Ledger wurde geleert, Sadage…
- Dieses Thema hat 36 Antworten sowie 1 Teilnehmer und wurde zuletzt vor vor 1 Jahr, 4 Monaten von
aktualisiert.
-
Beiträge
-
-
Ich habe meinen Ledger seit einem Monat nicht mehr überprüft, und als ich gestern nachsehen wollte, stellte ich fest, dass jemand vor etwa 2 Wochen meine .45 btc geleert und weggeschickt hat… 🙁 Ich bin mir nicht sicher, wie das passieren konnte, aber offensichtlich wurde er irgendwie kompromittiert?
Ich habe meinen Ledger Nano S erst Ende 2017 bekommen. Aufgerüstet auf einen Nano X und übertragen mein Konto von der S auf die X über die Passphrasen in der Mitte des letzten Jahres. Haben DCAing BTC in mein Ledger für mehr als ein Jahr und jetzt ganz plötzlich jemand gehackt und übertragen sie alle.
Ich habe meine geheimen Phrasen aufgeschrieben, aber tbh, ich habe auch eine Kopie auf einer externen HD, die ich nicht angesehen habe, seit ich mein Konto übertragen habe. Jetzt kann ich nur noch beobachten, wo die gestohlenen BTC gelandet sind. Ich schätze, es gibt nichts, was ich tun kann, außer noch einmal von vorne anzufangen…schade
-
Sorry to hear that. This can be tough to bear 🙁
If it helps (so that you eliminate such ever happening again), here’s possible points of compromise:
– *“Upgraded to a Nano X and transferred my account from the S to the X via the pass phrases“* … where did you buy the device? did it come with a pre-written recovery phrase and you just restored that & transferred coins?
– *“I wrote my secret phrases down but tbh, i do also have a copy on an external HD that I haven’t looked at“* … this is a major compromise point — having your recovery phrase in any digital form. Not recommended.
– Additional: How secure was your written recovery phrase? Is it possible someone had access to it all along and just waited for you to accumulate? or someone found it recently from where you kept it.
– Additional (for the journey ahead): Look into setting a 25th word (passphrase) on top your new recovery phrase. Then store your main amounts of coins in the addresses generated while the 25th word (passphrase) was configured. This is an advanced thing and requires relative seriousness. https://www.ledger.com/academy/passphrase-an-advanced-security-feature
-
-
-
If what you’ve said is accurate and true :
1. Someone knows where you hid the seed
2. The external harddrive when connected to your computer got picked up by malware or Spyware and the seed exposed
3. Your phone is uploading to your cloud without your knowledge and you have a poor or reused password with weak 2fa or no 2fa
4. You have an app on your phone with privledge to your pictures but it’s malicious in nature and extracted your seed -
-
-
-
So you took a photo which made a digital copy, then you copied it to an external hard drive. Both of which are vulnerable. Never ever make a digital copy or eventypemit down in notepad and delete it. Always assume you have a keylogger and someone is screencastong your digital content live stream.
-
Here it sits till it moves again… derp!
https://blockstream.info/address/38jtTVDZXjnMn5Q23vkfzdmLmbqat9wwQA
-
-
-
Look into passphrase.
I actually advise storing a passphrase sometimes called 25th word on your phone/cloud.
So long as the seed phrase is only kept as a physical existing item and the passphrase is Digital you got two halves that makes a whole to give access to your keys.
Can’t get in without the other
So even if your cloud is compromised your crypto is safe because your seed phrase is stored physically.
And if your seedphrase is compromised they can’t get access without your passphrase.
I actually advise storing passphrase digitally because if even one character is wrong when you recover it will generate a whole different wallet address.
-
Your problem was storing the passphrase electronically. Sorry this happened to you. If you choose to start over, i would recommend looking into add a 25th word (passphrase) to your next seed. You can keep the 24 words electronically (preferably encrypted) but NEVER EVER store the 25th word electronically. That should keep you relatively safe.
-
-
I hate to hear this but it’s good you’re honest about that photo which is the most likely the cause. That’s why I like the 25th word because it’s a added layer of hidden security. Apples iphones and Macs love to upload photos without your consent so that’s still an option. If not the external HD at anytime it was connected to the computer.. worse when the internet was on was a very big risk.
If I was going to ever plug that external in, it would only be on a PC that will not touch the internet even after it’s unplugged and would run software to 0 out the PC’s drive many times to make recovery hard if not impossible then reinstall the OS and probably repeat the process, but even then I would still feel paranoid connecting that PC to the internet.
I don’t trust apps on phones as they can have permissions to media and have the ability to grab personal data, I know iphones are meant to be better as the apps are run isolated but I don’t know enough about iphones apps to trust them.
Then there is the paper version maybe less likely but still a possibility via a camera viewing it or physical person but no one usually considers that. That’s why my seed is mixed up with many many other words in weird order with a clue I hide away and have also memorized is what I prefer to do with my seed along with the 25th word. I also have another backup version but it’s complicated and private lol
-
>I wrote my secret phrases down but tbh, i do also have a copy on an external HD that I haven’t looked at since I transferred my account.
Seriously come on people. At that point zero reason to even buy a hardware wallet. Might as well throw it in the trash and use a software wallet.
Like buying a car with airbags and removing all the airbags or better yet replacing them with explosives.
-
When ledger got hacked they sent out an email to those (including me) that person info was compromised. Ill bet you got that email..
After i got mine i was bombarded by hacker emails of all kinds. They were watching and while i was very careful ever since i still got burned a couple months ago for 1.26 btc
Funny thing is… it hasnt moved yet. It’s still at the address that stole it.
-
I am truly sorry for your loss. For enhanced security next time, if you want to sleep like a baby, follow this procedure:
1. Buy hardware wallets from three different manufacturers. Create a multisig wallet in a 2 of 3 configuration. Consider using Caravan, a free and open-source software project available on GitHub. Caravan, developed by Unchained Capital, assists in creating and managing multisig addresses and wallets. While the tool was created by Unchained Capital, there’s no requirement to become a customer. You can freely use the software on GitHub without registration.
2. Don’t trust the hardware wallets‘ integrated seed phrase generators. Instead, create your own 24-word seed phrases using casino-grade dice and a scientific calculator. Computers, especially hardware wallets that have very little processing power, struggle to produce true randomness. Flawed “randomness” algorithms have been suspected in numerous wallet compromises by leading cybersecurity consultants. For guidance on this technique, search for dice-generated seed phrase tutorials on YouTube.
3. Record the seed phrases on steel or titanium plates, considering a product like the Keystone Tablet Punch available on Amazon. There are many other suitable products, but the punch method is easy and secure. Make sure you have complete privacy while you are recording your seed phrases. Burn the papers where you previously wrote down your seed phrases.
4. Secure your plates with security hologram stickers with printed serial numbers and lock them using high quality combination padlocks.
5. Put each hardware wallet and its corresponding plate set into an individual tamper-evident bank deposit bag. Label each set as „1/3“, „2/3“, and „3/3“ to differentiate them. Ensure you store each labeled bag in secure locations that are geographically diverse from one another.
6. Avoid discussing your crypto holdings with others and include access instructions to your crypto in your Last Will. Store your Will in a bank safety deposit box.
-
-
-
-
-
Hey – truly sorry to hear about your situation. It’s indeed a distressing experience. It seems like your recovery phrase might have been compromised. If someone has access to your 24-word recovery phrase, they can access your funds without needing your physical Ledger device.
Please remember that Ledger will never ask for your 24-word recovery phrase. It should be kept offline and never shared with anyone. If you suspect that your recovery phrase has been exposed, it’s crucial to transfer any remaining funds to a secure account associated with a new recovery phrase as soon as possible.
Our help desk article below will provide more info on what could have happened: https://support.ledger.com/hc/en-us/articles/7624842382621-Loss-of-funds?support=true
-
-
-
I’m so so sorry this happened to you. I think this is everyone’s nightmare. Honestly, I’m surprised this happened with a Mac. I’ve had computers, pc’s and macs, for decades and only got hacked once on my pc. Never on my Mac. I would maybe use malwarebytes and bitdefender for security. Did you recently do any updates with Ledger Live?
-
-
-
-
-
Hi OP I was hacked as well not having compromised the seed phrase, my guess is malware or I was shipped a fake Ledger when I ordered it through their Amazon instead of their website. Never buying crypto again either way just too risky. Apparently ledger has a class action lawsuit brought against them in California that could possibly lead to recovering some of the stolen assets.
-
Happened to me as well with metamask wallet. Had the seed written and achieved in the note app. Not uploaded anywhere. But they still got it somehow. There seem to be people that see all your pics and what you write on your phone. Didn’t lose as much as you though. Ouch! Let that be a lesson.
-
-
-
-
-
- Du musst angemeldet sein, um auf dieses Thema antworten zu können.