Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 68 posts

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#11

Post by lazide »

fadys wrote: post #3

I want to make it clear that the Ledger passphrase, on paper, and hidden, was not ever accessed. And, even if it was, which it wasn't, his Trust Wallet on his iPhone was also compromised. How can someone guess both passphrases, from separate wallets, in separate locations with different words? It's literally impossible. Whatever technology is used to generate the passphrases in each of those wallets must be compromis…

Was his ledger manipulated or compromised in some way before using it? Was the seed already pregenerated? Was the paper actually compromised, or some other system got the data?

There are plenty of other ways.

You keep saying it is impossible the paper was accessed, but that doesn’t mean it wasn’t- or the information got compromised another way.

Did he print it out from a common machine?

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#12

Post by fadys »

menmob wrote: post #10

Has to be someone close to him who knew about both. I seriously doubt someone compromised ledger’s security and only stole $40k.

It's literally no one close to him. Please take that as a fact. The paper with the seed words was written a few years ago. It has been hidden since.

I'm willing to bet we'll be hearing about more people getting their wallets wiped clean.

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#13

Post by fadys »

lazide wrote: post #11
fadys wrote: post #3

I want to make it clear that the Ledger passphrase, on paper, and hidden, was not ever accessed. And, even if it was, which it wasn't, his Trust Wallet on his iPhone was also compromised. How can someone guess both passphrases, from separate wallets, in separate locations with different words? It's literally impossible. Whatever technology is used to generate the passphrases in each of those wallets must be compromis…

Was his ledger manipulated or compromised in some way before using it? Was the seed already pregenerated? Was the paper actually compromised, or some other system got the data? There are plenty of other ways. You keep saying it is impossible the paper was accessed, but that doesn’t mean it wasn’t- or the information got compromised another way. Did he print it out from a common machine?

He wrote the words on paper, away from any other devices, years ago.

The Ledger came from Ledger (the company) sealed in its packaging.

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#14

Post by jiehong »

fadys wrote: post #9
jiehong wrote: post #6

If one pass phrase was stored as a screenshot on his iPhone (which is automatically stored on iCloud without much encryption), I have little faith about the certainty of his paper words having never been accessed. Anyways, either someone had access to his hardware wallet and had a copy of that paper at the time of the theft, either wallets are insecure. If wallets were that insecure, more complains and warnings would…

That's partly why I'm posting this here. There must be something else going on. The paper with the seed words WAS NOT accessed.

Plus, if someone has a copy of his recovery words, they would be able to actually recover / clone his hardware wallet I think, because that’s what they are for.

If your nephew didn’t access that paper for years, it doesn’t mean someone hasn’t. Was it stored in a box with glitter nail polish on the lid ? Just something that can prove the location wasn’t opened without his knowledge. Believing it, is not enough.

Could he has noted those words on a block notes and the piece of paper below it recorded an imprint of those words that were recovered be someone else?

Have fun being a Sherlock! But I guess not much can be done.

Not sure the police would consider such a case as a valid theft (at least not yet)

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#16

Post by 627467 »

"appear compromised" should be reserved to when multiple unrelated instances occur with no direct relation.

While you describe plenty of recent facts, from the "he has spent years earning it" I take the wallets were setup years ago and honestly, I would not trust even myself on operational security of a single device/passphrase that I may regularly use.

Are you really sure that a given iphone has never "left his possession"? Was it locked in a safe the entire time?

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#17

Post by fadys »

jiehong wrote: post #14
fadys wrote: post #9

Earlier quoted context omitted.

That's partly why I'm posting this here. There must be something else going on. The paper with the seed words WAS NOT accessed.

Plus, if someone has a copy of his recovery words, they would be able to actually recover / clone his hardware wallet I think, because that’s what they are for. If your nephew didn’t access that paper for years, it doesn’t mean someone hasn’t. Was it stored in a box with glitter nail polish on the lid ? Just something that can prove the location wasn’t opened without his knowledge. Believing it, is not enough. Could…

Can you imagine a scenario where you secretly write some words down on paper, three years ago, near no devices, and you store it somewhere where you absolutely know for sure no one will ever access? I can imagine such a scenario for myself.

That's what he did.

Then we have the whole Trust Wallet compromise on his iPhone.

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#19

Post by fadys »

627467 wrote: post #16

"appear compromised" should be reserved to when multiple unrelated instances occur with no direct relation. While you describe plenty of recent facts, from the "he has spent years earning it" I take the wallets were setup years ago and honestly, I would not trust even myself on operational security of a single device/passphrase that I may regularly use. Are you really sure that a given iphone has never "left his poss…

It's a wallet on his phone and a hardware wallet. Both were wiped clean at about the same time.

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#20

Post by [deleted] »

fadys wrote: post #9
jiehong wrote: post #6

If one pass phrase was stored as a screenshot on his iPhone (which is automatically stored on iCloud without much encryption), I have little faith about the certainty of his paper words having never been accessed. Anyways, either someone had access to his hardware wallet and had a copy of that paper at the time of the theft, either wallets are insecure. If wallets were that insecure, more complains and warnings would…

That's partly why I'm posting this here. There must be something else going on. The paper with the seed words WAS NOT accessed.

[deleted]
Post reply on HN