BitsLab’s ScaleBit flags ‘alarming’ Uniswap Wallet vulnerability

January 13, 2025 Coin Telegraph

Scammers share crypto keys aiming to steal from wannabe thieves: Kaspersky

December 24, 2024 Coin Telegraph

Brooklyn DA shutters 40 NFT scam sites after artist loses $135K

December 9, 2024 Coin Telegraph

Dormant Bitcoin wallet moves $536M after over 5-year hiatus

June 11, 2024 Coin Telegraph

Ledger Crypto Hardware Wallet Launches Subscription-Based Backup Service for Secret Recovery Phrases

October 27, 2023 The Daily Hodl

Ledger hardware wallet rolls out cloud-based private key recovery tool

October 24, 2023 Coin Telegraph

Coin Telegraph

Ledger emphasized that the ID checks required for its private key recovery tool are not like KYC checks as they require “much less” information.

Hardware wallet firm Ledger is rolling out its cloud-based private key recovery solution despite facing significant criticism from the crypto community.

Ledger Recover, an ID-based private key recovery service for the Ledger hardware wallet, is launching on Oct. 24, the firm officially announced on X (formerly Twitter). The release comes in conjunction with Ledger finalizing the open-source code for the Ledger Recover on GitHub.

Provided by blockchain protection platform Coincover, Ledger’s seed phrase recovery solution is a paid subscription service allowing users to backup their Secret Recovery Phrase (SRP). SRP is a unique list of 24 words that backs up the private keys and gives users access to their crypto assets.

Ledger Recover was designed for users who “want to add an enhanced layer of resilience” in case their SRP is ever lost or destroyed, Ledger’s chief technology officer Charles Guillemet said. He also emphasized that Ledger Recover is an optional recovery service, adding:

“If you don’t wish to use the service, no worries — it’ll always be 100% optional. You can simply continue using your Ledger as you did previously — nothing will change.”

At launch, Ledger Recover is compatible with Ledger Nano X, with Ledger Stax and Ledger Nano S Plus integration coming in the near future. The solution is not compatible with Ledger Nano S, according to the Ledger Recover FAQ.

Ledger Recover is initially available to passport or identity card holders in the United States, Canada, the United Kingdom and the European Union. “We will be covering more countries and adding support for more documents,” Ledger said.

The firm emphasized that Ledger Recover’s identity verification “is not the same” as Know Your Customer (KYC) checks carried out by centralized crypto exchanges. Ledger noted that its recovery system only requires a “valid, government-issued document,” stating:

“Identity verification inherently collects much less information compared to KYC [...] KYC involves ID verification but it can also include revenue information, record of criminal activity, citizenship check, etc.”

According to social media posts, Ledger Recovery service will be available at $9.99 per month, or about $120 per year. If a user fails to pay the subscription, the subscription will be suspended, allowing the user to reactivate subscription in the next nine months.

“You will need to pay an administration fee of 50 EUR along with any outstanding balance,” Ledger Recover FAQ reads.

The rollout comes months after Ledger paused the recovery service in May 2023 in response to community backlash. Ledger CEO Pascal Gauthier subsequently said that the firm will launch the product once its open source code is released.

Ledger’s largest competitor, Trezor, has stayed away from introducing a cloud-based private key recovery solution, opting for a physical backup solution. Trezor launched its own physical seed phrase recovery tool, Trezor Keep Metal, in mid-October 2023.

Magazine: How to protect your crypto in a volatile market — Bitcoin OGs and experts weigh in

Trezor releases new hardware wallet and metal private key backup

October 12, 2023 Coin Telegraph

Coin Telegraph

Trezor is celebrating its 10th anniversary by releasing three new self-custody products, with a focus on providing entry-level devices.

Trezor, a major provider of hardware cryptocurrency wallets, is celebrating its 10th anniversary by releasing three self-custody products, including a new Trezor wallet, a proprietary private key backup solution and a Bitcoin (BTC)-only wallet.

The Czech Republic-based company officially announced the launch of Trezor Safe 3, its brand-new hardware wallet supporting more than 7,000 cryptocurrencies, on Oct. 12. The firm highlighted that the new wallet launch marks an important milestone in Trezor’s provision of entry-level hardware wallets.

The release of the Trezor Safe 3 wallet comes nearly five years after the hardware wallet firm rolled out the Trezor Model T in February 2018. Retailed for $79, Trezor Safe 3 is available in four colors: solar gold, stellar silver, galactic rose and cosmic black.

*Trezor Safe 3 hardware wallets. Source: Trezor*

The new wallet device maintains Trezor’s commitment to open-source development, applying open-source principles in using the security component, the announcement notes. Trezor has chosen a third-party secure element vendor that allows it to publish any potential vulnerabilities it discovers.

In addition to the Trezor Safe 3, Trezor has also introduced its own physical private key storage solution, Trezor Keep Metal. As previously reported by Cointelegraph, the safety of a seed phrase or a private key is far more important than the safety of a hardware wallet device itself, as users can restore access to the wallet even if a hardware wallet is lost or damaged.

Trezor Keep Metal has much in common with similar physical backup solutions in the market, allowing users to keep their recovery safe under any conditions against fire, water, acids and impacts. The backup tool is made from corrosion-resistant stainless steel with a watertight seal.

*Trezor Keep Metal backup tool. Source: Trezor*

According to Trezor CEO Matej Zak, Trezor Keep Metal is another important component of Trezor’s commitment to enhancing usability to boost global crypto adoption.

“It is very easy to use in the way that it is because all the other solutions usually have some kind of conversion so that you need some numbering system against the word,” Zak told Cointelegraph reporter Gareth Jenkinson in an interview.

“Whereas here, it’s very intuitive in a way that you just punch in the actual letter from the word onto the steel,” the CEO added.

Available for $99, Trezor Keep Metal allows users to store 12-word and 24-word standard backups. The Trezor Keep Metal catering for three 20-word Shamir backups sells for $249.

Finally, Trezor’s Bitcoin-only hardware wallet was released to mark the company’s anniversary, featuring a limited-edition run of only 2,013 devices. In recognition of Bitcoin’s ability to empower individuals in underprivileged and marginalized communities, Trezor will donate $21 from each sale to support the Trezor Academy, a Bitcoin education initiative, the announcement notes.

Founded in 2013, Trezor is one of the largest global providers of hardware wallets, allowing users to store cryptocurrencies like Bitcoin. Trezor’s first wallet, the Trezor One, was released in 2014 and is still for sale, offering the basic functionality of storing multiple coins long-term.

Magazine: Web3 Gamer: Minecraft bans Bitcoin P2E, iPhone 15 & crypto gaming, Formula E

Victim of 90 ETH exploit set to claw funds back after hacker was blacklisted

August 12, 2023 Coin Telegraph

Blacklist wallet

The hacker’s wallet with more than $100K worth of USDT was blacklisted and frozen, while the Victim had been drained for almost $170K worth of NFTs and other assets.

With the help of police and cyber authorities, a victim of a hack worth 90 Ether (ETH) has gotten the attacker’s Tether (USDT) address blacklisted. As a result, they may be able to get most of their funds back.

[2023/08/11 17:30] USDT blacklisted 0x788bc56b67c289399cd6e2022f0d76484f04724a in block 17893148 https://t.co/WipjkHXFGp
— usdt blacklist (@usdtblacklist) August 11, 2023

The victim, who goes by @l3yum on X (Twitter), was initially drained on March 16 after the hacker managed to get a hold of their hot wallet seed phrase. Several Yuga Labs-related NFTs were stolen, alongside some crypto and other NFTs from smaller projects, and then promptly swapped or sold off.

In an Aug. 11 X thread, L3yum highlighted that the hacker’s Ethereum-based USDT address had been blacklisted, as he noted that: “Today after working with the police and cyber team in my country, I was able to get the stolen funds sitting in USDT frozen and black listed.”

The people I was working with were amazing
The original police officer I dealt with didn’t even know anything about crypto aside from hearing of it, but after a few phone calls just by the way he was talking I knew he was learning and actually cared
Very grateful
— L3yum (@l3yum) August 11, 2023

At the time of writing, 90 ETH is equivalent to roughly $166,000 and the blacklisted wallet has $107,306 worth of USDT locked up in it, suggesting the victim may not get the full value of their stolen funds back.

While it is also not yet 100% certain if the victim will be reimbursed, in previous instances in which a USDT address has been blacklisted under similar circumstances, Tether has burned the blacklisted USDT and re-issued equal amounts of the asset to the original owner.

It is also worth noting that the blacklisting of a USDT address by Tether generally comes after a court order.

When asked if this was the case in the comments, L3yum confirmed this was the likely path forward, but suggested it hasn’t been confirmed yet.

“This is the part I’m unsure about but yeah from my understanding this is how it works and the funds that are blacklisted are essentially burnt. Don’t quote me on that though, but that is my understanding!” he wrote.

It is not entirely clear how the hacker got access to the seed phrase in March, however the general thought at that time was that the victim had either been SIM-swapped, mistakenly had their seed phrase backed up on iCloud, or had been using the wallet across several devices.

Another member of our community was compromised yesterday. $70k+ gone.

11 Eth, a Mutant, a Koda, and more. While the exact attack that @l3yum suffered is unclear, we narrowed it down to a few possibilities - and it could have been prevented by one thing

On hardware wallets 1/
— quit (,) (@0xQuit) March 15, 2023

Magazine: NFT Collector: On-chain music sounds off with latest raise, artistic duo Hackatao find their lane

Hidden as colors, crypto seed phrases could hide in plain sight, says dev

July 14, 2023 Coin Telegraph

BIP39 colors

Speaking to Cointelegraph, Entero Positivo argued typical seed phrase storage methods are too obvious, so he devised a way to hide a crypto wallet in plain sight.

A newly released tool called “BIP39 Colors” is turning Bitcoin (BTC) and other crypto wallet seed phrases into colors — giving users a potentially new way to hold their funds in cold storage.

The developer, only known as Entero Positivo — Spanish for “positive integer” — released BIP39 Colors on June 25, which helps translate a 12- or 24-word wallet seed phrase into an unassuming and seemingly random array of colors.

Speaking to Cointelegraph, Positivo said he created the tool because seed phrases will always need to be backed up somewhere physically and someone “seeing something with 12 or 24 written words is very obvious. [...] Many people know what it means.”

“Where and how do I store my words? Written on paper? On a titanium plate? What if a thief thoroughly searches my house and finds the paper with 12 words written on it?” he said.

BIP39 Colors translates a BIP39 mnemonic to colors and viceversa.

Check out the tool :https://t.co/IGrq8LlCXu

- It obfuscates your mnemonic phrase
- You can save each color independently without any order (at home, in css files, png images, ...)
- Color codes are… pic.twitter.com/Td2sm3igVt
— Entero Positivo (@EnteroPositivo) June 25, 2023

Explaining how it works, Positivo said the tool converts BIP39 words — the 2,048-long list of words used to create seed phrases — into eight or 16 colors alongside their hex codes depending on if a 12- or 24-word phrase is used.

*An example of a color palette generated using 12 random BIP39 words. Source: Enteropositivo.github.io*

However, the hex color codes don’t just represent the BIP39 word, explained Positivo. It also dictates the position of that word in the seed phrase.

“The colors are generated in such a way that they carry part of the information of the position occupied by the BIP39 words and information related to their position,” he explained.

This allows for the phrase to be backed up “in a disorderly way and in several different places,” and as “colors are everywhere,” it can make storing a seed phrase “less obvious to any hacker or thief who gains access to our house or computer.”

*AI-generated image depicting what artwork designed using Positivo’s tool could look like. Source: Stability.ai*

To ensure the utmost safety, Positivo suggested that users should not use his tool on an internet-connected device. Rather it should be downloaded and used offline, or better yet, the color swatch can even be created manually using a calculator.

Though it happens infrequently, crypto users have had their entire seed phrases exposed publicly before.

In a viral video in late 2022, a Nevada police officer’s body camera footage inadvertently caught a glimpse of a suspect’s seed phrase written on a slip of paper. The footage later became part of the public record, allowing anyone to see the phrase.

Collect this article as an NFT to preserve this moment in history and show your support for independent journalism in the crypto space.

Magazine: Should you ‘orange pill’ children? The case for Bitcoin kids books

Ledger co-founder clarifies “there is no backdoor” in Recover firmware update

May 20, 2023 Coin Telegraph

" title="

Ledger co-founder clarifies "there is no backdoor" in Recover firmware update

"/>

Coin Telegraph

Ledger Recover is an OTA firmware update, which would allow users to back up their seed phrases by third-party entities only if a user chooses to opt-in to the new service.

The launch of Ledger Recover, a service that allows users of the Ledger hardware wallet to back up their secret recovery phrases, met with immense resistance from the crypto community. Ledger co-founder and ex-CEO Éric Larchevêque took the criticism against Ledger as “a total PR failure, but absolutely not a technical one.”

Ledger Recover is an OTA firmware update, which would allow users to back up their seed phrases by third-party entities. If a user chooses to opt-in to the new service, the recovery phrase fragments get encrypted and are stored by 3 different parties, which can be used to recover the phrase in the future. However, the idea of the seed phrase leaving the hardware wallet did not resonate with users that considered Ledger as a trustless service for storing cryptocurrencies.

Addressing the rising concerns of users worldwide, Larchevêque posted on Reddit clarifying that Ledger was never a trustless solution:

“Some amount of trust must be placed into Ledger to use their product. If you don't trust Ledger, meaning you treat your HW manufacturer as an adversary, that can't work at all.”

He argued that the Ledger Recover update has no impact on the hardware wallet’s security model. He added:

“My mistake as a CEO during my tenure was probably not be relentless enough about explaining the security model, but at some point you just give up as people don't care at all. Until they care again, like now.”

Larchevêque believed that the only thing that changed is the general user’s perspective on trustlessness and that the Recover code in the firmware is not a malicious code:

“Ledger is still safe, there is no backdoor, the Ledger Recover is not a conspiracy, no one will ever force anyone to use Recover.”

Trusting Ledger with sharding the seed phrase is just like trusting Ledger with signing a transaction, he added. Addressing a user’s recommendation about having two different firmware to eradicate ‘backdoor’ concerns, Larchevêque said that “it wouldn't change anything” and would be saddening for him personally.

The firmware update in question is not available for Nano S — Ledger’s cheapest hardware wallet offering — as the chipset does not have enough memory to store the new firmware.

Amid the rollout of Ledger’s controversial firmware update, competing hardware wallet provider GridPlus decided to open-source its firmware for its users.

The most trusted name in cryptography, relied upon by the world's governments for their highest security applications for decades, sold products backdoored by the CIA. How can we ensure this won't happen again? Open-source software.

GridPlus will open-source its firmware in Q3. pic.twitter.com/889OnqXd20
— GridPlus (@gridplus) May 18, 2023

Turning the Ledger controversy into a marketing opportunity, GridPlus announced plans to open source its device firmware in the third quarter of 2023 to deliver greater transparency.

seed phrase

Share this video