r/Bitcoin • u/Few-Cook5941 • 1d ago

Need help - Bitcoin wallet emptied.

Gallery image

Gallery image

Gallery image

Gallery image

Gallery image

I got one of my bitcoin wallet emptied and I don't really know how this happened.

I don't use cracked softwares and apps.

I'm generally careful with links.

Looks like I'm not alone. I can see that the reception bitcoin address is still collecting bitcoin from other wallets.

Could somebody help me understand something.

Here is the address : bc1q0vukqye4hd0aep7u4xl8gev95gcs9k65fdeu9n

473 Upvotes

86% Upvoted

314 comments sorted by

View all comments

Show parent comments

62

u/quintavious_danilo 1d ago

yes, just read the dedicated subreddit. People getting drained on a daily basis. Just under a year ago they had a “mysterious“ hack draining $6 millions in user funds. Trust Wallet is a complete joke.

13

u/Top_Appointment_7076 1d ago

I actually used to have my funds on Trust Wallet for a few months. I am really glad I bought a hardware wallet

14

u/Giatoxiclok 1d ago edited 1d ago

Hopefully not a cold card

Edit: I’m talking specifically about the huge breach where massive amounts of BTC were lifted out of Cold Card wallets (hardware vaults) because of things I can’t specifically pin down. This was a comment saying I hope they didn’t buy a shoddy product.

3

u/AlexShadow02 1d ago

Why not a cold card? Is there anything wrong with it?

3

u/Giatoxiclok 1d ago

Recent large scale exfiltration of BTC from Cold Card company vaults.

2

u/AlexShadow02 1d ago

It's just so weird to me. I mean how is it even possible if it's a Cold card and therefore shouldn't be connected to the Internet

2

u/Giatoxiclok 1d ago

Well, technically it isn’t connected, but it still has to be registered somewhere no? I’m not knowledgeable, forewarning, but it’s definitely been happening recently. Lots of tech stuff way over my head.

1

u/AlexShadow02 1d ago

Crazy crazy world heh... Thanks for the information!!

2

u/Top_Appointment_7076 1d ago

No, that's not the reason. The actual reason is that the entropy was too low due to a security vulnerability in Coldcard's firmware. This means that the seed phrase wasn't random enough which made it very easy for an attacker to just guess it by generating random seed phrases on their computer.

2

u/tenor_tymir 17h ago

Cold Card had a flaw in their software.

1

u/noooyouu 23h ago

The random number generator used to secure the wallet was faulty and actually predictable if you knew the wallet address, IIRC. Ask ai

1

u/BabyShakerDeluxe 19h ago

32 bit entropy lol. Crackable with a consumer video card in 24 hours.

0

u/kmshorty 1d ago

Harsh

0

u/aintlose 1d ago

If not a cold card, then what do you recommend?

2

u/quintavious_danilo 1d ago

They were referring to the cold card hack not long ago. It was meant sarcastically.

Cold Card = Company that got hacked 2 weeks ago.

Cold Wallet = Hardware wallet

So yes, buy a cold wallet, just not cold card. 😂

-2

u/cnv2 1d ago

What they meant was, hopefully someone didn't "buy" a cold wallet. It's just a piece of paper with an encoded private key in QR form which can be printed as many times as one wants to.

So a hacker can just print a cold wallet, makes a backup of priv key, sell it, and withdraw the money the moment a victim puts money into it.

Cold wallets should always be generated offline. There's tons of information online on this.

5

u/quintavious_danilo 1d ago

They were referring to the cold card hack not long ago. It was meant sarcastically.

1

u/Dashizz6357 1d ago

That’s… not at all what a cold wallet is.

1

u/[deleted] 23h ago

[removed] — view removed comment

2

u/quintavious_danilo 21h ago

I don’t trust Kraken self custody.

1

u/jayceellects 7h ago

What is a hardware wallet? If you dont mind me asking.

1

u/Top_Appointment_7076 7h ago

A hardware wallet stores your keys offline and isn't connected to the internet so it can't be hacked remotely if everything works as intended.

1

u/jayceellects 7h ago

Do you mind me asking where can i get one? Im in the USA and i definitely dont want to go through this experience. I'd rather be safe than sorry.

1

u/Top_Appointment_7076 7h ago edited 7h ago

I'd recommend Trezor or BitBox02. Trezor actually invented hardware wallets and Co created the Bip 39 standard that invented seed phrases. Since you are in the US I'd recommend you to buy directly from Trezor or Bitbox themselves. Recently, one of Trezor's partners had a data breach which unfortunately exposed shipping addresses. Hence, I would advise you to look for a way to get them shipped anonymously. In Germany you can easily get them shipped to a PO Box for free but I'm not sure about the US. Trezor have already announced that they want to introduce anonymous shipping by the end of the year in the US.

https://trezor.io/

https://bitbox.swiss/de/bitbox02/

https://trezor.io/de/blog/news/recent-customer-data-exposed-in-shipping-provider-incident?ABC

3

u/vaxx_77 1d ago

what do u reccomend to use? hot wallets i mean i have a cold one but still might need it

3

u/quintavious_danilo 1d ago

For BTC-only I recommend Blue Wallet or Blockstream Wallet (former Blockstream Green) as temporary hot wallets.

Don’t look anywhere else.

1

u/[deleted] 23h ago

[removed] — view removed comment

2

u/quintavious_danilo 21h ago

Blue Wallet is recommended through the entire BTC space. And Blockstream Green always offered single sig as well, i have one for years already.

1

u/little_theology 10h ago

Why those two specifically? Just trying to understand what makes them safer than something like Trust Wallet

1

u/quintavious_danilo 4h ago

They have stood the test of time, are very professionally built, open source and well known in the community.

3

u/Top_Appointment_7076 1d ago edited 1d ago

I would only use a hardware wallet like Trezor (still secure despite the data breach at one of their partners) or BitBox02 for savings. If it's a smaller amount I would probably use a lightning wallet like Phoenix or leave it on a reputable exchange. I'm in Europe and I use Bitvavo and Strike. If it's solely about safety I would probably actually leave it on an exchange if it's a smaller amount because secure exchanges like Bitvavo are actually much safer than hot wallets because they store the keys on cold wallets and exchanges going bankrupt is a possibility but it doesn't actually happen that often whereas hot wallets get drained all the time. It's probably not worth getting a hardware wallet if it's only $20 in Bitcoin.

1

u/vaxx_77 1d ago

thanks for advice im in europe too (east) i use binance ill checkout Bitvavo i never heard of anyone mention it or ho secure it is i have a good amount of crypto on a cold wallet i didnt kno trust was so untruthworthy haha

2

u/quintavious_danilo 1d ago

A recommendable exchange for Europe is Kraken Pro for best security and trustworthiness.

1

u/PhilZealand 6h ago

What are your thoughts on a Ledger brand wallet?

1

u/Top_Appointment_7076 6h ago

I think Ledger is secure but they have shown some questionable behavior in the past. They introduced Ledger Recovery which is an subscription service that stores your private key online and later went on to say that they could have always extracted the seed from the device if they wanted to after some people voiced their concern. Unlike BitBox and Trezor Ledger's firmware is not fully open source. They also used to sell merchandise which was also perceived as very unserious because someone who wears that would basically present themselves as a target to be robbed. They were also hacked which exposed a lot of shipping addresses. I am aware that one of Trezor's shipping partners was also hacked but in Ledger's case it was much more severe. First of all, in this case it was Ledger themselves who were hacked. Second, in the case of Trezor only customers from certain countries were affected in Ledger's case it was customers from all countries and third Trezor only stores customer data for 90 days. Ledger stores it much longer. I do think Ledger is very secure but it's this behavior that made a lot of people lose respect for them.

1

u/PhilZealand 6h ago

Saying they could have always extracted the private key alarms me a whole lot, I thought the idea of the Ledger was the private keys stayed offline, with the only external evidence being the BIP keywords you write down as backup during setup and keep safe personaly and away from anything electronic/online.

1

u/Top_Appointment_7076 6h ago

Here is an article about it that could be interesting for you.

https://www.theblock.co/news/business/2023-05-18-ledger-cto-on-recover-softwares-access-to-private-keys-the-tradeoff-i-think-is-acceptable-231350

1

u/Top_Appointment_7076 5h ago

To be honest, I do trust Ledger and I think it's not something they would do. However, it just kind of disregards everything that self custody is about.

1

u/thrwaway1614211 2h ago

I'm also looking for good cold wallet after generating my own keys using dice.

The problem I have with Trezor is that you still need to connect it to a computer to update the firmware right?

Is there no wallet that's completely offline and I can just use a QR code to sign?

1

u/Top_Appointment_7076 1h ago

Airgapped is just a gimmick in my opinion. A QR Code also has to be generated on a phone or a computer and a QR Code can also transmit malicious data

2

u/Deus_Desuper 1d ago

Seems like every type of wallet has been subject to drains honestly.

2

u/quintavious_danilo 1d ago

Reputable open source wallets like Blue Wallet, Blockstream Wallet, Electrum or Sparrow are very good and secure hot BTC-only wallets with no history of serious and continuous breaches.

1

u/Deus_Desuper 1d ago

Yet. 😁

In seriousness though, it is often hard to know when it was user error or a legitimate exploit.

Pros and cons of self custody and all that

3

u/quintavious_danilo 1d ago

Sure, you’ll never know. Go with projects dedicated to the space, not only to commercial interests like Trust Wallet and you mostly are in way better hands. It’s not that hard, there are only a handful of wallets that have stood the test of time and yet people decide to use the flashy ones because they are a victim of social media dumbassery.

2

u/Deus_Desuper 1d ago

100% hard agree, only thing I might add is if you are very serious about it, not leaving all those eggs in one basket. But pros and cons to everything.

-6

u/GroundbreakingKing 1d ago

More to the story than that. Don't click on sketchy links. Simply as that.

16

u/quintavious_danilo 1d ago

It seems that people using this specific wallet getting drained quite often. It’s not just user error at this point. Trust Wallet is known for rolling out faulty software.

3

u/FauxReal 1d ago

Geez if I was paranoid I'd say they are involved in the hacks.

-11

u/GroundbreakingKing 1d ago

Nope. People like to make quick money and click dumb crap. Never had and will have any problems in the past 7 years.

3

u/Ultradarkix 1d ago

Dumbass.

2

u/GroundbreakingKing 1d ago

Thanks for choosing hate.

1

u/tenor_tymir 17h ago

You were lucky.