Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 68 posts

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#31

Post by jackcodes »

fadys wrote: post #25
_fzslm wrote: post #22

to everyone saying it's someone the nephew knew that stole the crypto, it can't be, right? because OP confirmed the thief's address had transactions from other addresses, so this seems like a remote adversary. i'm very sorry to hear he lost $40k, especially because he was saving it for college... i can't even imagine that much money being a student so i just hope you guys can find some way to work this out... i guess…

Your first point is spot-on. But about the rest...the Ledger's wallet's seed words were on paper, never seen by a computer after it was generated. His Trust Wallet, however, did have his seed words on his phone. But again, it has a 6-digit passcode.

Is the seed phrase on his trust wallet the same seed phrase as his ledger?

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#32

Post by gruez »

doggosphere wrote: post #4

Simplest explanation is the most likely. Both wallets were accessed at the same time, indicating seed words for both wallets were exposed. Regardless of what your nephew remembers, or believes about how he handled his seeds, someone got access to that data. One culprit could be cloud hosting like iCloud, google docs, dropbox, etc.

> Simplest explanation is the most likely.

not to mention, there's probably ledger wallets holding much more than that. think bitcoin whales or HODLers from 2012. If they really had a 0day they certainly wouldn't be wasting it on some kid with only $40k in crypto holdings. If they did, it would be part of some sort of coordinated attack that everyone would be reporting.

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#33

Post by lacker »

It's possible that those wallets are compromised, but it's quite strange that both of them would be compromised at the same time. It's also strange that someone in possession of a compromise for one of these wallets would use it for merely $40,000.

To me it seems more likely that your nephew is mistaken about some aspect of this story. Perhaps he used some malicious software and subsequently forgot about it. Either way, there is nothing that can be done.

In the future, your nephew would be better off using traditional saving methods rather than self-controlled cryptocurrency. If he can't figure out what he did wrong, it's likely he won't be able to prevent it from happening again.

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#34

Post by fadys »

jackcodes wrote: post #31
fadys wrote: post #25

Earlier quoted context omitted.

Your first point is spot-on. But about the rest...the Ledger's wallet's seed words were on paper, never seen by a computer after it was generated. His Trust Wallet, however, did have his seed words on his phone. But again, it has a 6-digit passcode.

Is the seed phrase on his trust wallet the same seed phrase as his ledger?

No. (I know).

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#35

Post by doggosphere »

fadys wrote: post #17
jiehong wrote: post #14

Earlier quoted context omitted.

Plus, if someone has a copy of his recovery words, they would be able to actually recover / clone his hardware wallet I think, because that’s what they are for. If your nephew didn’t access that paper for years, it doesn’t mean someone hasn’t. Was it stored in a box with glitter nail polish on the lid ? Just something that can prove the location wasn’t opened without his knowledge. Believing it, is not enough. Could…

Can you imagine a scenario where you secretly write some words down on paper, three years ago, near no devices, and you store it somewhere where you absolutely know for sure no one will ever access? I can imagine such a scenario for myself. That's what he did. Then we have the whole Trust Wallet compromise on his iPhone.

That's what you believe he did.

He may have taken a photo of it. Maybe left it out on the table when a friend was over. Maybe wrote a text copy as backup and forgot he ever did that.

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#39

Post by gruez »

fadys wrote: post #19
627467 wrote: post #16

"appear compromised" should be reserved to when multiple unrelated instances occur with no direct relation. While you describe plenty of recent facts, from the "he has spent years earning it" I take the wallets were setup years ago and honestly, I would not trust even myself on operational security of a single device/passphrase that I may regularly use. Are you really sure that a given iphone has never "left his poss…

It's a wallet on his phone and a hardware wallet. Both were wiped clean at about the same time.

>>Are you really sure that a given iphone has never "left his possession"? Was it locked in a safe the entire time?

>It's a wallet on his phone and a hardware wallet

But what about his hardware wallet backup, which was on paper?

Re: Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

#40

Post by gruez »

jackcodes wrote: post #31
fadys wrote: post #25

Earlier quoted context omitted.

Your first point is spot-on. But about the rest...the Ledger's wallet's seed words were on paper, never seen by a computer after it was generated. His Trust Wallet, however, did have his seed words on his phone. But again, it has a 6-digit passcode.

Is the seed phrase on his trust wallet the same seed phrase as his ledger?

AFAIK the seed phrase is randomly generated when you initialize the wallet.
Post reply on HN