Ledger HACKED!! How to Protect Your Crypto!! 😱
Вставка
- Опубліковано 25 чер 2024
- 🔥 TOP Crypto TIPS In My Newsletter 👉 guy.coinbureau.com/signup/
📲 Insider Info in my Socials 👉 guy.coinbureau.com/socials/
🔓 Get Your Trezor 👉 guy.coinbureau.com/trezor/
🛒 Get The Best Deals In Crypto 👉 guy.coinbureau.com/deals/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- TIMESTAMPS -
0:00 Intro
2:02 What Happened?
4:09 Ledger Breach
6:20 Data Dump
8:04 Phishing Attempts
10:51 Potential Risks
13:29 Protecting Yourself
15:29 Wallet Tips
17:54 Upgrading Security
19:43 Conclusion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⛓️ 🔗 Helpful Links & Sources 🔗 ⛓️
► Have I been Pwned: haveibeenpwned.com/
► Ledger Initial Disclosure: www.ledger.com/addressing-the...
► Ledger Dump: / 1340733120610447365
► Setting up Trezor: wiki.trezor.io/User_manual:Se...
► Passphrase Trezor : blog.trezor.io/passphrase-the...
► SimSwap Attack: us.norton.com/internetsecurit...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🤔 What Happened? 🤔
Ledger had their database hacked back in June where the hacker was able to get away with 1 million email addresses and 250,000 personal information (name, address etc).
This was then used in order to run phishing schemes on the Ledger users. They did this through email as well as phone messages.
This was then leaked on a hackers forum on the 20th of December available for anyone to see. Users started getting a lot of personal emails that were trying to extort them.
😨 Risks From Hack 😨
The first risk that exists is that people know where you live and they know that you have crypto. They could come to your house and force you to enter your password and hand over the crypto.
The phishing attacks are also a risk as the hacker will try to get you to download some malware that will steal your private keys or your seed words.
These phishing attacks have also extended beyond just hardware wallets as the hackers have targeted users with exchange phishing attempts.
Finally, there is also the risk that they could get sim swapped on these exchanges. This is when the hacker will commandeer the cellphone and bypass the two factor authentication.
There were also attempts to phish the seed words from those who held a trezor device. The hackers knew that most who had a ledger most likely also had a trezor as well.
❓ What To Do? ❓
Don't download any links from any hardware wallet manufacturer that emails you. You should also not respond to any emails or extortion attempts. They will take that as a signal that you respond to these and send more of them to you.
You should also change your email address at the other exchanges if you have used the same email for ordering the ledger.
If you do have any exchange accounts, then you will probably also want to avoid using sim based authentication and rather opt for something like Google Authenticator or Authy. Both of these generate an OTP on your phone locally.
🔓 How I Increase Opsec 🔓
Firstly, let's start with how I ordered that ledger device. I used a separate email address from the one that I use personally on all my other accounts. I had set this to auto forward any email that I did get from ledger regarding tracking with my parcel.
Then, when it came to the shipping address, I do own a post box here in London. I have used this for a number of other deliveries that I wanted to take without people knowing where I live.
I also did not hand over a contact telephone number for them to call me. I am incredibly cautious of giving my number to anyone and besides - they had my email so they didn't need to actually reach out to me on the phone.
You will also want to make sure that you don't order your Ledger device from any sort of third party seller. This is because they could have tampered with it.
💯 Next Level Security 💯
If you buy a Trezor device you can set yourself a separate passphrase which will allow you to go into a secret wallet that no one else is able to see. This can be used in any time where you are under duress.
You should also consider getting a safe deposit box where you can store two halves of both of your seed words. This can make sure that no one else is able to get near that crypto. You can also consider placing these two boxes in separate locations.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
📜 Disclaimer 📜
The information contained herein is for informational purposes only. Nothing herein shall be construed to be financial legal or tax advice. The content of this video is solely the opinions of the speaker who is not a licensed financial advisor or registered investment advisor. Trading Forex, cryptocurrencies and CFDs poses considerable risk of loss. The speaker does not guarantee any particular outcome.
#Ledger #Bitcoin #Hack #crypto #databreach #cryptocurrency #trezor #hardwarewallet
If you want to hear my ongoing thoughts about the Ledger hack and its implications, you can join my social channels 👉 guy.coinbureau.com/socials/
Quick few points:
1. If you ordered a Ledger after June of this year then your data was not accessed and you should be ok. You can still check it out by visiting the leak checking site in the description.
2. If your email is in the ledger breach, then you can check whether your phone number is as well here: www.argent.xyz/ledgerhack/
3. Buying from a third party seller is not too safe given the points I raised. However, if you are sure the box has not been tampered with and the seeds are autogenerated it could be ok. Be sure to check out the hardware wallet setup instructions.
4. People asking if ledger goes out of business, what then? Well, you can always restore a wallet from a seed on a wallet that supports BIP39. Trezor does so your seeds should work there.
Do you want a bunch of people‘s info? Do you want some emails to spam? Just hang out on Paste Bin for a while, there you go merry Christmas
BETTING this isn't your channel and you just read a teleprompter - prove me wrong please!
@@cedricvillani8502 the ledger data was actually dumped to raidforum
Just telling you a simple way to scrape some. I've purchased sets before off a few good rated sellers and then just text dumped on Pastebin. I just wanted the data for a few days anyway.
My life was totally change when I met millyhack101 on IG
I keep my 24 phrases in 24 separate pieces of paper in separate banks in separate countries.
not enough. I keep each of my 24 words on different planets in the whole galaxy.
But on the same planet ? Irresponsible!
LOL Good one
But if just one of those banks gets robbed, you'll still lose the access, right?
@@jundrix3675 nice catch
Love the way you lay out your info, very clear and very easy to digest, well done 👍🏻
You are the only person, site, company that I know of who took the time to address this situation in detail. In addition you gave a well defined course of action regarding security protocol (OPSEC). Thank you very much. It helped greatly in reducing my stress level.
Thanks Romeo. My pleasure
I will never believe on these stupid UA-camrs
A Safe Deposit Box is a horrible idea. Recently my U.S. bank has shut down multiple times not allowing access to my safe deposit box for several days. They claimed it was an "IT issue" and that they could not provide any banking services or allow anyone inside the bank. This is a top 5 bank that have several thousand locations. Strangely, the branch down the street and on the other side of town also were shut down. During these crazy times, a bank run would shut down banks for weeks. I would never use a Banking institution to store my seed phrases because they simply cannot be relied upon to stay open during issues or god forbid a massive crash resulting in a bank run.
Thanks a lot for what you do to the community.. Me (and a lot of folks out there) really appreciate this. I'm starting digging this crypto amazing world since Sep/Oct and most of what I learned, I did it thanks to you.. learning how do you protect your data is sth extremely valuable (even though I'm still a quite poor boy from a third world country with no money to secure.. yet!).
Keep the good work and good luck there!
Moreover, regarding home security, I'm really concerned of countries not allowing people to keep and handle publicly fire guns.. they are the second best protection (first one is caution).
Keep the great vids coming Guy. World class!
Thank you for all your videos especially this one
Found this channel a week ago and have learned more this week than the past two years on my own.
By far the best crypto channel.
Addresses all the caveats.
Yeah
Great video. I am a complete noob to the Crypto game (as in, days ago) and learning as much as I possibly can so that I might jump into market straight away. I was very happy to find this channel and video regarding the Ledger hack and associated security tips so that I can hopefully do things correctly out of the gate, as opposed to learning costly mistakes on my own.
Very good and well-presented information. Many thanks!
Tip 1. Never give out seed phrase to anyone.
Tip2. Don't connect wallet for defi through unverified links.
Tip3 never give out seed phrase! Ever! For any reason!
Tip4 don't keep crypto on exchange
😎
Very sobering... thanks Guy!
I love your videos.... The quality and your manner.
Your going to do really well bro.
Be very careful about leaving your assets in a bank's safe deposit box. If the bank gets shut down, your assets could get seized as the bank goes to audit...We need more private vaults that don't involve the banking system...
Store it encrypted with a passphrase
Banks don't even need to go under. The FBI have been known to go through vaults seizing everything under the guise of looking for a specific deposit box for a specific individual. Banks are not safe at all
You’re my favourite crypto Guy :) so relaxing and informative to watch, and no moon bollocks. Thank you
Thanks so much Jonathan. Doing my best to bring you the best.
Guy, Love your low to no hype, in depth, to the point approach. You are the only content provider I recommend to friends new to the space. I'm not easily impressed and you impress me. Thx
Wow, man your videos are so helpful!
Your the sh't!!! I have learned an amazing amount of info from your channel. If I ever want to get the real scoop or truth on topics like these. You are the first person I consider. Keep it up
Thanks so much Samantha. Will keep bringing you this content in 2021!
Can you please do a video on what should be done to ensure a proper change of custody in event of an untimely death???? Thank you for all the great information!
Awesome content! Congratulations dude!
Outstanding presentation and most helpful!
Thank you for all that valuable information,
it's very important to all of us.
And you're right there's things that are out of our hands are control,
at least we could take precaution.
I truly believe if we all survive 2020 we could survive anything.
God bless be safe
God bless Durman. And will do.
Ö
Hey Guy. Thanks for the video.
Quick question I can't understand:
Why do you have two locations and split the words in half? If one of the locations is compromised (meaning probably they LL steal the paper), you'll only have half your passphrase. Unless I'm seeing this wrong, this would only make sense with 4 locations, as with 2 you'll end up losing it as well.
Can you explain?
Thanks!
Excellent vid bro, greatly appreciate the info.
Excellent explanations and advice, thankyou
Ledger also has passphrase setup in advanced settings. I have recd some emails for KYC check etc....The sender address has a weird code which immediately arouses suspicion. Thanks Guy! Really helpful info. 👍🏼
Do either have decoys?
The Trezor solution he talked about is idiotic, because the criminals know that if you don't use the passphrase, you are hiding something from them.
It should be the SAME input method for both the decoy and the others.
A few notes:
- Ledger devices also have a passphrase features, either 1 time or alternative PIN
- Can also use 2 out of 3 security (e.g. 16 out of 24 words on each of 3 pieces of paper, needing 2 out of 3 copies to reconstruct the entire passphrase)
- Can also use a plain biro to write a dummy seed phrase, and UV ink to write the real seed phrase
- Relying on bank vaults is a form of centralisation. Obfuscation is a better strategy in my opinion, such as writing a short story with the seed words hidden in a secret pattern within that story.
Keep the obfuscated (and partial 16-of-24) phrase words scattered around locations that you are mostly in control of, in places where people would not normally look.
With ink they can't normally see!
As always, very informative. you're a gentleman, and a pleasure to learn from, and learn from.
This was brilliant. Thanks very much! I've just discovered your channel and am on a binge.
Thank you for the tips! Great video, as always, especially the part with storing seeds. It might seems too much, but if you hold significant amount of crypto, no preventive measures should be considered paranoid. Have a happy holidays and keep your style in 2021!
Thanks Radmila. You have an amazing Christmas too!
This is exactly why I generated my own key's offline and engraved it into a cheap piece of copper plate and printed out the QR code myself. I own a Nano-X but keep less than$100 of cryptocurrency on it, don't trust anyone you buy storage devices from. And make copies of your key's and keep them in a secure location like a safety deposit box.
Great tips, thank you so much Guy
Always great content - so informative. Thanks for this video!
When robbers see the shotgun I bought with crypto they’re going to be disappointed.
@@sunnydecree2349 Oh really? Mr. Crypto Scam.
cant take the crypto if you blow a dinner plate sized hole in their chest
Because robbers never enter a house quickly.
They first knock, wait for you to pull out your shotgun, and then kick the door open.
@@dialecticalmonist3405 That’s why you should always conceal carry a shotgun while in your house.
Lock & loaded 😉
Good info. Is there any reason you couldn't just use a thumb drive?
Very informative, thank you.
Another great vid guy, been in the crypto space for over 6 years and I learned something here. Thanks 🙏🏻
If ledger ever goes out of business, what happens to all the hardware wallets? Is it even possible to use it at that point? I’m not entirely sure how these wallets work and it’s concerning. Thanks.
Yes, it's possible. Ledger (like most hardware wallets) use a standard knows as BIP32/BIP39/BIP44. This means that the wallet can be recovered using any hardware or software wallet that uses the same standard. This means your wallet is not lost if Ledger goes out of business or if your hardware wallet is lost. It can always be recovered using your recovery phrase.
Appreciate the non crypto bro vibe of this channel and the educational format.
good quality context bro, keep it up
Terrific and useful vid.
My ledger balance probably gave the hackers PTSD, i wouldn't be surprise if they donate their savings to my ledger
Thankfully they can't access your balance.
@@geniusg5060 Pretty sure they did with the BlockFI data breach
IM HOWLING🤣🤣🤣🤣
Lmao
Obviously they can't access mine
Shameful for a security company to be hacked so easily and to lose sensitive customer data which should have been purged after the product was delivered.
inside job buddy inside job
No chit that was a huge fail!!
Makes you wonder why the data was not deleted, it looks like a class action lawsuit is needed here otherwise how will we keep this companies in line
Excellent video. Thanks!
Very much appreciate the security points.
Always check the domain from where the email comes from and the SSL certificate if any.
And DMARC & DKIM
As always Guy, great video! Watching you is like watching the Simpson, you have so many layers of information and comedy to appeal to all ages and levels of understanding. Not to mention the production value is always top notch. Thank you again for your time and wisdom. 😍👍🏽
Glad you are liking the vids Mudassar and honoured to be compared to the Simpons lol.
@@CoinBureau Hello I need help I put another security word in my ledger apart from the 24 words and don't pay attention that it generates 4 digits and I don't write them down I want to enter and it asks me for those 4 digits that I do not write down I lost all the funds I had? Can someone help me?
Two thumbs up! Awesome content. I am a member of a personal data protection and crypto regulatory body. I learned a lot from this video 🙏🏽
Thanks Guy!
Can't deny, I was expecting some mention of a crypto solution to these data breaches 😂
Great content as always!
I wish I had enough crypto to be slightly concerned about this ......
yeah... dude's talking about two separate boxes in two different bank vaults for the codes. my whole crypto holding would pay for that for a month maybe :D
@@tugrulserhat
It's foolish to trust third parties with your passphrase.
How does he know he will always have complete and total access to his safety deposit box?
Let's say there is rioting and/or the bank is looted. How the heck is he supposed to walk in there and get one-half of his passcode? And then he SPLITS it? Making it even MORE difficult?
I would always keep my passphrase on my own property.
Also, one should always carry multiple hardware wallets in case you need to move funds quickly to another wallet, due to the first wallet being compromised.
@@dialecticalmonist3405 idk man... if I had that much crypto, I would probably come up with a lot of ways to secure it too I guess.
@@tugrulserhat
But that's my point.
You are not making it more secure by depending on third parties or banks. Because you cannot rely on them.
Depending on banks, defeats the entire point of crypto in the first place.
on my ledger since I don't understand these gas fees lol
Thanks Guy this has been very helpful
Excellent quality reporting mate, cheers
My pleasure
Keep an empty Ledger, with a fake 24 words on your desk, in the case of physical robbery.
You may have covered this, but I didn't hear it: Is there still significant risk remaining if one purchases a Leger wallet TODAY, after Ledger has taken action to improve security 'after the fact'?
Good points!
Thanks and Merry Christmas! 🎄🎁
Thank you too!
Thx so much for the detailed info!
Glad it was helpful!
There’s a further risk here to all users. Ledger will get sued and could go belly up. This would mean all of us who own ledgers will no longer get software updates and will need to fork out for a new alternative device or become increasingly at risk to future hardware exploits
Yes. Unfortunately, Ledger do need suing. A class action lawsuit is inevitable, and they deserve it. Time to throw away your Ledger, and get a different hardware wallet. It's a pisser, but there you go.
@@tonebonetones what’s wrong with ledger?
@@Konzose nothing. Just dont fall victim to a phishing scam that looks like its from ledger
One of the best videos about safety!! Thank man! 🙏🏻✌🏻👍🏻
Good job.. Very informative from a security standpoint.. Must watch for all crypto holders..
Love your work Guy! You are my favourite YT Crypto Guy.
Poisonous wretch.
We never know when a hack is really a hack and not just a cover for a company to sell the customers private info it has. We will never know!
When they publish some of the hacked data.
Thanks Guy, great information!
Glad it was helpful Carlos
Very clear and well thought out detailing of the situation, and some excellent security tips. Thank you
Glad it was helpful Jerry!
SIM attacks are the real threat. Highly suggest phone changes are protected with pin number with provider. If they access your email with phone you are in big trouble!
Roger Smith thanks for the warning. Would you say that if I have the pin number protected phone change that it should be secure ? It's just that I read the reviews on google authentification and a lot people complained around the beginning of december that the app won't start anymore. So Im kinda hesitant to use the app...
@@lzz9320 some phone companies will allow you to lock phone number export on request.
Is there another way I can protect myself from a sim swap if my provider does not have that option (outside of US)?
I am one of the victims of this hack, and, yes, I am extremely angry. I took the initiative to finally purchase a Ledger Nano X, and it is from this purchase that my name, phone number, and address is now in the hands of the hackers and probably all over the Dark Web. I will fully participate in a class action lawsuit against Ledger. This is not just an ordinary hack...the hackers know that those of us whose information was stolen have financial assets, and we are ripe pickings for them.
Now, we know you have Cryptos and your YP account...
Good thing I relocated and used a trash email address for this purpose. About to change my phone # any how. Timing is everything. Still....not happy. But in TX we say...."come and take it"
@@pulfredy1 No problem. Come and visit me, and I will have a little surprise for you.
@@Amathews625 We say that where I am from as well. Where I will send them, crypto won't do them much good.
Sue the bastards that's out of order
Fantastic Video, thank you so much!
Well, I saw this video after seeing your BEST Crypto Wallets 2021: Top 5 Picks video. Should I keep my ledger?
Your ledger is fine! This was not a blockchain hack or anything. Your private keys were not leaked because ledger doesn't have access to them. This was a typical phising attack which can happen to anybody who is not alert.
Same thing happened to exodus, Atomic, My Etherwallet, Metamask and countless others. Those who were cautious enough not to download from the false link that was connected to the phising app, did not get their cryptos stolen.
This wasn't the kind of hack that people think.
The ability to add a "hidden wallet" (passphrase) is a game changer making Trezor better than the sexier cold storage options out there.
tbh if someone is your house holding a gun asking specifically for your physical device they know you have passphrase and hidden vault. they simply gone ask for it. thats just my 2 cents.
@@RaviKumar-xn2bm hidden wallet protects that. You put say $500 in the main wallet and the rest in the hidden. Give them your seed phrase at gunpoint and they only see $500. There is no way for them to know you have the hidden wallet feature turned on.
Great video thanks for the tips
Great article guy as always
I just got a ledger and will employ some of these. Wish I did your email tip for ordering it though.
You can change crypto email
Trezor gotta be loving this
Shit good point I didn’t think of that
Yeah, but I think their device got physically hacked. Still, that's no use to criminals if they don't know where to find it.
Good job. One of the best video on this topic.
Glad it was helpful!
Awesome video. So much valuable info. Thanks
How do you deal with succession (wills)? WIth your seed phrase in 2 seperate locations with no instructions as well as a being behind passphrases, in the event of your death, how do you securely transmit this information to your loved ones?
You dont. You die with it. Jk
They would get access to your safe deposit boxes in the event if your death. I assume you'd need to leave some instructions with a trusted family member.
There are also custodial accounts that can be set up specifically for this purpose.
I haven't opened an email that I'm not absolutely sure of who sent it in 20 years. I feel bad for those who lost and will lose their property and if it's to no fault of their own, like this hack, well then a lawsuit must be filed if the companies responsible failed to protect you and/or reimburse you.
Excellent video
This is why crypto will never go mainstream decentralized. All these steps and keeping your keys safe, etc... it would be a nightmare for most people.
i would advice to use protonmail for your accounts
Why protomail and not google
In the US, you don't have to "declare any crypto" just for owning it. You only have to claim capital gains when they are realized.
For now. Yellen wants to charge unrealized gains in a mark to market shizzle.
yee
@@countdracula1355 it would be such a shit move :/
When you do trading on the exchange, the exchange company requires you to provide your detail info. IRS will come after you when those trading companies follow the financial regulations. Your transaction info can’t be hidden anymore.
Capital gains? Does that mean when u sell of your crypto for dollars? or when you withdraw dollars?
Very helpfull!! Thanks! 👍
thanks Guy, love your work mate
Very good advise Guy. Thank you for that. As for "threatening" emails, I live in the south USA. Guns are an everyday thing here. Invasion of my home is met with Mr. Smith and Wesson and 2 very large Great Danes and a very rambunctious German Shepard. Even if these "attackers" were able to get past me and my dogs, then they would deal with my better half who is Law enforcement and a blackbelt in taekwondo. As for cyber security, I do have a failing and your advise is very informative. Safety deposit boxes are a good idea and I'll be looking into that. Not much crypto at the moment but I will be investing more for sure. Keep the awesome information coming my friend.
Nice 👍🏻 to hear how well prepared you are. I feel a special hate for criminals... i am the type to think we should have a criminals control of population ......
Indeed, everyone in my house has at least 2 firearms, good luck with that wrench.
This is 1 reason i NEVER use a phone for crypto or even pay wireless, NEVER because the risks are to big. For the same reason i don't own a wireless paycard, NEVER because i don't know when someone is passing me with some device to tap. A nice alternative is also Atomic Wallet, same safety with words without device. When i receive malicious mail i report & delete it.
Thanks for the video
Great content as always.
What really pisses me off is how Ledger is trying to play the whole thing down. All my personal data leaked. So angry. I guess all I can do (to start with) is to get a new sim and new email and link them to crypto and banks. Ps Thanks for the video!
yeah.... +1 ... waiting for that lawsuit tho'
This was not a blockchain hack or anything. Your private keys were not leaked because ledger doesn't have access to them. This was a typical phising attack which can happen to anybody who is not alert.
Same thing happened to exodus, Atomic, My Etherwallet, Metamask and countless others. Those who were cautious enough not to download from the false link that was connected to the phising app, did not get their cryptos stolen.
This wasn't the kind of hack that people think.
@@poorchristopher15 How much did Ledger pay you for this comment?
@@ElVerdaderoAbejorro 7% ?! The "Big Guy", only gets 10% i hear, so.. Just guessing :P
I wonder what Ledger would say when a customer not affected by the hack demands/requests their personal details being deleted from their system? Would that make sense?
You’re entitled under GDPR , if you’re located in the EU
Super helpful thanks 😊
I should point out that some wrenches are actually quite small, and can be easily countered with vice grips.
Ledger should be held accountable for this and provide ensurance to all of their customers... But giving the fact that they use shopify for their web page, I wouldn't expect anything like that from such a shity company
None of these companies are ever liable for any of this.
what i've done is putting each word and the ledger it self in a different bank in a different country , it will cost a fortune to retrieve them but my 0.2 btc is save
Great info TY
Lets protect that Crypto boys !
Are paper wallets safe? I'm new to this whole crypto thing.
To a extent, it would need to made and printed offline for maximum security. The biggest problem is how easily the wallet can become damaged or unreadable.
You are awesome guy. Thanks
Such a useful video. Thanks Guy
I would like to know that if you did passed suddenly, what have you done to prevent your crypto assets from becoming lost coins.
Check out Vault12.com - saw an add for it the other day. Haven’t seen Guy mention it yet but seems kinda cool
Leave instructions for someone you trust on how to access your crypto holdings.
hacker : "i got a wrench"
me: "meet my machete"
Underrated comment