PIN

Jpotter145

>**The attack required the user to follow step by step instructions to claim the reward which ended with the victim entering their seed phrase.** Sophisicated enough to use a Ledger, but not bright enough to keep the seed on lock down or follow basic instructions included with the Ledger. IMO they literally just handed 1M to a stranger.... I'm more baffled by how do people like this even acquire that amount of money before giving it away in some non-crypto scam. [https://support.ledger.com/hc/en-us/articles/360005514233-How-to-keep-your-24-word-recovery-phrase-and-PIN-code-safe?docs=true](https://support.ledger.com/hc/en-us/articles/360005514233-How-to-keep-your-24-word-recovery-phrase-and-PIN-code-safe?docs=true)

thebitcoinhole

My recommendation is to pick a hardware wallet with these features: - 100% airgapped - A screen to verify transactions - At least one secure element - Support for passphrases and PIN - Bitcoin Only You can take a look to our website where we compare more than 50 different models: [https://thebitcoinhole.com/hardware-wallets](https://thebitcoinhole.com/hardware-wallets)

cxr303

Have your BiL's widow get access to email... then search for any of the major exchanges, any major wallet companies (hw), etc.. for the former, then have them coordinate with the exchanges, with death certificate, the transfer of account. For the hardware wallet, if receipts are found... look for delivery details... that might give an idea of where the hw may be... also, it gives an idea of which app to look for on the phone. The issue will be with biometrics or PIN... if they know that, they should be good! It would be best to find a hw wallet and recover from there.. or get the exchange details figured out... A friend of mine passed Jan1 and I got his widow access to his systems... I have a few more to go, but with that, I'm going to look for wallwt.dat wherever I can so his wife and kids have something for their future... he and I used to talk about mining, and even may have back in the day.

dLoneRanger

If the amount is too big, buy a 2nd, make use of PIN + Passphrase

skydiver19

That's not how cold storage works, your keys and sometimes seed phrase are stored on a physical device. The only way to access your wallets is to then have that device in your possession, you then unlock it using a PIN code, and it allows the transmission of the keys to your mobile phone to unlock your wallet. The whole purpose is not to have an app with keys on your phone in the event of someone getting malware , hacking and stealing your creds or taking the device over. If you live someone, even writing that phrase down in two parts in different areas for example under your bed and under a desk is more secure that having an exchange hold your assets Someone would have to break into your house, know what they are lucking for to steal what you have. Fine if your house burns down you are somewhat fucked, but that would be no different that having a cold wallet thumb drive that's in the house. Regardless of having a device you are still meant to wright your seed phrase down in the event of it getting managed, loose or stolen so you can still gain access.

brando2131

I agree about Trezor being good for people starting out, if there's a good alternative, like Trezor, I don't recommend Ledger to anyone anymore. Not after they leaked everyone's PHYSICAL HOME addresses from their DB, they are a security company after all ... That is extremely dangerous, it only takes one idiot to go driving by and break into homes looking for valuables knowing they were involved in Bitcoin in 2020 when the breach happened. That along with higher email spam. https://www.bitdefender.com.au/blog/hotforsecurity/threat-actors-target-ledger-data-breach-victims-in-new-extortion-campaign/ Yeah the new seed backup isn't a good look, but that wasn't my main concern, but it is the straw that broke the camels back for me. Also it's just shit... The ledger S... The tiny screen that has a handful of pixels... The tiny two buttons takes forever to input a 8 digit PIN, let alone a 24 word seedphrase and passphrase... The tiny amount of memory it has, can only support 3-4 cryptocurrencies at a time. I know the plus and X is an improvement, but it still has the same form factor with two buttons inputs.

_mstrmnd

I've committed a decent amount of thought on this, and I believe I have a fairly novel approach. I too did not want a method that involved a third party. I've come across a few articles and posts discussing something similar, but for some reason or another, none of them satisfied what I wanted. I should say this is something I have yet to implement, and my intention with sharing this, is that I may receive some critiques. The components are a time-locked transaction, and at current, any set of Tangem cards (two or three). For how I'm thinking about it, the time-locked transaction would be setup 52 560 (144 blocks/day X 365 day/year) from current block height, with the receiving address being that which is controlled by the set of Tangem cards. Since simply altering the UTXOs that comprised the original transaction would invalidate the transaction, while you are alive you could use this to 'reset the timer' as it where. I'm thinking each time you consolidate UTXOs lets say, you create a new time-locked transaction. This is obviously more appealing to long term holders, and could be done at any given interval. The hex code of the new transaction would obviously just need to be shared. If you should pass or become incapacitated, the transaction would eventually reach the block height at which it is valid, and the transaction would simply need to be broadcasted. The tool at bitaps seemed the most suitable, though any one would suffice. I'm thinking Tangem cards, as this appears to be the most user friendly option on the market at present i.e. a very small learning curve, mobile based. The user would simply have to remember the PIN, and you could safeguard against any one person forgetting it, by making it the same for all cards in the set. Obviously each party you gave a card to would either have to be a family member or be highly trusted. The valid hex code could be contained in a document outlining any details you feel are relevant to the necessary parties ultimately securing the coins. I likely missed some relevant points, but I trust at the least this outlines the concept.

dvsbyknight

You could setup a wallet with a passphrase so that the seed is not enough to recover the wallet without the passphrase & vice versa. Then you could store a copy of the seed with one friend/family member, and a copy of the passphrase with another. Neither of the copies are vulnerable by themselves, only when brought together. You don't even need to let the parties know who each other are and it's probably more secure if you don't. Then you can simply leave instructions with the person holding the passphrase that if something happens to you they can inform the family that they have the passphrase & will need to get together with whomever has the seed phrase in order to recover the coins. This also has the advantage that if you memorize the passphrase for your own daily use of your wallet, you don't have to store it & the seed phrase together even in your own home so if someone gains physical access to your seed backup at home or anywhere else, it's not vulnerable. You could then add to your instructions to the person holding the passphrase "if I ever lose my memory, come to me with this to let me know I'll need to use it with my seed to recover my coins." I've heard others recommend a multisig wallet for inheritance planning & that can be another option, but personally I feel a multisig is more complex & confusing for heirs than the seed/passphrase setup. I know you say you may not have tech or crypto savvy people in your family but trust me, if money's involved they will be on Google figuring it out before you're even cold LMAO. *IMPORTANT NOTE: In the above example I'm not referring to a "Password" or PIN that your wallet may offer or require when setting up a wallet. A "Password" or PIN is only setup at the device level & IS NOT needed when recovering a wallet from a seed phrase. A "Passphrase" is an optional setting that is at the protocol level and it IS needed when recovering a wallet from the seed phrase. It is very important that you understand the differences & implications before implementing a passphrase as it can lead to lost coins if handled incorrectly.*

Admirable-Style4656

I had an experience like that last week with a parking meter. It was honestly painful haha. With Bitcoin all you do is write 12 words in sequence on a durable material and never show anyone. An okay wallet like Blockstream Green will allow you to set a PIN for quick access to the account, and then you're confronted with technical jargon for making a payment. For most people it's just way to much to deal with, and I don't blame them.

ArmLegLegArm_Head

I responded to another comment, but maybe something like bitcoin debit cards — tied to ID and secured with a PIN and refillable, automatically or on demand, thru self-custody or central exchanges with personal accounts, operating on layer 2 infrastructure.

genesisutxo

Bro I have a ledger nano s plus and I was also a bit nervous. But I saw that they only extract the seed when you sign off on it with the ledger. And they also mentioned they can’t recover a passphrase no matter what. So I just created a pretty strong passphrase and attached it to a strong PIN code and that’s it, I moved my funds to the “hidden” wallet. I would recommend you do this for now and then look into onekey, or SafePal x1 as they are open source and support way more coins than the jade.

Ilovekittens345

the problem with cold wallet is that most people when they decide to access them use that seed on their online system, comprosiming it. Afterwards, it's no longer a cold wallet even though they think it is. Cold wallet are not the way to go, hardware wallets are. Hardware walles offer plausable denialbility so your SO only steals your dummy wallet after you tell her the PIN so she stops nagging, or that police officer or TSA asshole. Or that robber that put a gun to your head. Or the RSI. Plausable deniability is the best thing ever. Everybody should have it. 5% of your shit on a trezor just behind the PIN with no passhrase but if you type in the passphrase ... bam there is the 95%.

StatisticalMan

An SSD doesn't change the fact that the keys are on your computer and if your computer is infected with malware that likely means instantly losing your crypto. The whole point of a hardware wallet is the keys are never on your computer. Your seed phrase ("24 words") should be backed up off line only in analog form. If you do that then concerns about password? (PIN) or technical problems are a non-issue.

animuz11

How did you pay with btc? Did you use a specific app and did the retailer use the regular PIN device, or a different machine to accept btc? How about the fees?

El__Jeffe

For sure. In addition you can set a PIN so the trezor won't connect until the pin is entered.

NoisePollutioner

u/AccordingLaugh5550 lol I'm impatient, so I actually just asked Google Gemini my above question. I'm sharing the response here for anyone who reads this thread in the future (and in case you spot any accuracy in Gemini's response). Here's what Gemini said...... " Yes, that's a fair and concise way to summarize the security benefits of hardware wallets for Bitcoin. Here's a breakdown of why it's accurate: * **Hardware Wallets and Private Keys:** Hardware wallets store the private keys to your Bitcoin in a secure chip isolated from the internet. These private keys are critical for accessing and spending your Bitcoin. * **Physical Theft vs. Digital Theft:** A thief stealing your hardware wallet itself wouldn't be able to steal your Bitcoin because they wouldn't have the private keys. The hardware wallet typically requires a PIN or passphrase to access the private keys. They would essentially be stealing an \~$80 piece of hardware. * **Importance of the Seed Phrase:** The seed phrase is a set of words that acts as a master key to recover your private keys in case you lose your hardware wallet. If someone steals your seed phrase, they could potentially steal your Bitcoin by using the seed phrase to recover your private keys on another device. **Additional Points to Consider:** * **Physical Security:** While a stolen hardware wallet doesn't directly result in Bitcoin loss, someone with the hardware wallet might be able to guess your PIN or trick you into revealing it, potentially gaining access to your Bitcoin. So, some level of physical security for your hardware wallet is still recommended. * **Multi-Factor Authentication:** Some hardware wallets offer additional security features like multi-factor authentication, adding another layer of protection beyond the PIN or passphrase. Overall, your statement accurately highlights the core security benefit of hardware wallets for Bitcoin - they offer physical isolation for your private keys, making them less susceptible to online theft. "

0x07AD

NEVER post your seedphrase. You probably already know, but I am replying for the sake of any newbies who may not understand their seedphrase is essentially the combination to a vault containing their bitcoin (satoshis) and only theirs. It would be akin to leaving your bank card (ATM) in public and writing the PIN code on the back of the card.

Confident-Target8129

Number one reason I decided not to get a coldcard is the 13 wrong PIN attempts brick the device and this setting can’t be turned off. Lots of people might do a few transactions and leave their shit on the desk if they get a phone call. Imagine your child or whoever comes in and starts pressing the buttons lol that’s it it’s a paperweight. Absolutely no reason that 13 incorrect attempts can’t be device wiped instead of bricked into a useless piece of plastic.

jcpham

I wouldn’t count on or enable Face ID on a phone with money on it. Mirrors and pictures can defeat that I’ve done it on my daughter’s phone IT IS A JOKE PIN codes are more secure that Face ID I can’t help you on where to keep your money safe but if Face ID is the key to your safe you might as well leave the safe open

DivinityInsanity

Could someone explain this to me, please? I sent everything I have to the exchange, and figured I would try out recovering my wallet now that it's empty (something I should've done when I first set it up)! So I delete Ledger from my PC and phone, but all it takes to connect and restore my wallet is simply my PIN? Only once I reset my actual hardware wallet I had to enter my seed phrase. Why would I ever want to factory reset my wallet, what's the point in that? But then, my hardware wallet is only as safe as my PIN is?

ardevd

Keep it simple. Why split it across multiple hardware wallets? Does your threat model include people shoulder surfing your PIN entries and stealing your hardware wallet? Have a simple setup and execute it perfectly. I’ve never heard of anyone who got their funds compromised due to a (reputable) hardware wallet hack. Most people screw up by either a) insecure backup seed phrase storage b) falling for scams c) falling victim to their own complex wallet setup (multisig, seed phrase treasure hunt, etc)

thamer

[**Found it**](https://web.archive.org/web/20141225104313/https://chronocoin.fr/fr/). It looks like a French project from around 2014. Like others in this post I could find anything with a search for "Chronocard Mini", but with "Chronocard BTC" [this article](https://www.rudebaguette.com/en/2014/05/first-french-bitcoin-center-now-open/) from a French tech website mentions a _Chronocard_: > Chronocoin: buy your bitcoin with your debit card, and store them on a Chronocard. The link on Chronocoin points to `chronocoin.fr`, but this redirects to `coinhouse.com` now, ten years later. Thankfully the Internet Archive has a [copy of Chronocoin from 2014](https://web.archive.org/web/20141225104313/https://chronocoin.fr/fr/), with photos of what appears to be the exact same device, also referred to as a "Chronocard Mini". From what I can tell it's not an actual hardware wallet, but a hardware authentication system that lets you access your coins on this French exchange. Quote: > L'association Chronocard + code PIN choisi lors de votre commande sont indispensables pour accéder à votre portefeuille en ligne. translated: > The combined Chronocard + PIN chosen when ordering are required to access your online wallet. So it looks like it's not a hardware wallet, and it's probably not a "fake device" either. Just a (likely) defunct authentication device from a [company](https://www.crunchbase.com/organization/chronocoin) that seems to have rebranded. If you find the Internet Archive to be a great resource and can afford it, [please donate to it](https://archive.org/donate). Check also if your employer will match your donation, mine does.

castorfromtheva

You can use it statelessly, meaning your keys won't be stored on the device. In this case you "load" your wallet onto the Jade every time you use it via a "seed qr" which you create manually during the setup process. You can also use the Jade like any usual hardware wallet, with the keys remain stored on the device. In this keys you need to unlock the device via a PIN. Here you have to use Green Wallet via Bluetooth instead of NunChuck via qr because NunChuck doesn't offer this way of accessing the Jade, only air-gapped. FYI: Seedphrase = 24 words (out of a standardized word list) that specifically define YOUR wallet. Passphrase = "25 th word", a password on top of your seedphrase which can be anything you want and which creates a completely different set of keys than you seedphrase itself. Recommended to be used but first look into it and understand how it works! PIN: A 6 digit number that unlocks you Jade in case you go with the second method mentioned above.

freakzee

Depending on your needs. In summary, Web3 wallets are suitable for active users who frequently interact with the blockchain, while cold wallets are better for those prioritizing security over convenience, especially for long-term investments. However, Trust Wallet (provided by Binance) is still one of the most secure web3 wallets out there. Here are some of its security features: Non-Custodial: Trust Wallet is a non-custodial wallet, which means it doesn’t store users’ private keys on its servers. Instead, the keys remain on the users’ devices, giving them full control over their funds. Backup Feature: It has a backup feature that allows users to recover their wallets and funds using a recovery phrase. Security Scanner: An inbuilt Security Scanner helps detect potential risks during transactions within the wallet. PIN and Password Protection: Users can set up a PIN and password to prevent unauthorized access. 12-Word Recovery Phrase: A 12-word recovery phrase adds an extra layer of security. Encrypted Cloud Backup: For increased wallet security, users can opt for encrypted cloud backup. Privacy: Trust Wallet does not track personal information, including IP addresses or balances. Proactive Alerts: The wallet provides alerts for risky address and dApp connections.

Status-Seaweed-5705

Passphrase is to be used WITH your seed phrase, when restoring an already existing wallet. So if your jade is configured like a normal wallet (not a seedQR), you use it only once. For everyday use Jade has its PIN. So you first unlock your Jade with your PIN and then you will be able to connect with Sparrow or any other desktop companion app. Once you prompt for a transaction on Sparrow, you will only have to accept the transaction on the Jade itself

MasterMonkMoney

Only if they have your Trezor and know your pin. If your treasure device is stolen and they don't have your PIN it is useless. "To prevent brute-force attacks, after every failed attempt, Trezor enforces a delay before it lets you try a different PIN again. This delay increases by the factor of two each time. After 16 incorrect attempts, your device wipes itself, making it possible to access your funds only with the use of your recovery seed" Only the seed phrase absolutely 100% needs to be kept completely safe from anyone. Obviously do your best to keep the hardware wallet safe too.

Corbimos

Yes, Ubuntu is very easy to flash. Lots of videos out there. Simalir to bitcoin, Ubuntu is an open source project. It's free and the majority of bitcoin tools will run on that platform. Just make sure your hard drive is big enough to last as the timechain grows in size. 2TB should last you until the drive dies. Electrum server is great for privacy only if you are using tor. If you connect to someone else's electrum server on clear net, they can tell what information they are serving to you. If you have your own electrum server, you do get some added privacy since you run the server. If you run Bitcoin core and Sparrow wallet, your addresses end up being stored on the machine. if you use a HWW it is not your private key info, just your public info. So if someone get phycial access to your computer, they could see your addresses, but thats it. I think Bitcoin Core is easier for most people and the privacy tradeoff is fine imo since they need physical access to get your info. Washers are good, but they can be easily lost. I would look to get another backup metal plate if i was in your position, just for redundancy if possible. Something simple works. I would recommend using existing BIP39 words. Maybe just use another 12 word seed as your passphrase for plausible deniability as most people would assume thats a different seed and not a passphrase. Put some decoy funds on that wallet and write in steel as well. HWWs like coldcard can store the passphrase encrypted on the SD card so you don't have to type every time. Yeah, use the PIN. Save the QR, but dont store it with the HWW. Keep it very safe and hidden. Plus, using the passphrase will protect that private key QR code. You should be exporting or scanning something on the jade to input the wallet data into Sparrow. It is pretty easy and the software shoudl walk you through importing the info. No need to apologize. Happy to answer any more questions.

CoolioMcCool

ATM? Do you mean the automatic ATM machines where you put you personal PIN number in to access you bank or are you talking about the BTC coin automatic ATM machines?

SmellyCummies

Fuck yeah, this is the type of info my brain needs! I am not to familiar with Ubuntu...I assume there are plenty of videos on youtube that can guide the process? From what I have read, the biggest difference between Bitcoin Core and an Electrum server is privacy of transactions mostly? I plan to just send BTC to my wallet and hodl for years. Would going without an Electrum server be just fine for my use case? I have my seed phrase stamped into washers. The "Safu ninja" method to be exact. Passphrase I was just going to remember. Maybe I will jut it down somewhere. Something simple should be fine I assume? Or is a passphrase meant to be some kind of short story or some shit. Not familiar with how it works. I plan to set up my Jade air gapped and use it fully air gapped forever. So you suggest I make a PIN so I don't need to scan the QR code each time? I will keep the QR code handy for future multi sig purposes though? So, this may be a stupid question, but I set up my Jade, create a seed phrase, go through all of that and then I create a new wallet in Sparrow and select the air gapped option, and I assume from there it is pretty easy? Sorry for all the questions. I am just so new to anything outside of purchasing BTC on an exchange and sending it my Ledger.

SmellyCummies

I currently have all my BTC on a Ledger Nano X. Don't worry I plan to change that. I just got my Jade the other day, and I was going to use it with Sparrow wallet. But I am a little nervous about it. Should I just order another Hardware wallet and set up multisig from the start? Should I consider getting a Node first and an Electrum server? I want to store my future safely...but I also don't want to fuck it up. It seems daunting and I am afraid of fucking something up. I have been watching countless videos, but would it be ok to send all my BTC to Sparrow now without having my own node or Electrum server yet? Should I wait until I get those things? I do plan to do my Jade completely air gapped. Not sure if I should have a PIN on it or have it scan a QR code each time. I know I can do a passphrase, which I will do, but should I also split my BTC up between multiple pass phrase wallets? Fuck this shit is so nerve wracking sometimes. Especially for a paranoid little pussy like me. I wish Ledger didn't suck but all this stuff I read about them lately has me nervous storing all my BTC on there. I plan to just use the Ledger for Altcoins after I transfer my BTC off. My brain sucks I hate how I overthink everything.

Obvious-Shop-6260

I read this other day and can’t legitimize having multiple wallets with the same seed phrase. It makes no sense what-so-ever. There is no benefit, or increased security, with that structure. I’ll give anyone my usb… take it. It will erase itself after 3 failed PIN code entries. Good luck with that. I’ll keep my seed phrase….. and my BTC. ;)

brandishedlight

PIN IT

Yodel_And_Hodl_Mode

> Do you add a passphrase to your parent master seed I don't. It's important to keep it simple. > or do you consider that unnecessary if you don't use that seed itself as a wallet in which to deposit funds, but use only child seeds/private-keys derived from the parent seed as wallets, and add additional security by adding a passphrase to each of them? Yes. Exactly. I've never used the parent seed for anything, except to generate child seeds. I use those child seeds as wallets. I have multiple wallets: One for personal use, one for work, and one for testing. Each uses a different seed and a different passphrase. I set it up this way because I find it to be easier. Somebody else might prefer having just one child seed and using a different passphrase for each wallet. That's fine too. There's no wrong way, so long as you set it up properly and have documented your work somehow, for future reference. So, my setup is like this: Parent Seed. (Unused as a wallet) Personal Wallet: Child Seed A & Passphrase A. Work Wallet: Child Seed B & Passphrase B. Testnet Wallet: Child Seed C & Passphrase C. > Out of curiosity, which hardware wallet are you referring to? **[Krux firmware](https://selfcustody.github.io/krux/getting-started/)** running on Maix Amigo hardware. Eventually, I'm going to do a full tutorial on my setup, but here's the gist of it. I have a Blockstream Jade and TWO Krux hardware wallets. The Jade is only for generating child seeds, so it only gets used once a year when I test my setup (Everybody should test their setup once a year!). Why two Krux Wallets? The hardware (Maix Amigo) is dirt cheap, so it's nice to have a backup. But the real reason I bought two is because Krux does encrypted SeedQR, but it doesn't do encrypted passphrase QR (at least, not yet). Since I'm using a 12 word seed as a passphrase, I encrypt it as a seed. I use a 24 word seed *as my seed,* and a 12 word seed *as a passphrase.* Both are encrypted [like this](https://imgur.com/a/mfO8c4c). So... with one Krux, I load the 24 word seed and decrypt it (Scan to load, scan to decrypt. It's so fast!). With the other Krux, I load the 12 word seed I'm using as a passphrase and decrypt it. With the first Krux, I scan the passphrase on the second Krux. I know that sounds like a lot of hassle, but it's much faster and easier to do that than it is to enter a passphrase on a ColdCard. Krux A: Scan & decrypt the seed phrase. Krux B: Scan & decrypt the passphrase. Krux A: Scan the passphrase on Krux B. I LOVE THIS SETUP SO MUCH! It's incredibly secure, and it's surprisingly easy to use. Krux is a million times easier to use than any other hardware wallet I've found. There's no PIN to unlock it, because nothing is saved on the device. The device has a large touchscreen and the UI is well laid out. They didn't hide any of the features. For example every time you load a seed, it asks if you want to use a passphrase. Most hardware wallets treat users like idiots & hide the passphrase. Everything with Krux is well laid out and easy to use. I recommend it very highly. It's worth it for the ability to encrypt SeedQR and scan passphrases. Those two features alone are worth their weight in gold. And the Maix Amigo hardware to run Krux is great. It's a touchscreen device designed for development & tinkering, kind of like a Raspberry Pi, but a complete gadget, not just a board. And since it's not a crypto related product, you don't end up on a bullshit corporate mailing list (I still can't believe Ledger leaked names and home addresses of millions of their customers!!!). I'll say it again... I love this setup so much. Krux is an under the radar project that deserves so much more attention. I think it's best in class by a long shot, and it's just getting better.

Machinedgoodness

Thanks. I’ll read again I haven’t since 2017 or so. The fact that you always need the seed words makes me always think paper is inevitable. Hardware device can fail. You need multiple backups and ideally you don’t want anything online ever so that’s basically… paper. Memory and offline disks (Hardware wallet). Paper isn’t great if someone breaks into your home. Hardware I’m guessing has some PIN or biometric so that’s good. I was thinking multiple hardware wallets for redundancy

Maxx3141

In another comment you say the wallet did have a seed - but did you write down the seed? Is the wallet still functional enough for you to access these informations? If you can still browse the setting, also look out for a "private key", that be even better. Cardano is a mess in terms of key derivation, there are a few different standards. According to [this](https://medium.com/cardwallet/c-wallet-will-cease-operations-708de72ad67f), it should be a 15 word seed: >Restoring a wallet using seed phrases is also an option. To proceed with this, open the C-Wallet application, navigate to the “Settings” menu, then select “Security” followed by “Backup wallet”. Upon entering your PIN, you will be able to view the 15 words necessary for restoring the wallet in other applications. **It is crucial to remember never to share your seed phrases with anyone!** There might be different derivation paths, even for 15 word seeds, I'm not that familiar with Cardano. If you still can't restore it to a wallet, ask here again, and I'm sure someone from the community who is not a scammer can help you to find a compatible wallet.

arcticwanderlust

Oh I see. Whoever gets the hardware wallet won't be able to use it because they won't know the PIN? So it's essentially swapping the need to memorize the long seed phrase to a need to memorize the short PIN. But of course the risk associated with having to store the seed phrase - in memory or on paper - still doesn't go away, you'd still need it in case you lose the hardware wallet?

azgal677

You have to watch Mr. M Podcast on Youtube - Gold vs. Bitcoin. Posted 2 days ago. Schiff vs. Davinci. Everything is clear now. At the end of the video Schiff actually admits he had BTC given to him and had someone put it in a wallet for him and he lost the PIN. Claims to never have gotten a seed phrase. Also, talks about his brother losing his BTC which is still on Coinbase (can't log in). Can't make this stuff up.

webbs3

Get hardware wallet. Trezor is one of the best options. This is how to set it up: 1. You need to plug the Trezor wallet into your computer's USB port. Once you do, the Trezor screen should show you an image of a lock and a website to visit. 2. The webpage will give you further instructions on how to keep your Trezor wallet safe, before re-directing you to wallet.TREZOR.io.  3. Now you will need to install the Trezor wallet, which will allow your hardware wallet to communicate with the blockchain. You can either install the Google Chrome extension, or download it directly on to your device. 4. You will now be asked if you want to install the latest firmware. Make sure you click "Yes, Install". 5. You will now be asked to check that the “Fingerprints” on your Trezor hardware screen match those displayed on your computer’s device screen. If everything looks good, click "Continue"(*on your Trezor device*). 6. Now you need to unplug your Trezor wallet from your computer and then re-insert it. Then go back to wallet.TREZOR.io. 7. You will now be asked to give you the Trezor wallet a name. This can be anything you like and it can always be changed at a later date. 8. It’s now time to set up your PIN, which is one of the most important parts of the setup process. On your computer screen, you will see the following image. 9. On your Trezor hardware wallet screen, you will see the following image. 10. This is where it gets *a bit confusing*. The position of the numbers that are displayed on your screen is random, which ensures that nobody can find out which keys you are pressing. However, you need to enter the numbers you want on your computer. For example, if you want to choose “7,1,6,5”, you would need to select the same position in the blank squares displayed on your computer screen. You will need to enter this twice, which ensures you don’t make a mistake. 11. Now that you've set up your PIN number, your Trezor hardware wallet will display your 24-word backup phrase. **It is really important that you write these down and keep them safe because if you ever lose your wallet or it is stolen, you will need this to recover your funds**. You should have received a 24 lined piece of paper within the Trezor box, so you can write them down on that. Quite a long guide. But should be helpful. [Guide](https://www.bitdegree.org/crypto/trezor-wallet-review) with the images.

tehmattrix

I bet his PIN is 1-2-3-4.

MostBoringStan

No. The private keys are in the device. You plug it in, enter your PIN, and you have access to your wallet. You only enter the seed phrase if the device has been destroyed or lost, and you want to recover your wallet on a new device.

jilinlii

Good question - it's imperative that you remember the passphrase you used when setting up the wallet. Like I said, first access the wallet by entering the PIN / password, but then *not* entering the passphrase. There is a chance you may have transferred to your non-passphrase regular wallet. (Not too likely, but better to double check.) If it's not there, then the solution is to enter the exact passphrase you used when setting up the wallet. If even one character is off, you won't see your wallet.

jilinlii

> I opted in to create a passphrase as well for additional security When viewing balances on Bitbox02, the app prompts you for two things separately: 1. A PIN / password to unlock the hardware wallet 2. A BIP-39 *passphrase* to view the hidden wallet associated with your seed The situation now is: you can't see your balance, but it's definitely there, per the blockchain explorer. So try a couple things: * View your regular wallet (without entering a passphrase) to see if you accidentally transferred there; or * Try a few different variations of your passphrase By far the most likely scenario is you're entering your passphrase wrong.

confuze

If the PIN is accepted I'd still think it the passphrase that is wrong. Maybe you've used the PIN as passphrase? Test that.

angello_

Thank you for responding! It ask for the PIN first then the passphrase. I did think about disabling the passphrase but it gives this message : any coins on your passphrase-wallet will still be on that wallet, however you wont be able to access them beacause after unlocking bitbox02, you will open your default wallet.. ​ so i dont know if this will work

confuze

When you start the device, do it asks for for passphrase, not just the PIN? Try with and without the optional passphrase.

Tinkering_Soc

This is critical. You have a couple of levels of security. 1. A *hardware* wallet leverages a physical device to protect private keys. So you might have to input a PIN to confirm transactions, etc. But that is much harder to hack. 2. *Cold storage* is a wallet that never touches the internet. Institutions and pro services use this. A hardware wallet is likely enough. So go ahead and Google "Ledger" or "Trezor", these are two main ones and then check out the learn / blog sections

Dont_Waver

You're thinking of a PIN, they're talking about a passphrase, which essentially creates an entirely separate wallet. They're very different things. If you use just the 12 word seed phrase to restore, it will restore a wallet, let's call it Wallet A. But if you use the 12 word seed phrase plus the passphrase, it will restore a completely different wallet, let's call it Wallet B. Wallet A and Wallet B are completely unrelated.

aScarfAtTutties

All a PIN does is lock your wallet app. Your seed phrase can be used to restore your wallet on any device and on any wallet software.

Zombie4141

Id definitely get some of the ETF, it’s insured and in some accounts like a Roth IRA you won’t need to pay capital gains. However I would keep some of your stack secured by a hardware wallet. And add a hidden wallet. When you add a hidden wallet you are adding an additional passphrase to the Seed or your PIN number. This is how it works. You plug in your wallet and enter your pin, that gives you access to your wallet. I usually put 1/10 my bitcoin in there. Then you enter in your passphrase and you have access to your hidden wallet the other 9/10 of my bitcoin is in there. If somebody steals your hardware wallet and threatens you, give them your pin and when they steal your 1/10 bitcoin stash they’ll never realize you have more. Also when recovering your wallet you’ll need your seed to access your 1/10 wallet. But if you restore it with the seed and the passphrase you will be able to access your hidden 9/10 wallet. So in conclusion the passphrase is the most important thing and needs to be stored separately from your seed and your pin. If anybody tried to steal your bitcoin and they get your hardware wallet, pin, and seed, they will not be able to access your hidden wallet.

TissueUnflawed

It doesn't make sense for wallet recovery, which is the main purpose of a seed phrase. If the hardware stops working (they all do), you need both the seed phrase and passphrase to recover. The PIN doesn't help at all

loupiote2

If you could not reset your ledger, you should have destroyed it. Most likely it was just the display that was bad, and ledger displays cost $3 and are easy to replace. All this has nothing to do with the recover service, which can only extract your encrypted seed shards if you subscribe to the service and approve it on the ledger. Since you did none of that, no issue there. But if your PIN was 1234 and it was just the display that was bad, then yes, you took risks.

Whatsup167

Here’s a summary off the website kaspersky “A hardware wallet is a piece of physical technology (sometimes resembling a USB thumb drive) that securely guards a crypto user’s private cryptographic keys in offline or “cold” storage, ready to be used online for completing a crypto transaction of some sort at a later date. Unlike a conventional wallet for physical or fiat currency, a crypto hardware wallet does not contain any of a user’s existing coins. Hardware wallets keep the user’s private keys (needed for accessing their coins) safe for later access to the blockchain. Most hardware wallets can even work with multiple blockchains simultaneously. This allows a user to manage many different types of coins from many different exchanges on a single device. All of the data stored in a hardware wallet can be easily backed up with a single recovery phrase or PIN code.” I look at it like a physical savings account that you and only you are in control of. It is a way for you to take your crypto off of an exchange and put it into your possession. With your money on a platform like coinbase it can be used without your knowledge to give out loans, and other things. look up FTX collapse and that will give you another idea of the nefarious ways your crypto can be used on an exchange without your knowledge.

-ctyrka-

There’s nothing against common sense when using your wallet. But if you own significant number of Bitcoins, you custody them yourself and travel, will you take your hw wallet with you? Is it safe? How about its backup? I personally don’t take it easy and don’t call Shamir backup overkill at all (this is what I suggested in this topic). At a first place, picking strong PIN (not 4 digits) and complex passphrase is must. If you set up these correctly, then more important than safeguarding physical wallet is a backup strategy. (of course using Trezor wisely is premise) Second, you can have tons of common sense, but issues like burglary, fire, flood or any force majeure can destroy your seed in your absence. From that reason I consider geographical redundancy (Shamir backup with cryptosteel capsules) as the best possible precausion, way far from overkill, better than possession of multiple hardware wallets or any engraved seed phrase. Whoever writes about paranoid shits probably has never owned 5BTC, doesn’t take his money seriously or simply can afford to lose them.

-ctyrka-

you are right, you need to be careful where and how you use your hw wallet. if you follow basic rules - meaning always and only use Trezor display for confirming transactions, do not type your seed anywhere else than on the Trezor display itself when recovering your wallet, then you are safe. You can also put Panzerglass Privacy screen protector on your display to prevent somebody seeing your data. In case your Trezor is stolen, thief has 16 (or so) attempts to get to the standard wallet, so always pick good PIN (not 4 digits only). There is really minimal chance that 6+ digit PIN can be cracked with 16 tries. After that Trezor is reset. Also, using complex passphrase will minimize chance of hacking hidden wallet in case all of the previous fail. It's always good to study and understand basic hw wallet functionality because then you can confidently create your own strategy. Trezor has great wiki pages and tutorials. Thinking twice before doing anything.

HSuke

TL;DR: **How users lost their Bitcoin**: * Deceased + Lack of Estate Planning * Accidentally Backed Up Wrong Seed * Lost Seed and Wiped Device * Wrote down seed words incorrectly * Phishing Attacks * Fake Support Service * Malicious And Incompetent Hardware Wallets Makers * Vengeful Ex and No PIN * (Physical) Supply Chain Attack * Clipboard Hijacking Attacks

KlearCat

You need a secure place to store the recovery seed. Ideally you should have 2 places to store the recovery seed that are not in the same physical location. > I also considered writing a shirt story with the scede incorporated into it and just emailing it to my proton email. Do. not. do. this. Now....putting writing that short story in pencil and storing it with many other short stories at your parent's house? Yes, that is actually not a bad place to do it. > my seed has never been inputted into a computer. It is not compromised and I have not tried to encrypt it. It is just written on paper in my backpack as I move from one place to the next. Which I'm sure you can agree is so stupid of me. But what are my options? First - hide it better than how you are doing it now. Second - consider what I wrote about above. You need a secure location that is not on you. This may mean flying home and dealing with this. I assume you have somewhere where you store your things at your home country? Start there. On another note, you should definitely consider putting a >0 amount on your non-passphrase as a precautionary measure against $5 wrench attack since you are traveling with your Trezor. I'm saying this because I'm assuming you are traveling in less developed countries where theft can be a concern. If someone breaks into your things and finds a Trezor and knows what it is, that could be trouble for you. I personally wouldn't even want to travel with my Trezor as it's a giant red flag saying "I have a lot of crypto, and not only do I have a lot of crypto it's easily attainable to anyone who knows the PIN to this device"

RandoStonian

The Ledger is just a calculator that has a copy of your seed in encrypted memory. When you type in your PIN, that's decrypting the memory with your seed in it. When you want to spend some Ethereum, for example, you unlock your Ledger, pick the Ethereum app, then Ledger then plugs your seed into a math formula that's something like [ETH-1 + seed] = [spending key for your ETH account 1]. Anyone who has a copy of the seed can plug it into standard formulas to calculate the spending keys on their own. So your Ledger isn't compromised, but the seed you're storing in it right now *is*. Generate a new seed, throw away old one, and *never* store a digital copy of your seed. No typing it into your PC, no typing it into your phone, no taking digital pictures (that might get automatically uploaded to a cloud service hackers could see).

Elean0rZ

Correct, ish. You don't want to wave your hw wallet around because that tells the world you have crypto, and theoretically could increase the chances of scammers pursuing you or, worst case, a $5 wrench attack. But IF your hw wallet falls into the wrong hands, it probably isn't a big deal because the odds of the finder cracking your PIN before the device locks them out for too many attempts is very low. Still, though, if you ever lost your device you'd want to reinitialize your keys on a new device and then transfer all your assets to an address controlled by "clean" private keys, just to be absolutely safe. So yes, keep your hw wallet in a drawer or whatever, and don't sweat it too much. But your seed phrase is a different story altogether and needs to be kept absolutely secure. (Note the "secure" doesn't necessarily have to mean, like, inside a refrigerator-sized safe or something...cryptic and low-key is also secure.) Yes, remember, a hw wallet only holds keys. The associated public addresses are just as public as ever, so you can toss them into any relevant block explorer as normal to view your assets. Many apps also have a "watch mode" where you can save your public addresses and it'll display updated info in the app. But of course you won't be able to actually do anything with your assets without your keys, i.e., without the physical hw wallet to sign tx.

TheJohnRocker

The seed phrase is really the only thing to keep safe in any type of self custody wallet. Of course you should also keep your PIN safe but a bad actor would need your physical Trezor and know your PIN for theft. Someone else knowing your seed phrase is way more detrimental because they can just drain the accounts without any additional steps.

Elean0rZ

You have some good answers, so I won't repeat those. I'll just add that realized security isn't theoretical; it's based on the practical reality of your needs and personal circumstances, and is also relative to alternatives. A hardware wallet is absolutely not perfect, but relative to most alternatives it does a good job of protecting you from some of the more common risks, while still being very convenient. Separately, understand that crypto assets are never "on" or "in" any wallet. Wallets only hold private keys, which are essentially like passphrases that connect you to your actual assets, which always live as a bunch of 1's and 0's on the blockchain. A hardware wallet is just a secure way of storing those private keys. Regardless, you will need to back up your seed phrase (essentially the basis for your private keys); it is 1000000x more important than your physical hardware wallet, which is protected by a PIN and therefore unlikely to be compromised even if bad guys get hold of it. But with the seed phrase, anyone with access has access to your assets. So keep it safe, which means a non-digital physical copy in one or more safe places.

callebbb

Coldcard requires a 2 stage pin. Up to 12 total numbers. The first stage produces a short phrase, unique to each device, to protect against the evil made or man in the middle attack. On top of that, the Coldcard supports adding a passphrase, or some refer to it as the “25th word” (it can be more than 1 word and include special Characters, fwiu, but YMMV). On top of that, the Coldcard can stay offline indefinitely. It uses PSBTs (Partially Signed Bitcoin Transaction) via microSD cards to sign transactions, and a wallet interface on your computer to broadcast them. The case is translucent, with schematics published from the producer, Coinkite, so you can verify every transistor. It bricks after 10 failed PIN attempts. The company is Bitcoin only. They focus on privacy and OPSEC. Highly recommend it.

Br0-cko

That duress PIN seems interesting, I will look into it, thank you.

0xIlmari

If noone knows you own bitcoin, noone will have a reason to pull a gun on you. You can geographically distribute parts of your seed phrase backup so that all of it is never endangered at once, say, in case of a home robbery. Some hardware wallets, most notably the ColdCard, have a "duress PIN" feature, where you can divulge some secret in a gun-to-the-head scenario, but have it lead to a decoy wallet with little funds. Get yourself your own gun, if you can.

harvested

You don't need to factory reset it. You can unlock your jade with your seed instead of PIN, this will test your recovery phrase.

coinfeeds-bot

tldr; The article explains the security model of hardware wallets for cryptocurrency storage. Hardware wallets, also known as cold wallets, are physical devices that store private keys offline, providing robust security against online threats. They require a PIN for access and can recover assets using a recovery phrase. Transactions are signed within the device, keeping private keys secure. The article emphasizes the importance of understanding how hardware wallets work, their security features, and the need for safe usage practices to protect digital assets effectively. *This summary is auto generated by a bot and not meant to replace reading the original article. As always, DYOR.

Joe_From_Kokomo

Toss it. Get a Tangem wallet.  Much better design. Much easier to use. Here's what I hate about the Ledger.  The clumsy two-button interface you have to use to enter your PIN, normally 6-8 digits.  It's actually hard to use. 3 failed attempts and you're locked out. Imagine your non-technical family trying to get logged in after you die, as we all do some day, and getting locked out because they can't figure it out in 3 tries.

JacobTheSmuggler

It doesn't fall under freedom of speech (1st amendment), but it does fall under the 5th amendment protection to not be a witness against yourself. This has already been dealt with in US law. Say you have an iPhone and you are arrested for a crime. The police can force you to unlock that iPhone if unlocking can be done by physical means, like using your FaceId or fingerprint. But the police cannot force you to disclose your PIN - since that's something you memorized, it falls under 5th amendment protection. It would be the same with Bitcoin. First of all, unlike gold, it would be much harder (impossible in some scenarios) to prove that you hold Bitcoin. Say you have a wallet that unlocks with a fingerprint reader, then the police can open it, say it's with a pin code, you cannot be compelled or punished for not given them the pincode/password. Banning the bitcoin source code, or forbidding it's execution will indeed fall under 1st amendment protection of freedom of speech.

Elean0rZ

Nah, if you don't plan on doing anything you don't need to have hodl wallets vs. spending wallets. Just a hodl wallet is enough. When your goal is hodling, having multiple wallets is actually a double-edged sword. If bad guys are out to get you around every corner then you can convince yourself that you're spreading your risk around, but in practice it more often just results in more stuff to keep track of, and more opportunities to screw something up. Do you mean your kids messing around with your HW wallet, thinking it's a toy? Or do you mean when they grow up, like as a succession plan? If the former then no, they'd need the PIN and without it they can't really mess anything up too badly. Worst that could happen is they physically break your Ledger, or they enter the wrong PIN 3 times and the device locks out. Either way you would just reinitialize from your backed up seed phrase. If the latter then yeah, you'd want a plan to ensure they have access to your seed phrase if you die. Yes, you can give them access to your Ledger + PIN also, but Ledgers are pieces of tech that will eventually break down or go obsolete, whereas your seed phrase is forever. Seed phrase give rise to private keys, not the other way around. They literally provide the entropy from which the private keys are generated. You can easily generate a new seed phrase any time you want, but it will yield different private keys which won't allow you access to your assets, which are exclusively associated with your original keys (unless you send them to a different address that's associated with different keys, of course). A Ledger or other hw wallet is initialized using a single seed phrase--either one that it randomly generates, or one that you specify. That gives rise to the private keys, which are then "translated" into the "language" of any given blockchain, giving rise to your addresses on that chain. That's why the same device can be used to manage assets on hundreds of different blockchains, and why a practically unlimited number of addresses can be derived from the same private keys.

Elean0rZ

Yeah so different hardware wallets work slightly differently, but in general the idea is that they have a "secure element" inside them that holds the private keys. Rather than releasing your actual unencrypted private keys for the purposes of signing transactions or otherwise interacting with the blockchain, the keys stay fully within the secure element and essentially pass along a cryptographic proof that they exist (I'm massively oversimplifying but that's the gist). Point is, in theory you can connect a hardware wallet to a compromised/infected computer to interact with your assets and your keys will remain safe. A couple of caveats though: * One, a hardware wallet still can't save you from yourself. If you choose to sign a scammy transaction, you're still gonna get scammed. All a hardware wallet can do is make it more or less impossible for a hacker to gain direct access to your private keys. But, like I was saying earlier, YOU are much easier to "hack" than most wallets anyway. * Two, hardware wallets aren't 100% trustless. At some level you're trusting someone--the manufacturer of the secure element, company that wrote the devices firmware, whatever. You might be aware that there was a big controversy around Ledger last year when they announced their "Recover" feature, which (if you opt into it) sends encrypted fragments of your private keys to several different trusted backup services so that you have a backup in the case something goes wrong on your end. Great! But...if that's possible, doesn't that mean your private keys can theoretically leave the device? And the answer is yeah they can theoretically do that, and they've ALWAYS theoretically been able to do that regardless of what brand of hardware wallet we're talking about, and at some level you just have to trust that the companies in question aren't going to nerf their entire business, invite the entire planet to litigate them into the stone age, and have their leadership spend the rest of their lives in prison, just to rugpull their users. I would argue that the odds of that happening are MUCH, MUCH, MUCH lower than the odds of someone screwing up and compromising their assets in any number of other ways, to the point that it's not worth even worrying about until you've picked all the lower-hanging security fruit, so to speak. But in any case, just be aware that among hardline crypto purists mainstream hardware wallets are still seen as "impure" because they aren't totally trustless. That's true, but for 99.99999% of users I think it's \~irrelevant. * Three, the one area where I think concerns over hardware wallets are a bit more justified is around the risk of the companies themselves being hacked in some way. This has happened a few times, usually resulting in user information (emails etc.) being leaked, or sometimes resulting in hackers gaining temporary access to code they shouldn't have access to. Either way, the result is an increased risk of users getting phished. If you have your wits about you you can mitigate most of these risks, and my argument would still be that most other wallets have even more risks associated with them. * Four, just to answer your question, yeah, there have only been a very small handful of actual direct hacks of hw wallets, despite there being millions of units in circulation and an obvious financial incentive to hack them. All of these have involved the attacker having direct access to the device, and also exploiting obsolete firmware (i.e., if the firmware had been up to date it wouldn't have even mattered that they had direct access). To the best of my knowledge no hack has ever been successful in the wild, resulting in loss of funds for anyone. Anyway, bottom line, my personal opinion is that while hw wallets aren't perfect, they are the best option for \*most\* people \*most\* of the time, insofar as they represent real improvements in security vs. hot software wallets, while still being very convenient to use. The exceptions would be if you're a massive techno-klutz (in which case keep your assets on a reputable exchange), have only a small amount of crypto such that the cost of getting a hw wallet is hard to justify, or you're a hardline cypherpunk who doesn't mind sacrificing convenience for even more security and trustlessness. Well, OK, more more exception: When you really get into it, it's not a bad idea to keep your hodling wallet(s) and your transacting wallet(s) separate--like, manage your hodling wallet with your hw device, and then transfer small amounts as needed to another hot wallet when you actually need to do something. That way, if everything goes sideways and you get phished or whatever, your primary stack stays safe regardless. But I degress. To your point about losing a Ledger, it's not a very big deal if you do. The device is protected by a PIN and locks out if it's entered wrong 3 times, so the odds of guessing it are low. The bigger concern is the backup of your seed phrase, which is a set of 24 words that's used to provide the entropy to derive your private keys. For all intents and purposes, your seed phrase = your private keys. You don't want to wave your physical Ledger around moreso because you don't want people to know you have crypto (see: [$5 wrench attacks](https://xkcd.com/538/)), but what you REALLY don't want the wrong people to see is your seed phrase. It should be written down, not stored digitally, and there are lots of ways to do it well (circled words in a favourite book; listed as a string of [numbers corresponding to the words](https://getcoinplate.com/blog/official-bip39-word-list-mnemonic-in-english-verified/); etched in metal and buried in the bottom of your fish tank; stored in your safety deposit box if you trust your bank; split into parts; etc.--just so long as it's no so crazily "secure" that you forget how to read it yourself). The main thing is not to have it, like, tacked on your corkboard in the background of a photo you share on social media or something. And, yeah, you could store your seed phrase in a safe in your home but it had better be a good safe, because the one thing safes say is "hey Mr. Thief, there are probably interesting things inside me". IMO it's better to go for the downlow approach--if you don't look like a target it's not likely someone is going to break in in the first place, but if they do, I'd rather they see nothing that makes them even think I have anything worth searching around for. But there are certainly arguments to made either way, and personal preference will always factor in.

Bob_Vienna_MVC_93108

What else u/khanisgreat ? My SSN, the PIN of my debit card, CVV, address and seed phrase?

LargeSnorlax

Called them on the phone, sometimes videos are confusing and don't give perfect info. https://trezor.io/learn/a/get-started-with-the-model-t?gad_source=1 This is their standard guide, which looks like a lot of information, but it can be distilled into. - Install firmware - Create wallet, write down seed and secure it in safe place - turn on PIN protection and set pin The part beginners need to learn most is how to transfer from an exchange to your wallet. If you have that part down, the initial setup of a trezor is very easy and you should be able to set it up and get comfortable in 15-20 minutes, even reading through everything. Have fun!

makhpeter

Didn't the phone have a PIN or something like that?

Useful-Tackle-3089

The only practical way to break SHA-256 is by brute-forcing it: by applying the algorithm to as many random values as possible and checking whether any two random values return the same result (e.g. hash collision). What the whole Bitcoin mining network tries to do is to find a partial match - a hash result that contains a number of zeroed bits (based on a parameter called difficulty) and it takes the whole network 10 mins to find that partial match. What I’m trying to say is that SHA-256 is secure because all that Bitcoin miners are doing is attacking it and they’re only partially successful to ensure a block is generated every 10 minutes. If by an unlikely event SHA-256 was “cracked”, then after civilization recovers from that disaster, I imagine that a hard-fork would be introduced replacing SHA-256 with a “more” secure hashing algorithm, rolling back any blocks mined with the exploit. Wallets themselves are somehow safe - SHA-256 is used on some wallets to convert simple PIN codes to robust seeds, so they’d be vulnerable to hardware attacks.

wuzzgucci

How do you find out the PIN code for the crypto.com digital debit card?

handgrip_shingle

What is the use of PIN then? PIN is there exactly for these situations, if it gets stolen, they can’t get it. You done fucked up, on all the fronts

AdS_CFT_

If someone has your ledger ans knows your pin, you are screwed. If they don't know the PIN you are fine, extremely rare to guess it in 3 tries. ​ Only thing you can do is find your seed phrase and insert it in a brand new ledger (or other wallet you trust)

ScepticDog

Sorry to hear man, but definitely something that could have easily been prevented on your end. Even if you find those final words, there’s a large chance the coins are already gone. Might be best to just take this as an expensive learning opportunity and start over. Remember, the point of a PIN is to be a second authentication factor if you have the device. I store my pin in a password storage tool, and ledger device hidden that only my wife and I know. As for the seed phrase, that’s buried on a family property. If you aren’t going to be any more secure having a hardware wallet, you may as well store all your coins on an exchange that is trustworthy. The whole “not your keys not your crypto” is only valid if you’re actually going to protect the keys as if your life depends on it

Vakua_Lupo

If they have your Ledger Device and the PIN, and they know what they are doing, then unfortunately your crypto will now be in someone else's wallet.

Artistic-Comb-5932

I know of a Chinese website where you can buy one and then hook up your cold wallet to it by putting in your PIN.

Toporin

SeedKeeper (https://satochip.io/product/seedkeeper/) is the perfect use case for this! It is a smart card that allows a user to backup one or more BIP39 seeds inside the secure memory of the chip, protected by a PIN code (4-16 characters). If a wrong PIN is provided 5 times, the card is blocked. You can give a SeedKeeper backup to your loved ones, and write the PIN code in your will. If something happens to you, your family can recover the seed from the SeedKeeper using the PIN code! This is probably the moste safe and effective way to transmit your bitcoin! The SeedKeeper code is open source (https://github.com/Toporin/Seedkeeper-Applet) and it is even possible to build your own SeedKeeper device by compiling and loading the applet in a blank smartcard!

110010010011

I’m using a version of shamir in my plan. My seed words are in two places (my safe and a safe deposit box), but the passphrase which unlocks the seed is partially in three places: my safe, the safe deposit box and my dad’s safe. No one place has the full passphrase, but any two of the three together forms the passphrase. There’s also a hardware wallet in the safe deposit box, but the PIN is only in mine and my dad’s safe. This is the primary way that the crypto should be accessed. The recovery phrase is the paper back up in case the hardware fails.

knhcxe

Don't answer any private messages, no matter from who it is. Only read on this thread. Sharing your address shouldn't be a problem, it's something public anyways, but maybe you don't want it linked to your person in reddit or the risk of having it linked anywhere else because of it. If you didn't sign anything on Coinbase Wallet, didn't approve any contracts, didn't swap or transfer, then the only possibility is that your seed was compromised somehow. No one at coinbase knows your seed or has the ability to see it. Only someone with physical access to your device and the PIN or Biometrics would be able to access it (or if you wrote it down). Maybe the Metamask you used wasn't the real one and you got drained that way. Without sharing the address not much can be done, but if you did maybe someone can check transactions and come into a conclusion as to how it was drained, however it's not certain.

BitcoinAcc

If you have the seed and the passphrase stored away safely (in different and redundant places), then yes, you can reset the Trezor. And no, it wouldn’t be of any use for a thief then (it wouldn’t be of any use for a thief even if you didn’t reset it, assuming you are using a secure passphrase and have a non-trivial PIN set). And no need to regularly upgrade the firmware either. You can do that whenever you need to restore the seed in the future. Personally, I wouldn’t bother resetting it. Keeping the seed on it adds another layer of redundancy if your seed backup gets lost (of course it does not add redundancy if your passphrase or PIN gets lost, but still). I would also export the XPub of both the normal (decoy) wallet and the actual wallet and import them as read-only wallets into Blue Wallet, so that you can actually see if your (decoy or real) wallet is compromised, without firing up the Trezor and Trezor suite. Especially if you decide to actually reset (as that would additionally entail restoring the seed each time you want to check the wallet - which only adds exposure risk if you need to get the seed out of its save/secret storage space each time you want to do that). But be aware: Using Blue Wallet with your XPubs will expose your public wallet addresses to the default Blue Wallet Electrum server (i.e. the fact that these addresses are connected in a wallet, not that they belong to you personally). Just like using Trezor Suite exposes this info to the Trezor server. If you want to avoid this, set up your own node and connect both Blue Wallet and Trezor Suite to it.

poco

Hell, I was just chatting with a service provider through the online chat and couldn't remember my password (actually, I know what it was, but they kept asking me to enter the PIN into a form and I couldn't figure out the pin). So they asked me some security questions to confirm me identity... My name and email address. Before I could type anything else they then sent me my password. Like typed it out in the online chat. Not only do they use email and name as verification, but they store their passwords in plain text and give them out without asking.

greenstake

True, but from what I've read it is not as common to be tortured. They usually just drug you and steal your phone and shit. Also the Justice System in the US can force you to biometric unlock stuff. They can't force you to enter a PIN number.

Toporin

Have a look at SeedKeeper: https://satochip.io/product/seedkeeper/ Basically, it's a smart card that allows you to backup one or more seeds inside the secure memory of the chip protected with a PIN code. If a wrong PIN is entered multiple times, the card will block. Even if someone finds the SeedKeeper, it is useless without the PIN code!

Toporin

Use a SeedKeeper (https://satochip.io/product/seedkeeper/): it's a smart card that allows you to backup one or more seeds inside the secure memory of the chip, protected with a PIN code (like 4 digits).  SeedKeeper is an open-source project: the firmware is freely available, and you can buy a SeedKeeper from the official website or even compile the firmware and load it on a blank card yourself! Have a look at this YouTube demo: https://youtu.be/NTdiji9KpRE?si=jtE7gcKxJhN_F4qa

benma2

> Don't you think it's a lot riskier to lose or get the memory card of the bitbox stolen instead of having the same wallet protected by another layer of security like a passphrase? No, quite the opposite. I can't keep count with the instances I have heard of or witnessed instances where users lost funds due to passphrase mistakes. The reports of physical thefts pale in comparison. I can see how 'attach to PIN' can be useful for users who know what they are doing, but still I'd worry that it would exacerbate the above statistic. I didn't say multisig had even more dangers or was trickier to use, just that it also has pitfalls of its own. > Since this feature is part of the original protocol I would say it's important to implement it in the safest and most usable fashion. Not sure what you mean here, passphrases are not part of any protocol and are not native to Bitcoin or to seed management. I don't think passphrases can be made significantly more secure, they are inherently tricky. I think that multisig (or even Miniscript) has much more potential to be improved to become safe to use for everyone, so efforts should go there instead. Multisig also protects against more failure modes than passphrases, like loss of a single seed.

benma2

Thanks for the suggestion. You mean the 'attach PIN to passphrase' feature? It is not planned for the BitBox02. The main reason is that the passphrase is a very tricky feature to use, one where tons of beginners and advanced users alike frequently screw up. We have the feature for compatibility with other wallets, but otherwise try to discourage its use. Attaching a PIN to a passphrase makes the situation much more complex and likely to lead to critical mistakes. As for multisig in the BitBoxApp: that would be a very cool feature and we'd like it a lot, but after extensive user surveys we had to de-prioritize this below other features that are much more requested.

benma2

> (which means the only way to change BB02 PIN is to wipe and restore the mnemonic seed). This is not due to the use of the device password in the encryption, but basically just a missing feature.

No-City94

Thanks. I just bought Jade. It can be set up as stateless like Seed Signer. But I haven't decide yet if I want to set it up using PIN or as a Stateless.

Aussiehash

All chips/secure elements can be attacked with enough time and expense, if you notice that your hardware wallet has been lost or stolen then you are in a race against time to sweep your Bitcoin faster than your thief can. Whilst the blog posts say Trezor can have its flash dumped in 15mins with $75 worth of equipment, it took 5-6 years post Trezor One's release and months of work before Kraken recreated the 15 minute glitch bench. There have also been secret extraction attacks made on several generations of Coldcard Mk1,2,3 and Bitbox02 secure element chip. The CC mk4 uses 2 separate vendors' secure elements, and BB02 uses the "PIN" as an encryption password (which means the only way to change BB02 PIN is to wipe and restore the mnemonic seed). Ledger Donjon won't tell you if they've discovered an unfixable attack vector on Ledger's secure element, but given their extreme tracking and recover service, and repeated customer Doxx leaks, I would avoid them like the plague.

sburke0708

Yes because it adds a layer of security. You can and should put your seed words in metal, but having your keys on a hardware wallet with a PIN code helps for quick(er) access for transfer if needed. I suggest you keep reading more about bitcoin and self custody. Another friendly word of advice, don’t tell others how much crypto you have. Best of luck in 2024!

uncapchad

Well a time-capsule is to leave mementos of a moment in history behind for others to discover. You seem to be asking about inheritance and forgetfulness. Assume all your beneficiaries/guardians are not computer-literate and know 0 about crypto. Assume they believe it's worthless, satanic, a tax problem etc and not worth bothering about. You would first need an NFT specifying your wishes - incapacitated or dead. You'd need a trusted agent to be able to access that. You could have further NFTs with phrases etc. You'd have to have to be careful about language. *seed phrase*, *pass phrase*, *PIN* are understood in different ways by different apps. So you'd have to be particular about what info is agnostic. Then there are acronyms like CEX, DEX, liquidity pools etc. Where are your assets vs where do you think your assets are? Assume there are 0 devices, apps for any executor of your wishes to work with. Decentralisation is tricky. And so, to answer your question, I'm now going to have to use my CrimLimbo week to try figure it all out!

MrQ01

I reject the notion of "intrinsic" value, and "tangible" value relies on physicality. - Your bank account PIN number and password has no tangible value. - Your inheritance will to all your worldly assets... might be good for rolling up and building a split. Bitcoins use cases have already been demonstrated via donations to Canadian truckers, immunity from bank runs, transferring wealth across borders (in terms of refugees having to leave their home)... If anything, your own focus towards the ETFs is the step backwards towards "speculation", having witnessed use cases manifesting in real world situations... and ones that dont rely on prices going up.

boat_go_brrr

They don’t have to do any matrix hacking at all. They just need your iphone PIN or icloud password. And most people type that shit out in public.

Miserable_Twist1

I already have a set up for cold storage but it's so convoluted and difficult, so I'm tempted to try this out. So no, haven't actually tried it but I was thinking theoretically could be more secure than a hardware wallet, I don't like things secured by a PIN, because once a technique is developed to crack the hardware, it is trivial to brute force. A sufficiently long passcode used for encryption can never be broken, which is an option on this vault wallet.

LosWranglos

If someone finds a hardware wallet, they still need to access it (PIN / password etc) guess wrong a few times and the device is bricked. If someone gets your seed phrase, it’s game over.

mastermilian

The device might have a vulnerability which allows you to to extract the seed or have unlimited attempts at the PIN. You'll need to do your own research since you haven't given details about the device.

Substantial-Skill-76

I find it all very very confusing and frustrating. Seed phrases, recovery phrases, PIN numbers, pass phrases. All seems so complicated and uneccessary. It's definitely challenging. And it shouldnt be.