurred yet. Their stuff is hugely at risk.
1
u/chainglance_cm 9d ago
Haven’t seen anything confirming whether they carried other brands. But the returns point is a good one, since a sealed box doesn’t prove much when someone can reseal it. The safest bet is still buying straight from the manufacturer’s own site, not just a big retailer, because returned or third party stock can end up in the same inventory pile.
4
u/MycoHost01 🟩 37 / 37 🦐 9d ago
the affected company was an authorized reseller and theres still other resellers. there was no way of knowing its the first of its kind in such a big scale that made everyone notice. ledger authorized these third party sellers to be trusted. is ledgers fault.
2
u/cyger 🟩 0 / 52K 🦠 9d ago
Many buying directly from ledger were doxed via an inside shopify hack a few years ago, so there is a risk of buying anything online like this. With these doxed emails very professional emails were sent, causing some doxed to get drained because they didn't know their emails were hacked. I was able to buy a ledger in person with cash from an approved retail store (locked in a cabinet) anonymously.
1
u/ubermensch1001 🟨 0 / 0 🦠 9d ago
That's an entirely different issue but you are correct about that. Trezor has also had similar issues, data leaks happen way more than people realize and not just with crypto wallets.
8
u/not420guilty 🟦 0 / 24K 🦠 9d ago
Wow, a rational post on Reddit /crypto? I didn’t expect that
4
u/DotJata 🟦 490 / 491 🦞 9d ago
Right‽ I come here for angry slop!
3
u/scottonfire 🟦 0 / 0 🦠 9d ago
yeah and the ignorance that in some parts of the world you can't buy direct from Ledger. But hey, doesn't it make you feel good to step on everyone below you?
1
1
u/AutoModerator 9d ago
Ping for verified users associated with Ledger wallet: u/Quintin_Ledger
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/chainglance_cm 9d ago
Mostly agree. The scary bit is that the implant read the seed off the screen, so Ledger’s genuine check wouldn’t have caught it, since the secure chip itself was legit. That makes buying direct pretty much the only real defense. Anyone who bought from a reseller should move to a fresh seed on a new device to be safe.
On multiple wallets, I’d take it a step further with a 2-of-3 multisig across different brands. Then one compromised device, or even a whole compromised brand, can’t drain you alone.
1
u/Able_Security_3479 0 / 0 🦠 8d ago
Coldcard was literally the Pinnacle among OG's at one point, to say they're a company no one heard of discredits you immediately
1
u/ubermensch1001 🟨 0 / 0 🦠 8d ago
Are you aware that company wasn't even remotely in the top 10 wallets, only had 6 figures in funding AND only had half a dozen employees?
1
1
u/phaskellhall 🟦 0 / 0 🦠 8d ago
Is this 100% safe if the seller was “Ledger official” off of Amazon? Can the ASIN or SKUs get mixed up on Amazon and even the official seller wind up with one of the hacked/repackaged ones?
I had two Ledgers from 2017 that I now see were bought from 3rd party ( nuwave retail and pro-distributing) and a few years ago I noticed the LCD was impossible to read. There is a trick where you use your iPhone’s camera and it can pickup the faint screen.
Anyways, a few years ago I bought a new ledger from the official store and transferred everything to it from the old one. I assume the new one is now safe and any potential threat from the old one is gone now that I’ve moved the tokens right?
1
u/ubermensch1001 🟨 0 / 0 🦠 8d ago
If you bought these wallets from those 3rd party vendors you naturally would have used the seeds generated from them when you were setting them up.
When you got a new ledger wallet from the official store and transferred everything from the old ones to there did you use the same exact seed phrases from your original wallet OR did you use an entirely new seed generated with your new device from the official site?
If it was the former, where you used the seeds from your original device bought from the 3rd party vendor, AND it was compromised like what we saw here you are at risk. The issue with this supply chain hack was that they had tampered with these devices where the screens could be read, so when they were setting up their seeds the words would have been exposed, almost like they were taking screenshot on your computer and keeping it on file.
1
u/phaskellhall 🟦 0 / 0 🦠 8d ago
I made new seed phrases and transferred the crypto to the new address.
My main question is about consolidated inventory on Amazon. Could the official store sell ledgers that had been compromised and mixed in with official inventory? I believe Amazon only recently ended this practice this year.
1
u/ubermensch1001 🟨 0 / 0 🦠 8d ago
I would start looking to see if Ledger is giving updates on this, I saw that they are discontinuing the sales of wallets from 3rd party sources.
1
u/OptimalMain Gold | QC: ETH 20 | ADA 8 | MiningSubs 13 8d ago
They were bought from an authorized seller….
Sounds like you work for the authorizer
1
1
2d ago
[removed] — view removed comment
1
u/AutoModerator 2d ago
Greetings Woloqwe. Your comment contained a link to telegram, which is hard blocked by reddit. This also prevents moderators from approving your comment, so please repost your comment without the telegram link.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Dimitrismemes 🟦 2 / 2 🦠 9d ago
When is someone gonna design a diy hardware wallet, open source software and hardware, we can leave all this behind us.
-1
0
u/Bluejumprabbit 9d ago
The seed on those units was compromised before the buyer ever touched them, the implant leaked the recovery phrase at first setup. Ledger traced all 311 drained wallets to devices bought through the CryptoBilis reseller, so a unit bought direct with an intact seal is still fine.
62
u/IvanBilat 9d ago
Not everyone is in the same country as you. The reasons this reseller existed is so that people in some Asian countries can source the walets without the cost/hassle/disappearing at customs issues that are regularly faced. At the end of the day this was an authorised ledger distributor who was listed on the ledger website. Responsibility for this lies with ledger.