OSWOpSecWallet
Wallet security research from public data and official disclosures. We never ask for seed phrases, private keys or transfers.

Hardware Wallets

Articles tagged Hardware Wallets

2026-10-12Wallet Safety Weekly Review — October 5–11, 2026A curated review of the 10 most important wallet security stories for October 5–11, 2026: Ledger confirming a hardware implant inside a reseller-sold device as drains are estimated at $72M–$94.5M, a five-year-old MakerDAO keeper auction drained of 200 ETH, a trader's $4M wallet sweep at TOKEN2049, the U.S. government moving over $1B of forfeited bitcoin, and the week the supply chain — not the cryptography — turned out to be the weakest link.2026-10-12Wallet Security Data Report — Week of October 5–11, 2026The week of October 5–11, 2026 in wallet-security numbers: about $4.58M in confirmed direct losses across four incidents — including a 200 ETH drain from a five-year-old MakerDAO keeper — set against $72M–$94.5M in suspected but unconfirmed user losses tied to Ledger devices sold by one reseller, where Ledger has confirmed a hardware implant in a single device and no loss figure at all.2026-10-12Wallet Safety Intelligence Briefing — Week of October 5–11, 2026The week of October 5–11, 2026 in five fixed questions: how much was lost (about $4.58M confirmed, plus $72M–$94.5M estimated), the pattern (the supply chain became the attack surface), what enforcement did (a stablecoin deadline, a commodities proposal, a mixer retreat, a live prosecution), the one operational change worth making, and what the calendar holds next.2026-10-12Wallet Safety Market Update — October 5–11, 2026The cost of safe operation for October 5–11, 2026: a USDT transfer on TRON still burns about 6.43 TRX (~$2.12) where rental prices it near $0.43–$0.59 for a 72% saving; a hawkish Fed-minutes week pushed bitcoin down 2.1% and ETFs to $729M of two-day outflows; and the venue board now reads Bitget restored, Blast counting down, Ledger under investigation.2026-10-12The Tampered Device: Inside the CryptoBilis Case and What It Proves About Self-CustodyA hardware-wallet vendor confirmed that a device it made, sold through a Southeast Asian reseller, contained an unauthorized implant — and analysts put the suspected losses above $86 million. This deep dive separates what is confirmed from what is estimated, explains how a compromised display can defeat a secure element, and sets out the one habit that closes the door.2026-10-12How to Verify a Hardware Wallet Is Genuine — and What to Do If You Bought From a ResellerA verification walkthrough for hardware wallets: why the box can be compromised before you open it, what a vendor authenticity check does and does not catch, how a hidden implant reads a recovery phrase off the display, the reseller 90-day decision tree, and the setup questions that expose a pre-compromised device before real money arrives.2026-10-05Wallet Safety Weekly Review — September 28–October 4, 2026A curated review of the 10 most important wallet security stories for September 28–October 4, 2026: MetaMask exiting 17,000 validators over 0.36 ETH of diverted rewards, Gravity Bridge drained of $5.4M through its signing keys, a $3.865M exploit at NEAR Intents returned in full within a day, Bitget naming a third-party zero-day as the breach vector, and the week the defensive machinery — for once — outperformed the attackers.2026-10-05Weekly Safety Intelligence — Week of September 28–October 4, 2026Our five standing intelligence questions for September 28–October 4, 2026, answered: a week in which losses collapsed to ~$9.6M, a full recovery landed inside 24 hours, a $1.4B defensive withdrawal contained an infrastructure breach to 0.36 ETH, and the regulator's custody proposal read like the incident ledger converted into rule text.2026-10-05Wallet Safety Market Update — September 28–October 4, 2026Market-side intelligence for September 28–October 4, 2026: TRON one-hour rental quotes held the 20–38 SUN band with TRX near $0.336, ETF flows cooled from $2.39B to $241M as macro prints whipsawed bitcoin through an $82,600–$87,200 range, Bitget finished restoring withdrawals and pledged to refill its fund, and the SEC's custody proposal turned two-person key authorization into proposed rule text.2026-10-05Inside MetaMask's $1.4B Validator Exit: What 0.36 ETH Proved About Non-Custodial StakingAn attacker reached the infrastructure behind MetaMask's staking service and diverted 0.36 ETH of block rewards — and the response was to exit 17,000 Ethereum validators holding about $1.4B of staked ETH. This deep dive walks the two-key architecture that kept the principal unreachable, the reward-routing layer that did not, the 45-day cost of caution, and what the week's other authorization failures confirm about the same boundary.2026-09-29How to Migrate Your Keys to a Clean Device: A Step-by-Step GuideA complete walkthrough of the migration that matters after a key has touched software: why moving the coins to a brand-new key beats importing the old one, how to prepare and verify a clean device, how to plan the TRON transfer costs (65,000 or 130,000 energy per USDT transfer), and how to retire the old address without leaving approvals behind.2026-09-28Wallet Safety Weekly Review — September 21–27, 2026A curated review of the 10 most important wallet security stories for September 21–27, 2026: a backend compromise that moved $387.5M out of Bitget's hot and warm wallets, a day on which three platforms lost $11M, a $20,199 governance proposal that took over two protocols on Neutron, a cross-chain key leak that drained 145 addresses, and the week the market absorbed all of it anyway.2026-09-28Weekly Safety Intelligence — Week of September 21–27, 2026Our five standing intelligence questions for September 21–27, 2026, answered: a week in which $412.3M left wallets and exchanges through systems that authorized correctly, a $20,199 governance vote took over two protocols, the costliest month of 2026 closed, and the effective defense shifted from key hygiene to the trust boundary itself.2026-09-28Wallet Safety Market Update — September 21–27, 2026Market-side intelligence for September 21–27, 2026: TRON one-hour rental quotes unchanged at a 20–38 SUN band against a 6.5 TRX burn baseline, TronZap's own documentation now corroborating the 65,000/131,000 energy figures, a record $2.39B ETF week absorbed the year's costliest security month, and the Bitget breach put the exchange insurance fund's headroom on every operator's dashboard.2026-09-28How a Backend Compromise Drained $387.5M From Bitget Without Touching a Private KeyAt 18:31 UTC on September 24, 2026, unauthorized transfers began moving assets out of Bitget's hot and warm wallets. The exchange's private keys were secure and its cold storage untouched — the attacker had compromised the backend system that assembles and authorizes transactions, and made it authorize the transfers itself. This deep dive reconstructs the four-day timeline, explains why the authorization pipeline rather than the key was the real wallet boundary, profiles who was actually exposed, and reads the week's other failures against the same line.2026-09-21Wallet Safety Weekly Review — September 14–20, 2026A curated review of the 10 most important wallet security stories for September 14–20, 2026: an app wallet signing flaw that swept 1,552 XRP Ledger wallets, a $7.8M Safe-wallet drain that a bot front-ran, a stolen bridge key that minted 2.3 billion AI tokens, a ransom demand aimed at Revolut's customer files, and the advisory that names the recruiters stealing seed phrases.2026-09-21Weekly Safety Intelligence — Week of September 14–20, 2026Our five standing intelligence questions for September 14–20, 2026, answered: a week in which $20.9M left wallets through valid signatures, an app wallet's signing flaw swept 1,552 XRP Ledger wallets, seven agencies named the recruiters stealing seed phrases, and the effective defense moved from protocol audits to key and module hygiene.2026-09-21Wallet Safety Market Update — September 14–20, 2026Market-side intelligence for September 14–20, 2026: TRON one-hour rentals quoted from 20 SUN by the cheapest operator against 29–30 SUN-per-day 30-day terms, JustLend's own documentation now confirming the 64,000/130,000 energy figures that most fee guides still understate, a bitcoin week that survived a rate hike and a failed bill, and the venue failures that left users without an exit.2026-09-21How a Wallet App's Signing Flaw Emptied 1,552 XRP Ledger WalletsBetween 16:29 and 18:34 UTC on September 15, an automated drain emptied 1,552 XRP Ledger wallets holding 2,009,321 XRP. The flaw was in a phone app's signing path, and the company's own exposure criteria describe a class of user rather than a class of transaction. This deep dive reconstructs the two-wave timeline, explains why the recovery phrase rather than the device sets the blast radius, profiles who was actually exposed, and reads the week's three other failures against the same boundary.2026-09-14Wallet Safety Weekly Review — September 7–13, 2026A curated review of the 10 most important wallet security stories for September 7–13, 2026: 3,400 BTC returned to the Liquid federation, a $24B laundering marketplace struck by US enforcement, two more bitcoin-wrapper unbackings at Nomic and Symbiosis, a UBI protocol's reserves drained, and an old Balancer deadline that lapsed quietly.2026-09-14Weekly Safety Intelligence — Week of September 7–13, 2026Our five standing intelligence questions for September 7–13, 2026, answered: a week shaped by three bitcoin-wrapper unbackings in five weeks, the return of 3,400 BTC to Liquid, a $24B laundering marketplace taken apart by enforcement, and a baseline of roughly $2M per week in confirmed direct losses.2026-09-14Wallet Safety Market Update — September 7–13, 2026Market-side intelligence for September 7–13, 2026: TRON energy rentals at 22–38 SUN with an on-chain measurement confirming the stale 31,895-energy figure is half the real cost, the laundering market repricing after the Xinbi sanctions, and a recovery week that returned ~$269M to the Liquid federation.2026-09-14One Deposit, Two Receipts: How a Wrapper's Double-Spend Left 36% of Osmosis's Bitcoin UnbackedOn September 9, Osmosis disclosed that 39.84 fake nBTC — roughly 36% of its alloyed bitcoin token's backing — had been sitting inside the pool since June, created by a flaw in Nomic's deposit-forwarding code that credited one deposit twice. This deep dive reconstructs the timeline from origination to disclosure, explains why a counterfeit receipt passed every check, profiles who was actually holding the hole, and reads the week's second unbacking at Symbiosis against the same boundary.2026-09-07Wallet Safety Weekly Review — August 31 – September 6, 2026A curated review of the 12 most important wallet security stories for August 31 – September 6, 2026: a $320M settlement-layer withdrawal, the Coldcard attacker moving funds again, a $1.73M legacy-contract overflow, a hardware-wallet shipping breach tripling in size, a cross-border drainer ring dismantled, and a clipboard-hijacking botnet taken down.2026-09-07Wallet Security Data Report — August 31 – September 6, 2026The weekly numbers for August 31 – September 6, 2026: ~$321.8M in tracked direct losses, with one settlement-layer incident accounting for about 99.5% of the total, a $1.73M legacy-contract overflow second, and the non-Liquid remainder falling 77% week over week.2026-09-07Wallet Safety Intelligence — Week of August 31 – September 6, 2026The five fixed questions for the week of August 31 – September 6, 2026: risk migrating to the layers around the key, a $320M settlement-layer withdrawal, social engineering that borrows trusted identities, the operations that matter now, and what to watch in September.2026-09-07Wallet Safety Weekly Update — August 31 – September 6, 2026The weekly market-side numbers for wallet safety: TRON operation costs at their cheapest tracked level, enforcement actions against attack infrastructure, and a threat market that is consolidating rather than slowing.2026-09-07Liquid Network: How $320M Left a Federation Wallet and What It Means for Wallet UsersA long-form look at the September 6 withdrawal of roughly 3,996 BTC from Liquid Network's federation wallet: how a peg-out works, where it appeared to break, why the actors call themselves white hats, and what holders of federated and bridged assets should do with the exposure.2026-08-31Wallet Safety Weekly Update — August 24–30, 2026The weekly market-side numbers for wallet safety: TRON operation costs holding under a dollar, the poisoning and drainer run rates now carrying nameable operators, and a shrinking on-chain insurance market.2026-08-31When Seeds Aren't Random: The $5.69M Predictable-Seed Problem and the Entropy Crisis in Wallet SecurityA structured teardown of the week's defining story: Coinspect's finding that five wallet apps generated predictable recovery phrases — costing users $5.69M — read against the Zilliqa nonce post-mortem and the Coldcard seed-generation failure, and what the entropy crisis means for every wallet user.