Rendered at 15:40:58 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ArtTimeInvestor 1 days ago [-]
Hardware wallets are not a solution to self-custody.
If one would make a list of things that can go wrong, starting from the supply chain that delivers parts to the manufacturer, malicious employees at the manufacturer, mistakes the manufacturer can make, attacks on the delivery chain from the manufacturer to the user, to mistakes the user can make creating, using and storing their keys - the list would contain hundreds of points.
embedding-shape 1 days ago [-]
> Hardware wallets are not a solution to self-custody.
Nothing in this world tends to be "the solution", everything has tradeoffs.
Say you want to do self-custody, what is then the best option? "Don't do self-custody" obviously isn't the solution, as the core use case here is self-custody, so what in your opinion is a better way, than hardware wallets?
If there is nothing better today than hardware wallets, then for now, they are "one of the better solutions" for how to do self-custody, even with the current tradeoffs. But again, I'm eager to hear what the alternatives are.
ArtTimeInvestor 1 days ago [-]
There is no solution yet.
From a bird's-eye perspective, 3 things are needed: Create a key, derive an address from the key, store the key.
Creating a key safely is possible with dice. You would probably create a seed phrase instead of a key directly, but for this discussion it is the same.
Deriving an address from the key is hard and I have not yet seen a good protocol on how to do it. I have read through a bunch of descriptions of how people do it and they are all weak and brittle. The most popular seems to be "I order a hardware wallet and follow the instructions that come with it". But even people who put a lot of thought into it come up with weak and brittle approaches.
I would think there is a way to do it safely. But I have never seen a description of one yet. It might involve multiple computers, multiple software implementations and a hell of a lot of work to create a multisig that is not prone to a single attack vector.
Storing the key is probably the hardest. The most popular way seems to be to store it in a drawer or a safe. So now those coins are just as safe as a piece of gold would be. Or they use a multisig and store the keys in multiple locations. Quite painful. As you have the ongoing problem of keeping those locations accessible and safe at the same time.
thinkmassive 1 days ago [-]
How is multisig "quite painful" in your opinion?
embedding-shape 5 hours ago [-]
> There is no solution yet.
Again, "best solution we have available" for self-custody is hardware wallets, so we're back to square one.
Imagine if I tried to discuss and argue about things like this on a TypeScript submission? "No, this won't actually solve the problems of TS" I say, "What is the solution then?" someone asks me and I reply "There is no real solutions to those problems, just use Clojure, problems avoided!", completely missing the point.
nkrisc 1 days ago [-]
Then can you give an example of what you would consider a solution, whether hypothetical or real?
fps-hero 1 days ago [-]
Banks and payment providers (Visa Mastercard AMX) provide services beyond simply a store of wealth and a mechanism to transfer it.
Actually 2FA, hardware biometrics, behaviour based fraud prevention and personal confirmation of suspicious transactions. If you’re using credit they can refund fraudulent transactions, and there is the chargeback mechanism. This is probably banking system dependent, but in AUS there is a refund mechanism for mistaken/fraudulent traditional bank transactions.
BTC has effectively none of the safety net, and humans are fallible. We need the safety net. It’s the hugest barrier to adoption. Exchanges do a far better job of managing the risks than trusting your wealth to a hardware wallet.
miki123211 1 days ago [-]
In financial systems with a basis in law, no transaction is ever final. It doesn't matter what the protocol says or what the technology is capable of, if the judge says that the transaction must be reversed, you get it reversed, even if that means delivering cash in briefcases or something like that.
In systems with a basis in technology, final means final. If the North Koreans take your money, your money is taken.
The safety net makes you less secure against the U.S. government, but more secure against everyone else. That's the right choice for almost all users, but I still think it's at least kind of good that people have a choice.
lrvick 24 hours ago [-]
I have worked for and/or audited the majority of exchanges, that mostly white-label a much smaller number of players.
I have yet to see a single one, not one, that had a system of custody that did not allow any one of hundreds of people, most not even employees, to walk away with all of the funds.
There are no standards for security that apply to crypto custodians and the mostly fail to do the bare minimums.
If you use even a top ten custodian, operate under the assumption that the funds are in multi billion dollar plaintext wallets sitting on AWS servers the whole team has ssh access to from the same laptops they "npm install" random shit to all day.
Honestly if you do not feel confident custodying crypto yourself, you should probably not own any.
I’m not saying they are perfect, but on aggregate they are better than hardware wallets. Legally they will be responsible if your money is lost. They are about as close as you can get to the type of legal assurances provided by a bank.
fps-hero 1 days ago [-]
Anacdote, I have a friend who is a locksmith. I needed his services one day, gave him a call, and it turned out his day job had evolved since I last talked to him 5 years ago.
Basically, he was now just a safe cracker. He is a a locksmith, but 100% of his full time hours are cracking safes. He didn’t even carry around the stuff in his van to repin a lock. He gave me mates rates but the shop had to do it.
This man was attending multiple callouts, per day, to crack into a safe. Because of, you guessed it, human fallibility.
In a city with with millions of people, basically a hundreds of people needed a single locksmiths service because they had locked themselves out of there own “personal store of wealth”.
I’ve heard zero such examples through traditional banking, with the exception of stolen cards.
1 days ago [-]
whywhywhywhy 1 days ago [-]
Use a device that’s mass produced enough it can’t be targeted e.g a MacBook, then keep it airgapped and don’t do normal computing on it.
Gigachad 1 days ago [-]
Hardware wallets are air-gapped. The issue here was a distributor got acquired and then snuck a chip in that could read the spi link between the microcontroller and the screen. The chip had its own cellular modem and could send the passphrase that was shown on the screen to the attackers.
wongarsu 1 days ago [-]
If you sell a device specifically for storing large amounts of liquid assets, that puts a huge target on that device. You are basically asking for supply chain attacks
An ordinary MacBook does not have that issue. If you are a high-value target, you can further decrease your risk profile by buying it from a random physical store, further preventing targeted attacks.
ameliaquining 1 days ago [-]
The post you're replying to is arguing that it wouldn't be feasible to do that with a MacBook (at least if you buy it off the shelf at Best Buy).
alwa 1 days ago [-]
Boy that was a slog, to dig deep enough through the slop to find the technical details…
In retrospect @gigachad’s summary is worth as much as both articles combined, but for the Clauded technical source (with pictures!) that Ledger’s Claude-release refers to:
https://www.tibane.net/research/ledger-nano-x-implant
LoganDark 1 days ago [-]
Nobody said hardware wallets aren't air-gapped. They said take something normal and usual enough not to be an attractive target for bespoke crypto stealers, and then airgap that to make your wallet.
QuadmasterXLII 1 days ago [-]
airgapped pre crypto devices are extra safe: break out the ti82! don’t buy a ti82 for this purpose, it has to be one you had in your closet. If a blog post describes how to code it in TiBasic then affiliate links a calculator in ebay, well…
ArtTimeInvestor 1 days ago [-]
There is none yet.
If there was one, someone would write down the steps necessary and put them on the internet. But I have never seen a sound description of how to self-custody Bitcoin in a safe way.
The hardest part seems to not even be the one that currently creates all those problems - the hardware and software used. The hardest part is storing the key (for example a seed phrase). If anyone says they know a way to safely store Bitcoin, my first question is: How do you store the key?
skinfaxi 1 days ago [-]
Where do you store your bank password? Couldn't the same be used for a seed phrase?
everyday7732 23 hours ago [-]
remember it? Write it down somewhere hidden if you have to.
littlecranky67 1 days ago [-]
get a brand new, cheap laptop or machine (even a raspberry pi works) that you randomly pickup at the store (no delivery order). Install debian 13, install electrum, airgap the device, reboot and generate 1-of-2 your wallet keys.
The wipe the device, use any non-debian other linux (or BSD) to generated the 2-of-2 wallet key.
mattmaroon 1 days ago [-]
Using the banking system instead of crypto.
pants2 18 hours ago [-]
MPC or multi-sig is a pretty good solution, you can require a 2/3 sign off from different custody solutions (ie. a hardware, desktop, and mobile wallet)
notyourwork 1 days ago [-]
The existing financial system which provides protection to consumers. Crypto doesn’t solve the problem the general public assumes it does and hype has inflated its value dramatically.
akoboldfrying 1 days ago [-]
Yes, but this threat analysis also holds for laptops and phones.
What do you use to access your bank account online? I use my laptop, or my phone.
kasey_junk 1 days ago [-]
If your money is stolen from a bank account via fraud you have recourse to get it back, and it’s pretty straightforward to do in most cases.
SXX 1 days ago [-]
Very often this is not the case. Debit / credit cards payments are quite reversible, but once a person send $100,000 or even $10,000 to a scammer it can be quite hard to recover.
Caused by an account take over? This is letter of the law stuff and something bank (and other financial firms) employees receive specific training on. The customers loss is capped and their bank is on the hook.
For inter-bank transactions involving a scam that causes the customer to “voluntarily” send money it depends on the rail. But US ACH rules cover reversals due to fraud and have pretty substantial rules about it.
SXX 1 days ago [-]
All the countries have rules about it. Except if your credentials been compromised it can take weeks before you find out that money gone from your account.
Gigachad 1 days ago [-]
Usually how it goes is if someone hacks your account or steals credit card info. You get refunded. If a scammer convinces you to willingly send the money, you’re out of luck.
iammrpayments 1 days ago [-]
The truth is that banks often have pretty bad security and customer service, but the risk of getting caught after stealing crypto is virtually zero when compared to scamming someone’s bank account balance.
nkrisc 1 days ago [-]
Because the scammers are instructing victims to use methods that are difficult or impossible to reverse, such as gift cards or cryptocurrency.
rwmj 1 days ago [-]
Don't buy gift cards and send them to random people would be a good rule to live by.
sfn42 1 days ago [-]
Yeah, "everyone" knows that. Except the world har an incredible amount of people who fall for these kinds of scams. And there are less obvious scams around.
I almost fell for a strange scam a while ago. A Steam user by the same name as one of my existing steam friends added me. I assumed it was his second account and accepted. A few days later, he messages me, asking me to participate in a DOTA2 tournament. I had previously played DOTA2 with this person, he spoke to me in our shared native language which is not English and everything seemed in order. I said I haven't played DOTA2 in years so I'm beyond rusty, he said I don't have to play, they just need me to register so they have a full team for the signups and then they'll find someone else to play before the tournament starts. Sent me a link to a website requiring a signup and I can't remember what it was now but there was something about the signup that irked me. Maybe it was just creating a account, maybe it required a credit card or something I can't remember but I ended up looking at my steam friends list and noticed both the accounts were online. So I sent a message to the other account asking if this is them, he said no and then I noticed the same scammer had added another mutual friend so I messaged them too warning them about it.
That's the closest I've been to getting scammed that I can recall. I'm not sure what the scammer would gain from my signing up but I'm sure they had some kind of profit angle.
nkrisc 23 hours ago [-]
And yet people still do it.
chinathrow 1 days ago [-]
But freedom.
Seriously, that's why we have banks, still.
iammrpayments 1 days ago [-]
Good luck trying send money abroad or dealing with a sudden unexplained account shutdown.
chinathrow 1 days ago [-]
I have had no problem sending or receiving money abroad, thank you.
theplumber 1 days ago [-]
yet
Dah00n 1 days ago [-]
We are not all living in America, yet.
theplumber 1 days ago [-]
Well as far as I know banks in Europe (UK included) already ask you a lot of questions when you withdraw your money(I.e cash) or even when you wire various amounts( unless you have a good bank manager). My bank manager in Europe just told me straight that I don’t need to explain him anything but he has to call me anyway because of the bank policy(I.e to tick the boxes).
Next is a hold on your suspicious transaction, request additional documents for your own money, basically a lot of AML and KYC before you can use what’s yours.
I understand the reason why they do this but it feels to me you are no longer in control of your money/property and somehow they fail to catch people loading billions from shady sources so I would rather not keep my money in a bank (at least not a retail bank) if I had a sensible option.
Most people don’t care about this until they get trapped just like most people are
/were OK with Paypal and other junk services.
ameliaquining 1 days ago [-]
That's not really relevant; the U.S. government has enough leverage over the global (fiat) financial system that they can cause any account in any First World country to be shut down.
The actual reason to discount this is that account shutdowns are flashy rare events that reliably summon HN outrage, and so the kind of person who posts here overweights how likely they are, at least for people not on the margins of society. (If that weren't the case, the system wouldn't work and normal people wouldn't use it.)
chinathrow 1 days ago [-]
Exhibit #9387434 for reasons to stay out of crypto.
Neywiny 1 days ago [-]
My gut reaction is that a hardware implant would be too costly so there's no way they'd actually do that but I guess when you can steal $92M, anything is possible. They could even fab an esoteric chip and still make a profit.
dannyw 1 days ago [-]
Why do you think it's too costly? It's well known that there are divisions in DPRK that are focused on generating $ through crypto hacks and compromises.
We're dealing with reasonably sophisticated state actors here in this dark forest; not script kiddies.
Cheap $5 PCB + programmable small FPGA is a very viable route too for hardware implants; but even a microcontroller / ESP32/etc will probably do.
thinkmassive 1 days ago [-]
> A technical account published by Tibane Labs described an arrangement involving a microcontroller, cellular communication hardware and connections to the screen’s internal data lines.
Cellular communications hardware seems very sophisticated and expensive compared to a simple microcontroller.
Neywiny 20 hours ago [-]
Other commentator covered it a bit but BOM cost is a negligible percentage
Shank 1 days ago [-]
PCBWay will make anything you send them for reasonable pricing. Custom boards etc are not at all hard to manufacture, and for the amount of money you can get, of course you can team up with someone. I think the most people overestimate the cost of bespoke PCB creation.
They did, in fact, appear to mass-manufacture a custom-built flat flex implant with cellular (LTE-M!), eSIM, and everything that hid right inside the Ledger, sniffing the SPI reads to the display to read the recovery phrases it pukes out and send 'em over cellular to the ringleader.
It's an EXTREMELY well built implant. I'm impressed. Multiple revisions, even.
The money's too hot to not build shit like this and slip it into the stream. Even a few thousand in R&D netting a six figure ROI is worth it, getting millions is just the icing.
Freeaqingme 1 days ago [-]
I'm guessing the best way to go about self custody these days is to have a multi sig wallet, based on multiple hardware wallets from different vendors.
scrlk 1 days ago [-]
I wouldn't trust any of the hardware wallet vendors. Pretty much all of them have had customer data leaks, resulting in wrench attacks.
You're better off just having a dedicated laptop for crypto transactions.
wongarsu 1 days ago [-]
Hardware wallets have a huge target on their back. They are great for convenience, but once you are using multiple for muli-sig you can have more security with less hassle with an airgapped old laptop or a hand-stamped piece of metal you keep in a safe
sunshine-o 1 days ago [-]
What always surprised me is there aren't many implementations of multisig for EVM based chains.
Actually the only one I know is the Gnosis Safe. Talk about creating a huge risk if it would have a problem.
postalcoder 1 days ago [-]
What a f-ing nightmare. It's stuff like this where I start to understand Apple's stance on right to repair. How do you maintain hardware security without strict provenance over every component in your device?
olalonde 17 hours ago [-]
I wonder if a epoxy/resin potting would solve this sort of attack. Or active tamper response that fries the board if someone tampers with the case.
whywhywhywhy 1 days ago [-]
Can see why hardware wallets seemed a good idea at the time but history has shown this is a terrible way to self custody. Compromised devices aside, the KYC data leaks have put people in danger too.
woadwarrior01 1 days ago [-]
Ledger has had three data leak incidents: once in 2020, a software supply chain attack in 2023 and another data leak in 2026. This latest one is the fourth.
Even if one were to ignore the latest incident, which arguably isn't their fault, the first three incidents make up a pretty bad security track record.
How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
Slartie 4 hours ago [-]
> the latest incident, which arguably isn't their fault
I'd not release them soo easily from their share of responsibility. Tamper-proof hardware is a thing, electronic funds transfer terminals for example already implement ways to detect or prevent physical intrusion into safety-relevant parts of the device. Would probably have cost a few cents in manufacturing to add countermeasures to physical modification into the Ledgers. The fact that there is not even the slightest attempt at securing the device against this kind of attacks is entirely on the manufacturer.
> How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
Surely you can name a dozen of US companies that have been driven out of business by enforcement of EU privacy laws. But I'd be glad if you'd at least name a single one!
1 days ago [-]
jmakov 1 days ago [-]
So HW passkeys in general can also be compromised?
dauertewigkeit 1 days ago [-]
Funny how all the rules of capitalism break down as you approach really big sums of money.
pjc50 1 days ago [-]
The #1 rule that you keep what you can get away with just seems to apply a lot harder. See also the Abramovich/Deloitte story on HN today.
Cytobit 1 days ago [-]
What is the use case of a hardware cryptocurrency wallet besides trapping bitcoins in the Shadow Realm?
numpad0 1 days ago [-]
Like any HSMs, to put private keys in it and to let things be signed with it.
mitxela 1 days ago [-]
Making sure malware on your PC can't steal your private keys.
buckle8017 1 days ago [-]
The tweet doesn't say that ledger installed the chip.
This is some D grade trash writing.
wartywhoa23 1 days ago [-]
[flagged]
astverskoy 1 days ago [-]
Crypto is a gift to scammers: billions stolen, victims left with little recourse, and no effective government oversight.
dgellow 1 days ago [-]
And yet on this exact website people critical of the industry were ridiculed with the exact same rhetoric adopted by the AI industry. It was touted by so many as inevitable, and how we will all be left behind if we don’t join the cult
brokensegue 1 days ago [-]
I think hn was generally more skeptical of crypto then AI
dgellow 19 hours ago [-]
It really depends the year, but yes, overall I think that’s correct, a majority rejected the crypto bull narrative. While also a significant number of people were pushing it. the same money behind the crypto push has been behind the AI push. And the same peer pressure arguments are used
If one would make a list of things that can go wrong, starting from the supply chain that delivers parts to the manufacturer, malicious employees at the manufacturer, mistakes the manufacturer can make, attacks on the delivery chain from the manufacturer to the user, to mistakes the user can make creating, using and storing their keys - the list would contain hundreds of points.
Nothing in this world tends to be "the solution", everything has tradeoffs.
Say you want to do self-custody, what is then the best option? "Don't do self-custody" obviously isn't the solution, as the core use case here is self-custody, so what in your opinion is a better way, than hardware wallets?
If there is nothing better today than hardware wallets, then for now, they are "one of the better solutions" for how to do self-custody, even with the current tradeoffs. But again, I'm eager to hear what the alternatives are.
From a bird's-eye perspective, 3 things are needed: Create a key, derive an address from the key, store the key.
Creating a key safely is possible with dice. You would probably create a seed phrase instead of a key directly, but for this discussion it is the same.
Deriving an address from the key is hard and I have not yet seen a good protocol on how to do it. I have read through a bunch of descriptions of how people do it and they are all weak and brittle. The most popular seems to be "I order a hardware wallet and follow the instructions that come with it". But even people who put a lot of thought into it come up with weak and brittle approaches. I would think there is a way to do it safely. But I have never seen a description of one yet. It might involve multiple computers, multiple software implementations and a hell of a lot of work to create a multisig that is not prone to a single attack vector.
Storing the key is probably the hardest. The most popular way seems to be to store it in a drawer or a safe. So now those coins are just as safe as a piece of gold would be. Or they use a multisig and store the keys in multiple locations. Quite painful. As you have the ongoing problem of keeping those locations accessible and safe at the same time.
Again, "best solution we have available" for self-custody is hardware wallets, so we're back to square one.
Imagine if I tried to discuss and argue about things like this on a TypeScript submission? "No, this won't actually solve the problems of TS" I say, "What is the solution then?" someone asks me and I reply "There is no real solutions to those problems, just use Clojure, problems avoided!", completely missing the point.
Actually 2FA, hardware biometrics, behaviour based fraud prevention and personal confirmation of suspicious transactions. If you’re using credit they can refund fraudulent transactions, and there is the chargeback mechanism. This is probably banking system dependent, but in AUS there is a refund mechanism for mistaken/fraudulent traditional bank transactions.
BTC has effectively none of the safety net, and humans are fallible. We need the safety net. It’s the hugest barrier to adoption. Exchanges do a far better job of managing the risks than trusting your wealth to a hardware wallet.
In systems with a basis in technology, final means final. If the North Koreans take your money, your money is taken.
This piece from Patrick mcKenzie explains this well https://www.complexsystemspodcast.com/episodes/the-900m-wire...
I have yet to see a single one, not one, that had a system of custody that did not allow any one of hundreds of people, most not even employees, to walk away with all of the funds.
There are no standards for security that apply to crypto custodians and the mostly fail to do the bare minimums.
If you use even a top ten custodian, operate under the assumption that the funds are in multi billion dollar plaintext wallets sitting on AWS servers the whole team has ssh access to from the same laptops they "npm install" random shit to all day.
Honestly if you do not feel confident custodying crypto yourself, you should probably not own any.
https://de.fi/rekt-database
Basically, he was now just a safe cracker. He is a a locksmith, but 100% of his full time hours are cracking safes. He didn’t even carry around the stuff in his van to repin a lock. He gave me mates rates but the shop had to do it.
This man was attending multiple callouts, per day, to crack into a safe. Because of, you guessed it, human fallibility.
In a city with with millions of people, basically a hundreds of people needed a single locksmiths service because they had locked themselves out of there own “personal store of wealth”.
I’ve heard zero such examples through traditional banking, with the exception of stolen cards.
An ordinary MacBook does not have that issue. If you are a high-value target, you can further decrease your risk profile by buying it from a random physical store, further preventing targeted attacks.
In retrospect @gigachad’s summary is worth as much as both articles combined, but for the Clauded technical source (with pictures!) that Ledger’s Claude-release refers to: https://www.tibane.net/research/ledger-nano-x-implant
If there was one, someone would write down the steps necessary and put them on the internet. But I have never seen a sound description of how to self-custody Bitcoin in a safe way.
The hardest part seems to not even be the one that currently creates all those problems - the hardware and software used. The hardest part is storing the key (for example a seed phrase). If anyone says they know a way to safely store Bitcoin, my first question is: How do you store the key?
The wipe the device, use any non-debian other linux (or BSD) to generated the 2-of-2 wallet key.
What do you use to access your bank account online? I use my laptop, or my phone.
For inter-bank transactions involving a scam that causes the customer to “voluntarily” send money it depends on the rail. But US ACH rules cover reversals due to fraud and have pretty substantial rules about it.
I almost fell for a strange scam a while ago. A Steam user by the same name as one of my existing steam friends added me. I assumed it was his second account and accepted. A few days later, he messages me, asking me to participate in a DOTA2 tournament. I had previously played DOTA2 with this person, he spoke to me in our shared native language which is not English and everything seemed in order. I said I haven't played DOTA2 in years so I'm beyond rusty, he said I don't have to play, they just need me to register so they have a full team for the signups and then they'll find someone else to play before the tournament starts. Sent me a link to a website requiring a signup and I can't remember what it was now but there was something about the signup that irked me. Maybe it was just creating a account, maybe it required a credit card or something I can't remember but I ended up looking at my steam friends list and noticed both the accounts were online. So I sent a message to the other account asking if this is them, he said no and then I noticed the same scammer had added another mutual friend so I messaged them too warning them about it.
That's the closest I've been to getting scammed that I can recall. I'm not sure what the scammer would gain from my signing up but I'm sure they had some kind of profit angle.
Seriously, that's why we have banks, still.
Next is a hold on your suspicious transaction, request additional documents for your own money, basically a lot of AML and KYC before you can use what’s yours.
I understand the reason why they do this but it feels to me you are no longer in control of your money/property and somehow they fail to catch people loading billions from shady sources so I would rather not keep my money in a bank (at least not a retail bank) if I had a sensible option.
Most people don’t care about this until they get trapped just like most people are /were OK with Paypal and other junk services.
The actual reason to discount this is that account shutdowns are flashy rare events that reliably summon HN outrage, and so the kind of person who posts here overweights how likely they are, at least for people not on the margins of society. (If that weren't the case, the system wouldn't work and normal people wouldn't use it.)
We're dealing with reasonably sophisticated state actors here in this dark forest; not script kiddies.
Cheap $5 PCB + programmable small FPGA is a very viable route too for hardware implants; but even a microcontroller / ESP32/etc will probably do.
Cellular communications hardware seems very sophisticated and expensive compared to a simple microcontroller.
Eg. https://dangerousthings.com/products/apex-flex?Antenna=Narro...
They did, in fact, appear to mass-manufacture a custom-built flat flex implant with cellular (LTE-M!), eSIM, and everything that hid right inside the Ledger, sniffing the SPI reads to the display to read the recovery phrases it pukes out and send 'em over cellular to the ringleader.
It's an EXTREMELY well built implant. I'm impressed. Multiple revisions, even.
The money's too hot to not build shit like this and slip it into the stream. Even a few thousand in R&D netting a six figure ROI is worth it, getting millions is just the icing.
You're better off just having a dedicated laptop for crypto transactions.
Actually the only one I know is the Gnosis Safe. Talk about creating a huge risk if it would have a problem.
Even if one were to ignore the latest incident, which arguably isn't their fault, the first three incidents make up a pretty bad security track record.
How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
I'd not release them soo easily from their share of responsibility. Tamper-proof hardware is a thing, electronic funds transfer terminals for example already implement ways to detect or prevent physical intrusion into safety-relevant parts of the device. Would probably have cost a few cents in manufacturing to add countermeasures to physical modification into the Ledgers. The fact that there is not even the slightest attempt at securing the device against this kind of attacks is entirely on the manufacturer.
> How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
Surely you can name a dozen of US companies that have been driven out of business by enforcement of EU privacy laws. But I'd be glad if you'd at least name a single one!
This is some D grade trash writing.