A hardware device wallet is a physical device designed specifically for storing cryptocurrency and is considered an important means of safely storing crypto assets. Its built-in security chip stores private keys offline, ensuring users have complete control over their cryptocurrency. Hardware device wallets typically operate offline, further reducing the risk of cyber hackers.
However, despite the general lack of understanding among the investor community, there are still a large number of fraud incidents targeting novice users, resulting in the loss of their assets stored in hardware device wallets. This article will introduce two common methods of currency theft from hardware device wallets—hardware device wallet manual scams and hardware device wallet modification disguise scams.
Hardware Device Wallet Instructions Scam
The core of this type of currency theft method is to take advantage of ordinary investors' ignorance of how to use hardware device wallets, and mislead victims to transfer funds to phishing addresses by replacing false instructions. The victim purchased a hardware device wallet from a third-party e-commerce platform. After opening the package, he opened the hardware device wallet according to the "Initial Pin Code" marked on the "Instructions" and backed up the "Mnemonic" printed on the "Instructions". After that, a large amount of money was deposited into the wallet address, which was eventually stolen.
Source: ForesightNews
The reason is not that the wallet was cracked at the hardware device level, but that the coin thieves obtained the address mnemonic by activating it in advance, forged false instructions for secondary packaging, and then sold the activated hardware device wallet through unofficial channels. To the victim, once the target transfers crypto assets to the address, they will enter the standard fake wallet currency stealing process.
Similar risks exist in the secondary market in the Chinese-speaking region. Imkey, a well-known hardware device wallet manufacturer, once issued a reminder-it was found that some unofficial stores were selling "activated" hardware device wallets while tampering with the user manual to trick users into using their wallets. The funds are deposited into the wallet address created in advance by the evil merchant. It can be seen that the importance of identifying the official e-commerce store is equivalent to identifying the official website.
Source: ForesightNews
Hardware device wallet device has been modified
A Ledger user received a package containing a brand new Ledger X hardware wallet and an accompanying letter without placing an order. The letter stated that due to a cyber attack on Ledger, which resulted in user data leakage, new hardware wallet devices were sent to affected customers, and the letter asked users to replace their devices to ensure safety.
Source: ForesightNews
However, the authenticity of the letter is questionable, and Ledger CEO Pascal Gauthier made it clear that the company will not compensate for the accidental leakage of personal data. The user also said that this was a scam. He shared more pictures and opened the device to show the inside of the plastic box of the hardware device wallet. There were obvious signs of tampering.
Source: ForesightNews
In addition, the Kaspersky security team has also reported a case of counterfeiting a Trezor hardware device wallet. The victim purchased a Trezor Model T through unofficial channels, but the internal firmware of the device has been replaced by the attacker, and he will be able to gain access to the device. Users gain access to encrypted assets and then engage in currency theft.
write at the end
It is not difficult to see from the above cases that supply chain attacks against hardware device wallets have become very widespread, and ordinary investors and hardware device wallet manufacturers should be more vigilant about this. Correct usage will effectively avoid the risk of currency theft:
Purchase Hardware Devices from Official Channels Any hardware device wallet purchased from unofficial channels is not safe.
Make sure the wallet is in an unactivated state. Officially sold hardware equipment must be in an inactive state. If the investor finds that the machine has been activated after turning it on, or even the manual prompts an "initial password" or "default address", please deactivate the equipment in time. And give feedback to the hardware device wallet official.
Make sure the address is generated by yourself. In addition to the device startup process, setting the PIN code, generating the binding code, creating the address and backing up the address also need to be completed by yourself. Any operation by a third party will bring financial risks to the user. Under normal circumstances, the hardware device wallet device should be in an unactivated state. That is, when using the hardware device wallet for the first time, starting the device, creating a wallet, backing up the mnemonic phrase, and setting the PIN code should all be completed by the user.
[Disclaimer] There are risks in the market, so investment needs to be cautious. This article does not constitute investment advice, and users should consider whether any opinions, views or conclusions contained in this article are appropriate for their particular circumstances. Invest accordingly and do so at your own risk.
This article is reprinted with permission from: (Foresight News)
Original author: Bitrace