Cold wallet hack: only default passwords are at risk
A security breach at a hardware wallet maker affects only users who kept the default password. Ledger and Trezor are unaffected.
English · Original discussion in Spanish · Published
Cold wallet theft: the myth of offline security deflates
A security incident at a hardware wallet manufacturer has cast doubt on the untouchability of cryptocurrencies stored in cold storage. The scare, however, comes with nuances: the exposure only affects those who kept the device's default password. Everyone else, using their own passwords or a passphrase, hasn't noticed a thing.
Which users are actually exposed
The breach occurred at one specific company that made these devices. Anyone who bought that hardware and did not change the initial password is the target. Those using Ledger, Trezor or other brands have suffered no theft whatsoever. Nor have those who use a passphrase or multisig setups. In other words, this is a problem of basic hygiene, not of the technology itself.
Entropy, the pending lesson
The discussion has turned to how to generate truly unpredictable keys. Some recommend rolling dice at home and entering the results into the software, rather than trusting random number generators. Some even recall that old statistics textbooks came with very useful tables of random numbers. A return to the analog world to protect the digital one.
While we wait for the manufacturer to detail the real scope of the leak, what remains is an uncomfortable suspicion: if a supposedly offline key can be stolen from within, Bitcoin's security depends more on the human link than on the code. And that still doesn't sit well with many people.
A security incident at a hardware wallet manufacturer has cast doubt on the untouchability of cryptocurrencies stored in cold storage. The scare, however, comes with nuances: the exposure only affects those who kept the device's default password. Everyone else, using their own passwords or a passphrase, hasn't noticed a thing.
Which users are actually exposed
The breach occurred at one specific company that made these devices. Anyone who bought that hardware and did not change the initial password is the target. Those using Ledger, Trezor or other brands have suffered no theft whatsoever. Nor have those who use a passphrase or multisig setups. In other words, this is a problem of basic hygiene, not of the technology itself.
Entropy, the pending lesson
The discussion has turned to how to generate truly unpredictable keys. Some recommend rolling dice at home and entering the results into the software, rather than trusting random number generators. Some even recall that old statistics textbooks came with very useful tables of random numbers. A return to the analog world to protect the digital one.
While we wait for the manufacturer to detail the real scope of the leak, what remains is an uncomfortable suspicion: if a supposedly offline key can be stolen from within, Bitcoin's security depends more on the human link than on the code. And that still doesn't sit well with many people.
Also available in: Deutsch
Summary of a discussion on Burbuja.info - Foro de economía, actualidad y política., translated from Spanish and reviewed before publication. Read the full discussion (35 replies).
More summaries
-
Ozempic: Forum suggests weight regain is inevitable
According to a forum, Ozempic alone cannot cure morbid obesity, and when treatment ceases, the weight rebounds; public prescription requires strict criteria.
-
Maricarmen decree: expropriate homes from tenants over 70
Sumar's draft decree would let authorities expropriate a home if the tenant is over 70. The industry warns: fewer rentals for older people.
-
Marina D'Or: Spain's next property boom on the Mediterranean?
Apartments in Marina D'Or, Spain, from 120,000 euros. Could they double in price within 4 years? We look at the prediction and the precedents of Torrevieja and Benidorm.
-
The economic paradox behind the Pope's migration rhetoric
The Pope calls for welcoming migrants while the Vatican takes in not a single one. The economic paradox of a message that clashes with the Church's financial reality.
-
Signature drive launched to curb the EU's drift
The Save Europe Act platform is calling for 21,600 signatures a day to make the EU respect national identities. A citizen movement or wishful thinking?
-
The ultrasound-in-cinemas conspiracy theory doesn't hold up
The conspiracy theory about ultrasound in cinemas is met with irony and skepticism. A hoax that distracts from the real economy.