I saw a YT video last night from a #crypto holder that…
1 reactions
I saw a YT video last night from a #crypto holder that claims his #hardwarewallet got hacked and he lost some three-million dollars worth of # #Bitcoin . This sounds more like user error, not a genuine 'hack.theft.' A #coldwallet not connected to the internet is very secure.
Here are some points on the matter:
A hacker can steal crypto from a cold (hardware) wallet by primarily exploiting user errors through social engineering, or by executing sophisticated physical attacks on the device itself. The offline nature of cold wallets makes them highly secure against remote network hacks, but not entirely impenetrable if an attacker gains physical access or tricks the user into compromising security.
Primary Attack Vectors
Compromised Recovery (Seed) Phrase :
The most common way funds are stolen is when users inadvertently expose their 12- or 24-word recovery phrase (mnemonic phrase).
Phishing Scams :
Hackers create fake websites or send malicious emails (e.g., posing as customer support) that trick users into entering their seed phrase online.
Insecure Storage :
Storing the seed phrase in an unencrypted digital format (e.g., a photo on a phone, a text file, or a password manager) connected to the internet makes it vulnerable to malware and remote access.
Physical Theft of Seed Phrase :
If a hacker or thief physically finds the written-down seed phrase (e.g., in a sock drawer or standard paper) they can restore the wallet on their own device and drain the funds.
Malware on a Connected Computer :
When you connect your hardware wallet to a computer or smartphone to sign a transaction, the host device might be compromised with malware.
Address Swapping :
Malware can monitor the clipboard and, when a legitimate wallet address is copied, replace it with the hacker's address. If the user doesn't carefully verify the entire address on the hardware device's screen before confirming, the funds will be sent to the hacker.
Blind Signing Malicious Contracts :
Users can be tricked into "blind-signing" malicious smart contracts that grant an attacker full access or unlimited token allowances to their wallet. This usually happens when interacting with a fake or compromised decentralized application (dApp).
Physical Device Theft and Tampering :
Physical Attacks :
Sophisticated attackers can use specialized techniques like power glitching or side-channel analysis to extract private keys from the device's secure chip. These attacks require physical possession and advanced technical knowledge.
Supply Chain Attacks :
A hacker might compromise the device during manufacturing or shipping, installing malicious firmware before it even reaches the user. Users should only buy directly from the official manufacturer or authorized resellers to mitigate this risk.
Coercion :
An attacker might use physical force to compel the owner to unlock the device with their PIN or reveal their passphrase.
Key Takeaway
The primary point of failure for cold storage security is usually human error or an attack that bypasses the offline security by targeting the user's behavior or the seed phrase backup. A properly used and secured cold wallet (with the seed phrase stored offline and securely) offers very strong protection against most threats.
Here are some points on the matter:
A hacker can steal crypto from a cold (hardware) wallet by primarily exploiting user errors through social engineering, or by executing sophisticated physical attacks on the device itself. The offline nature of cold wallets makes them highly secure against remote network hacks, but not entirely impenetrable if an attacker gains physical access or tricks the user into compromising security.
Primary Attack Vectors
Compromised Recovery (Seed) Phrase :
The most common way funds are stolen is when users inadvertently expose their 12- or 24-word recovery phrase (mnemonic phrase).
Phishing Scams :
Hackers create fake websites or send malicious emails (e.g., posing as customer support) that trick users into entering their seed phrase online.
Insecure Storage :
Storing the seed phrase in an unencrypted digital format (e.g., a photo on a phone, a text file, or a password manager) connected to the internet makes it vulnerable to malware and remote access.
Physical Theft of Seed Phrase :
If a hacker or thief physically finds the written-down seed phrase (e.g., in a sock drawer or standard paper) they can restore the wallet on their own device and drain the funds.
Malware on a Connected Computer :
When you connect your hardware wallet to a computer or smartphone to sign a transaction, the host device might be compromised with malware.
Address Swapping :
Malware can monitor the clipboard and, when a legitimate wallet address is copied, replace it with the hacker's address. If the user doesn't carefully verify the entire address on the hardware device's screen before confirming, the funds will be sent to the hacker.
Blind Signing Malicious Contracts :
Users can be tricked into "blind-signing" malicious smart contracts that grant an attacker full access or unlimited token allowances to their wallet. This usually happens when interacting with a fake or compromised decentralized application (dApp).
Physical Device Theft and Tampering :
Physical Attacks :
Sophisticated attackers can use specialized techniques like power glitching or side-channel analysis to extract private keys from the device's secure chip. These attacks require physical possession and advanced technical knowledge.
Supply Chain Attacks :
A hacker might compromise the device during manufacturing or shipping, installing malicious firmware before it even reaches the user. Users should only buy directly from the official manufacturer or authorized resellers to mitigate this risk.
Coercion :
An attacker might use physical force to compel the owner to unlock the device with their PIN or reveal their passphrase.
Key Takeaway
The primary point of failure for cold storage security is usually human error or an attack that bypasses the offline security by targeting the user's behavior or the seed phrase backup. A properly used and secured cold wallet (with the seed phrase stored offline and securely) offers very strong protection against most threats.
1
| 5,000 mlx | |
| 13 | |
| 1 |