June 2023: users of Atomic Wallet, a software wallet, found their funds gone. At least $35 million, per Elliptic.
Their keys lived in an app on an internet-connected device. Keys created on a KeepKey stay on the KeepKey, and nothing moves until you press its button.
Elliptic on the Atomic Wallet thefts. The root cause wasn't established in the reports we read: elliptic.co/blog/analysis/no…
Only set up a hardware wallet you ordered yourself, shipped by the manufacturer.
A "replacement" you didn't order is a scam. A genuine device never asks you to type recovery words into a computer. Your KeepKey shows its words on its own screen, once, in front of you.
You copy an address. You paste an address. It's not the same address.
Clipboard hijackers swap what you paste for the attacker's. Kaspersky tracked one disguised as Tor Browser: 15,000+ attacks in 52 countries.
The address that counts is the one on your KeepKey screen.
Kaspersky's report on the fake Tor Browser clipper: kaspersky.com/about/press-re…
How to check the address on the device before you approve: docs.keepkey.com/docs/deskto…
A hardware wallet does one job well: your keys stay on the device, and nothing is signed until you press its button.
It can't read a request for you. And it can't protect a recovery phrase once it leaves the paper.
Start here: the habits that matter, in 2 minutes.
The full course, 11 short episodes: docs.keepkey.com/docs/videos…
A technical breakdown of exactly what happened with coldcard.
Been getting a lot of questions about the coldcard seed bug,
so — short version. It wasn't a hack. Nobody broke a PIN, opened a device, or installed malicious firmware.
A build flag meant affected devices picked their secret from a far smaller set than they should have.
Those coins were guessable from the day the wallet was made. Some of them, five years ago. Here's my breakdown of what to know.
KeepKey retweeted
Get ready for a discussion with @cryptokeepkey! Mark your calendars $DGB community.
xitter.cf/i/spaces/1PKqrrmLglbGb


