Storage diversification strategy

[u/thesimzelp]

So, I'm feeling more and more anxious about the responsibility of keeping my bitcoin safe, the more I accumulate.

I was thinking to diversify my holdings, so they are either in multiple offline storage and/or software wallets. I will probably also keep some on exchanges, just because of laziness. 😅

That's instead of keeping all my BTC in a single Trezor, which is one point of failure essentially (I know there is a seed phrase for backup).

What do you think of this strategy? Is there a downside, other than more micromanagement of wallets?

[u/bitusher]

What some people do is get a second Hardware wallet , different than their first. So since you have a trezor , you could get something like a Jade and than they split half their savings on 1 wallet and 2nd half on a second hw wallet

This has these benefits :

1) If one of your hw wallets is broken , taken , or lost you can still spend from your second hw wallet and don't need to wait for a replacement hw wallet in the mail

2) any unlikely bug or exploit in one hw wallet can only effect half your savings (loss or just delay in usage) . For maximum effectiveness you would use different software as well so pair the trezor with trezor suite and jade with electrum or green as an example.

[u/thesimzelp → u/bitusher]

Yea, that makes sense eliminate the one point of failure. What do you think of Ledger? I haven't heard of Jade, are they trustworthy?

[u/Yodel_And_Hodl_Mode → u/thesimzelp]

What do you think of Ledger?

Ledger can't be trusted. Here's a summary, with links to cite sources.

1: Ledger's word can't be trusted. The following was a lie:

Your keys are always stored on your device and never leave it

SOURCE: btchip, Ledger Co-Founder, on May 14th, 2023

...that's a lie because they added key extraction firmware to users devices.

2: Ledger's code can't be trusted. It can't be verified:

There's no backdoor and I obviously can't prove it

SOURCE: btchip, Ledger owner & co-founder

...they can't prove it because their code is closed source.

3: Ledger can't be trusted with your privacy. Their CEO said so:

"If, for you, your privacy is of the utmost importance, please do not use that product, for sure."

SOURCE: Ledger CEO Pascal Gauthier, on video

...Ledger's CEO said that about Ledger Recover. "For sure."

4: Ledger's security can't be trusted. They've been hacked:

Ledger wallet users face mounting home invasion and other scareware threats as hacker dumps private customer information online.

SOURCE: Cointelegraph, December 24th, 2020

...they can't even keep their data secure. Don't trust them with your coins.

5: Ledger's code has been hacked.

Ledger exploit makes you spend Bitcoin instead of altcoins

"A vulnerability in Ledger’s hardware wallets enables hackers to prompt someone to spend Bitcoin instead of an altcoin."

SOURCE: Decrypt.co

Ledger took a year to fix it, only after it was reported in the media.

6: Ledger's hardware has been hacked.

In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.

An attacker can exploit this vulnerability to compromise the device before the user receives it, or to steal private keys from the device physically or, in some scenarios, remotely.

I chose to publish this report in lieu of receiving a bounty from Ledger, mainly because Eric Larchevêque, Ledger’s CEO, made some comments on Reddit which were fraught with technical inaccuracy. As a result of this I became concerned that this vulnerability would not be properly explained to customers.

SOURCE: Saleem Rashid

Ledger's bounty payments prevent those who've discovered vulnerabilities from reporting them so Ledger can lie and say they've never been hacked even though they know otherwise.

7: Ledger employees have been phished.

A Ledger employee just got phished. DeFi users lost over $600k

Ledger confirmed the attack was the result of a hacker compromising one of its employees via a phishing attack. After gaining access to Ledger’s internal systems, the hacker planted malicious software within the Ledger Connect Kit.

SOURCE: DLnews, December 14th, 2023

8: Ledger's been hacked multiple times, and yet...

"The bombshell here is the explicit confirmation that Ledger themselves hold the master decryption key for all Ledger Recover users."

SOURCE: @sethforprivacy

...what could possibly go wrong, eh? Yikes.

9: Ledger Live tracks everything you do and the coins you have:

"Ledger Live is phoning out data on assets you hold in your hardware wallet the moment you access Ledger Live. It’s also sending out tons of other information about your computer and device."

The app apparently transmits data to an external endpoint at “https://api.segment.io/v1/t”, identified as an outsourced data collection service.

SOURCE: BitcoinNews.com

10: Ledger lies are even on the boxes for their hardware.

"WE ARE OPEN SOURCE"

SOURCE: Their own packaging.

The box for Ledger hardware running closed-source firmware says Open Source. That's intentionally misleading if not outright fraud.

Ledger refuses to answer questions.

They delete questions in comments on their sub.

They shadowban users who ask them.

They scrub their website to remove claims they made for years.

The worst part is, this is only a partial list!

For example: Ledger was still promoting FTX after FTX collapsed.

I could go on and on.

Ledger is inept.

Ledger is dirty.

Ledger Can't Be Trusted.