Cryptocurrency Hardware Wallets Can Get Hacked Too

An anonymous reader writes: Whether you think cryptocurrency is a scam or a salvation, those digital coins can store real-world value. The safest place to keep them is in what’s known as a “hardware wallet,” a device like a USB drive that stores your currency and private keys locally, without connecting to the internet. But “safest” doesn’t mean “perfect,” which new research into two popular hardware wallets reinforces all too well. Researchers from Ledger — a firm that makes hardware wallets itself — have demonstrated attacks against products from manufacturers Coinkite and Shapeshift that could have allowed an attacker to figure out the PIN that protects those wallets. The vulnerabilities have been fixed, and both hacks would have required physical access to the devices, which minimizes the danger to begin with. But Ledger argues that it’s still worth holding hardware wallets to the highest standards, just as you would a closet safe. Shapeshift’s fix can be found here. Meanwhile, Coinkite’s Coldcard Mk2 flaw has been fixed in the company’s current Coldcard model Mk3, which started shipping in October.