Cryptocurrency Hardware Wallets Can Get Hacked Too

An anonymous reader writes: Whether you think cryptocurrency is a scam or a salvation, those digital coins can store real-world value. The safest place to keep them is in what's known as a "hardware wallet," a device like a USB drive that stores your currency and private keys locally, without connecting to the internet. But "safest" doesn't mean "perfect," which new research into two popular hardware wallets reinforces all too well. Researchers from Ledger -- a firm that makes hardware wallets itself -- have demonstrated attacks against products from manufacturers Coinkite and Shapeshift that could have allowed an attacker to figure out the PIN that protects those wallets. The vulnerabilities have been fixed, and both hacks would have required physical access to the devices, which minimizes the danger to begin with. But Ledger argues that it's still worth holding hardware wallets to the highest standards, just as you would a closet safe. Shapeshift's fix can be found here. Meanwhile, Coinkite's Coldcard Mk2 flaw has been fixed in the company's current Coldcard model Mk3, which started shipping in October.

Who knew

[nonBORG]

This was obvious to everyone with a brain. They are a gimmick, they are just a little computer that runs software.

Re:

[_Sharp'r_]

The safest place to keep them is in what's known as a "hardware wallet,"

Ummm.... no. The safest place to keep them is in multiple locations, encrypted.

If the only place you've stored your crypto is on a single hardware device, then eventually you're going to have no more crypto. Hardware failure alone is more likely than proper encryption being broken in one of your multiple disparate locations.

Re:

[arglebargle_xiv]

Who would have thought that a bunch of random guys with no experience in building an HSM, or probably any kind of secure hardware at all, would create a insecure "hardware wallet"? I've worked in that field before - uhh, HSMs, not "hardware wallets" - and the amount of work that goes into them, and the level of attacks they can withstand, is impressive. However, there's only a handful of people who have the right mindset to do that sort of stuff, and some random crowd on Kickstarter ain't it.

I have some $20 bills in my (physical) wallet

[Rick Schumann]

Try hacking that. xD
Pre-emptive strike on the whole "carrying cash is dangerous, AAAH!" genre of comments; save your keystrokes. I don't live in a crime-ridden area where you have to worry about being mugged.

Re:

[Rick Schumann]

TL, DR

Re:

[golgotha007]

All of these attack types on hardware wallets require physical access to them for the hacks to work, so I'm not sure what you're on about. I can tell you that a hardware wallet is a heck of lot safer than some raw $20 that anyone can steal and spend. Keep your tree money and don't forget to clean up after your horse on your way out.

Re:I have some $20 bills in my (physical) wallet

[golgotha007]

Haha, no not upset just having some fun. I highly recommend you check out some youtube videos by Andreas Antonapoulos, especially one titled "Introduction to Bitcoin". It might give you the big picture you might be looking for.

Good luck!

Re: I have some $20 bills in my (physical) wallet

[NagrothAgain]

Sounds a lot like one of those "buy my book to learn how to make money selling books to people!" scams. Except it's "how to make Ad money from YouTube videos about cryptocurrency when your actual cryptocoins don't do it!"

Re:

[Rick Schumann]

Since we're being real (which I appreciate): I just don't see where I have a need for it, not as 'currency'. I see some people treating it like an 'investment', but even if I had money to invest in anything (which I don't) it's not only too volatile, it's apparently not secure either.
Then, I wasn't kidding about the criminal-use aspect. It's become the currency-of-choice for criminal activities. For that reason alone I'd rather just steer clear of it.
I honestly did look at it when Bitcoin first started up

Re:

[TheRealMindChild]

It's become the currency-of-choice for criminal activities.

Moreso than cash? You got a source on that? Probably not

I honestly did look at it when Bitcoin first started up

So you haven't even thought about it in practically a decade? Nothing more than an armchair neckbeard. Not even authentic

Re:

[Rick Schumann]

Moreso than cash? You got a source on that? Probably not

Do you *never* read the news at all? Not even here?
Two examples:
1. 'Dark web' dealings
2. Ransomware

So you haven't even thought about it in practically a decade?..
LOL define 'think about it'. I read about it all the time. I have no interest in getting involved with it. Why should I? No reason to.
Now go troll someone else, you're boring.

Re:

[TheRealMindChild]

Do you *never* read the news at all?

What news would that be? Slashdot is a dying news aggregation site. You can hardly use that as a source of information. So... you don't have a source. Got it.

I read about it all the time. I have no interest in getting involved with it. Why should I? No reason to

From those sources you can't cite? Like I said, you aren't even on Comic Book Guy level of neckbeard. You are just a poser.

Now go troll someone else, you're boring.

Clearly I'm not boring enough to ignore.

Don't wrestle with a pig

[raymorris]

Have you ever heard the expression "don't wrestle with a pig. You both get all muddy and the pig likes it"?

I appreciate your attempt at intelligent conversation.
It seems that attempt is one-sided today.

Re:

[Rick Schumann]

That's pretty much par for the course with the internets anymore.

Re:

[tlhIngan]

All of these attack types on hardware wallets require physical access to them for the hacks to work

They better, because otherwise what's the point of a hardware wallet?

And it's not really a hardware wallet - the wallet is still software based as it's part of the cryptocurrency network. All it records is movement of things between wallets, after all. The hardware wallet instead records the private keys associated with the wallet - the goal is to keep those private keys offline so even if your PC or phone is

Slashdot unaccessable from Chrome on windows

[mestar]

The "We value your privacy" dialog does not respond to mouse clicks.

open console and do this.

for( var x in document.querySelectorAll("a")) { if( x.text == "I ACCEPT") c.click()}

Any usb stored crypto ever reported stolen?

[Way Smarter Than You]

And I mean by a stranger / "hacker" not a family member with easy daily access to the home.

I've never heard of such happening. Lost USB stick, yes, but stolen and crypto stolen, no.

No need to worry!

[atif_munawar]

I was browsing a website [snipon.com] and saw the ad of a bitcoin hardware wallet. I quickly browsed some of the top bitcoin hardware wallets available in the market. This video [youtube.com] on youtube helped me out to pick my bitcoin wallet. After reading the post by Wired I did extensive research to find out the truth behind bitcoin hardware hacking. There are very few cases related to a vulnerable bitcoin hardware wallet.