Ledger’s hardware wallets have the most robust physical security on the market. To this day, nobody has been able to extract the seed words from the popular Ledger Nano S or the newer Nano X. But this kind of security is owed to a trusted setup which uses a closed-source secure element chip. In other words, you can’t verify what the device is doing and you must trust in Ledger with both your wallet xpub (so they know your public key and how many bitcoins you own) and security updates.

This “trust us” philosophy is a big part of the way in which Ledger operates as a company. But the recent news about Ledger’s database leaks should be concerning for all customers: on July 14th 2020 (which happens to be the French National Day), a security researcher has reported a data breach on the Ledger website.

The good news is that no customer has lost any coins. The bad news is that if you ever bought a Ledger hardware wallet from the official website, then your full name, e-mail address, shipping address, and phone number may have ended up in the hands of hackers.

Consequently, it’s likely that malevolent actors will contact you and ask for private information – or if you hold enough BTC to make the extra effort worthwhile, some people may even try to physically attack you. Just remember that Ledger will never ask you for information concerning your seed phrase, PIN number, or private keys.

Also, they most likely won’t ask you to confirm your home address and definitely won’t suddenly decide to send you a free hardware wallet if you tell them where you live. So if anyone ever contacts you and asks for such data, never reply to their message. It’s better for them to think that your e-mail address is inactive.

Furthermore, it’s important to be careful and never install any suspicious software update. Smart hackers will try to target you and ask that you install a critical security update on your Ledger Nano S or X. Never trust these sources and stay away from any update that doesn’t come from the Ledger Live software. Don’t fall for phishing or malware scams, as you may lose your coins.

The situation is very similar with the case of exchange hacks which target customer data and enable the hackers to extort coins directly from the owners. Ledger has done a poor job protecting your personal information, so you shouldn’t be surprised if you get contacted by all sorts of dubious people.

Ledger CEO Pascal Gauthier assures users that the company has taken immediate action in appealing to the CNIL (Commission nationale de l’informatique et des libertés, the governmental branch which deals with personal data over the internet) and filing documents to the French public prosecutor. But even if the hackers get caught and they face justice, your data is still out there and you never know who ends up getting it and using it for malevolent purposes. So please be careful if you think you might be targeted.

How can you securely buy a hardware wallet?

Buying a hardware wallet online can expose you to database hacking risks. But buying the same device from unauthorized sellers may also subject you to supply chain attacks. So what is the best way to securely buy a hardware wallet?

Well, the best answer is “Bitcoin conferences”. Most of the times, hardware wallet manufacturers will attend conferences and sell hardware wallets. This direct purchase won’t be registered under your name, you can pay in cash or bitcoins, and being in a crowd of Bitcoin enthusiasts also gives you a lot of plausible deniability – it’s not like you put a target on your back just because you purchase a Trezor or Ledger in plain sight.

The second best answer is “look for local authorized resellers”. If you check the Ledger website, you’re going to find a list of authorized retailers. Though it’s also a bad idea to order hardware wallets from their online stores, they sometimes also have physical stores where you can go and do your shopping. And in some cases (such as Amazon’s), their record of handling customer data is slightly better in terms of getting hacked – yet the fact that Amazon might share your shopping list with advertisers that can also get hacked should also be a concern.

Even if it costs more in some cases, it pays off in terms of privacy and peace of mind to purchase your hardware wallet from a physical store that doesn’t ask for your personal information. The experience should be as simple as dropping the device in your cart among a pile of other electronic-related devices, and then paying at the counter.

And yes, it’s convenient to order your hardware wallet directly from the manufacturer’s website. We’re in the middle of a pandemic, there are no Bitcoin conferences to make the process any easier, and sometimes we don’t have proper stores and distribution in our area of residence. Nonetheless, we should always consider the privacy tradeoffs and remember that privacy is the best gatekeeper of security – if nobody knows about it, then nobody can attempt to hack it.

Donate to the Bitcoin Takeover Project

If you’d like to support my work, then please donate BTC to this address:

3MUN6pTt6rY8tyNPrdCxTSWisN1GQXzkLL

If prefer the Lightning Network, you may use Tippin or Tally Coin.

And if you’re more into dirty criminal and blood-stained fiat, then Patreon is definitely your gig.

Today I have recorded and released a new video, which I titled “Bitcoin and Pokemon?!”. It’s available on YouTube, it contains lots of funny references and I’m sure that you will have a fun time watching it (watch out for a CSW and Farfetch’d joke).

Full Transcript

So Bitcoin and Pokemon, eh? As you’re watching this, you’re definitely assuming that I’ve gone crazy and have no topics to talk about – but don’t worry about it, I have plenty of plans for upcoming videos and they won’t be rooted in a Japanese animes from the 90s.

But speaking of Japanese, what’s the name of the guy who created Pokemon? That’s right, Satoshi Tajiri. And what’s the name of the leading character of the Pokemon anime? That’s right, Ash Ketchum – except that his name in Japan is actually Satoshi.

Hold up a minute, does this mean what I think it does? Satoshi Nakamoto, Satoshi Tajiri. Digital money, digital monsters. 21 million coins on the original chain, 151 Pokemons in the original series. Pokeballs, hardware wallets. Pokedexes, full nodes. Farfetch’d, Craig Wright is Satoshi Nakamoto. Exeggcute, eggs are pee.

There is definitely a connection there. And if you look at the design of the original Pokemon game on the GameBoy, you will notice that players were encouraged to trade Pokemons using the Game Link Cable. You can’t make this stuff up: kids of the late 1990s were connecting their GameBoys to create a peer to peer network and transfer rare digital assets.

You know, kind of like today’s cool kids who join a global peer to peer network and then download a client which allows them to transact value across borders in a permissionless, uncensorable, and verifiably secure way.

Bitcoin is a lot like Pokemon, and the two universes definitely have a lot in common. So someone who was into Pokemon in the late 1990s and early 2000s will definitely find it easier to learn about Bitcoin, as the core principles (no pun intended) are already there.

Even Jason Paige, the guy who sings the Pokemon theme song in English has recorded an adaptation of the theme song which is about Bitcoin. So if even he’s seeing a connection here, then I don’t know what else to say. I’m not making this up, here’s a sample and check the description for the full song.

And if you think that there are no resources to go more into depth, then you should know that I’ve written two articles about it: one for the Bitcoin Takeover website, which also describes certain aspects about Bitcoin in Pokemon terms, and the other one is on the Trezor blog and explains why hardware wallets are a lot like Pokeballs.

Share this with a friend who is a Pokemon fan and let’s travel across the land, searching far and wide, teach Pokemon fans to understand the power that’s inside Bitcoin.

Until next time, get on the Bitcoin Takeover website to listen to some educational podcasts and read some useful articles such as “Bitcoin Is Not Slow, It’s Highly Secure”.

Don’t forget to like and subscribe. And in the comments, tell me which Pokemon is your favorite and how many bitcoins you think it’s worth. Obviously, mine is Charizard and I think I’d take 1000 BTC for it.

And if you want to make me a donation, you’ll find a Bitcoin address in the description and a link to my Patreon page. Thanks for watching, bye!

Donate to the Bitcoin Takeover Project!

3AhbJGLZQ6EX6ncRatLSABWTag6vsm3JVF

For Lightning Network donations, please use Tippin.

And if you’d rather send fiat, please use Patreon.

If you don’t want to send me anything but need a new hardware wallet, steel plate, or Faraday bag, please check out the article’s sidebar for my referral links to Trezor and Billfodl. If you click them and make a purchase, I get a small percentage of your payment.

Trezor is responsible for designing the world’s first Bitcoin hardware wallet, and it’s thanks to their open source contributions that this niche of coin security has expanded and flourished.

The following article presents a limited-time offer for Trezor’s hardware wallets, which marks the celebration of the Trezor One’s 6th birthday. In a nutshell, purchasing a Trezor Model T between the 21st of July (starting a midnight, CET) and the 23rd of July (ending at 9 AM CET) will get you a free Trezor One. Please refer to a specialized website to understand how that relates to your time zone (or do the math yourself).

This way, you don’t have to think about which device is right for your needs: you buy the Model T and you get the other model too.

Why Trezor?

Back in 2014, Satoshi Labs has introduced to the world the Trezor One: a simple device which aims to protect your bitcoins from infected computers. According to co-inventor Slush, the hardware wallet was aimed to help him manage his BTC at SlushPool.

6 years later, the Trezor One is still the benchmark for security and the standard from which every other hardware wallet starts developing. Satoshi Labs also open sources all of their software, so you shouldn’t be surprised to discover that lots of other hardware wallet developers use their code.

As described by Slush in S4 E8 of the Bitcoin Takeover Podcast, hardware always lags behind software and tends to get inefficient in time. So the design philosophy of Trezor isn’t to release a new model every year to fix some security flaws (as other manufacturers tend to do), but to focus on developing software updates for the existing devices.

This is also why the Trezor One is still being manufactured and sold 6 years later its launch: it received many firmware updates and has been constantly fixed after vulnerabilities were discovered. While other manufacturers focus on the hardware part and chase physical security at the expense of frequently putting out new products, Trezor focuses on code.

Also, it should be explained what Trezor is not trying to do (at least at this point): physical security.

The lack of a secure element chip for physical security is addressed through the passphrase, the Shamir backup, and the multisig setups.

It’s not that Trezor don’t want to attain physical security (as a matter of fact, they are starting a project named Tropic Square to address the issue in their trademark open-source manner). Instead, they don’t want to compromise on the open-source auditability and transparency just to follow the security trend that Ledger have started.

You shill, muh Coldcard

Let me stop you right there are explain why I’m promoting Trezor. And no, this is not a paid post – I’ve joined the affiliate program of Trezor, and will only make money out of this if people actually buy their Model T in the next couple of days after clicking my link.

But while recording season 4 of the Bitcoin Takeover Podcast, I was surprised to discover that the two security experts (Lazy Ninja and Peter Todd) have expressed similar opinions about security: the best security is not the one that tries to cover every possible threat, but the one that’s limited and honest about its limitations.

It’s the reason why I have chosen to promote Trezor (they’re honest about who they are and what they’re doing), and I don’t know about you but I’d rather trust a developer and a hardware wallet hacker than a founder and his company’s marketing department.

“And if I am going to tell them to go get a hardware wallet, frankly I’d actually trust Trezor more because they do have a design that is based on more off-the-shelf chips than other people do. The problem with something like the Ledger is — to get all these fancy security chips — you have to go sign NDAs and then people can’t easily reverse engineer your devices and figure out if they’re actually doing what they should be doing. You’re actually putting much more trust into the manufacturer than you are on a Trezor, or let alone a phone” – Peter Todd

“I actually use a Trezor Model T. I had actually just upgraded from my Trezor One to that and now it’s sort of funny… people will be like ‘Well, you know, that doesn’t have the secure element that you like so much’ and stuff like that. And it is actually a security negative to that device to not have a secure element. And there are a number of attacks that are possible because of that. But in my case I’m valuing the screen size and ease of use from that perspective as being more important than the secure element. Because in general, I don’t actually take my hardware out of my house and I don’t actually store my funds on the hardware wallet most of the time. Usually everything’s in cold storage and the hardware wallet is just sort of storing intermediate levels of funds. So in my case, yeah, the Trezor Model T was the best one for me.” – Lazy Ninja

But wait, you work for Trezor!

Yes, as a freelancer who writes a blog post on the Trezor blog every couple of weeks. I’m free to talk about anything, I’m free to criticize or praise any product, I have no skin in the game at this point.

There are three reasons why I’ve written this article:

1. To raise awareness about this promotion (if you’re anything like me and collect hardware wallets, this is a good opportunity to expand your collection);
2. To explain what Trezor is all about (they’re not great at marketing their own products on Twitter and get a lot of undeserved hate while being the ones who create the code that everyone else forks for their “cooler” products);
3. To hopefully make some money from affiliate links.

So if you’d like to help me make some money, then please use my link.

If you’d rather make a donation to help me keep on writing, recording podcasts, and doing videos, then use this address: 3Hu32u76dDau752kjeH94e94JCU2fsMFoz

If you hate me for expressing a view which echoes the arguments of security professionals with a reputation and skin in the game, then so be it. Express it in the comments, cancel me on Twitter and do whatever makes you feel better about your own existence.

For at least two years, Arthur van Pelt has been paying close attention to the activity of Craig Wright. Ever since the self-proclaimed “Bit Coin” creator has started suing community members who contested his status, van Pelt has taken upon himself to shine a light on the numerous cases of shady evidence that Wright provided.

Some would go as far as saying that Arthur van Pelt is obsessed with Craig Wright and has a personal agenda. After all, his daily tweets about Wright’s life and activity in court do require hours of research and intensive reading. But if you ask van Pelt, he will say that he only does a community service by trying to salvage the reputations of those whom Wright has harmed: from Hal Finney to Adam Back and Hodlonaut, there are dozens of lives that have been irreversibly affected by lawsuits, threats, and perpetual slandering.

To support his cause, Arthur van Pelt has created the “#Faketoshi Fraud Timeline“: a website where he regularly publishes information that he collects from court data, testimonies, and individual investigations. His aim appears to be that of fact-checking statements that Craig Wright has made in court, private e-mails, blog posts, and social media interactions.

In the Bitcoin Takeover Season 5 finale, we talk about Craig Wright’s early days (convincing Gavin Andresen that he is Satoshi, debating Nick Szabo during Bitcoin Belle’s panel, and feeling reluctant to play the role of Satoshi), his evolution throughout the years, and the considerations that may exist behind his lawsuits.

Inevitably, some conspiracy theories get discussed: Is Craig Wright a government contractor who is trying to discredit Bitcoin and destroy it from within? Or is Craig Wright actually paid by the real Satoshi Nakamoto to put an end to the relevance of who the creator of Bitcoin may be?

At the end of our 155-minute discussion, Arthur van Pelt and I agree that the Bitcoin community should always be honest and phase out bad actors with facts and thorough research. While it’s better for bad actors to receive less media coverage, it’s also useful to balance their claims with facts. This anti-sensationalist middle ground may look less glamorous than scoring clickbaity website hits, but it’s also better in the long run.

Listen to the episode on iTunes and Spotify!

Donate to the Bitcoin Takeover Project!

Storing a podcast episode on a web server may be inexpensive… but when more than 50 of them add up, you end up having to upgrade your storage and also build an offline archive just in case cancel culture starts finding Bitcoin content offensive.

If you like what I’m doing and want to keep me going, please consider making a donation to the Bitcoin Takeover project. 90% of amounts sent to the address below will be redirected to support Arthur van Pelt’s research.

For Lightning, please use my Tippin account or Tallycoin. And if you’re more into giving blood-stained fiat, please consider a Patreon donation.

Conversely, if you don’t want to send anything but need a new Trezor hardware wallet or Billfodl metal plate/Faraday bag, feel free to use the linked referral links. I will get commissioned a small percentage of your payment, and any amount can help me keep going.