A fake hardware wallet user lost in $7 million after buying a discounted cold wallet from Douyin (the Chinese version of TikTok).

In an unlikely event, a user lost in $7 million after purchasing a discounted cold wallet, or fake hardware wallet, from Douyin (the Chinese version of TikTok), which was later found to be a modified hardware wallet.

Warning about fake hardware wallets spreading in online markets

According to blockchain security firm SlowMist, the wallet’s private keys were compromised at the time of creation, resulting in users’ funds being drained within hours!

So how did you get hacked?

The wallet was forged from the beginning. This case is not caused by the user’s error, but the problem is that the Cold Wallet has been “altered” before it reaches the user. The scammers will secretly insert some mechanisms that allow them to access our Private Key since we created the wallet.

All crypto gone immidieatly Once the victim starts using this fake wallet, the money transferred will be quickly withdrawn by the scammers within a few hours because they already have the Private Key.

What are some of the mechanisms?

1. Fake firmware may be installed.
   Instead of installing the firmware from the manufacturer, scammers will inject a modified firmware onto the device without the user noticing. This fake firmware may be coded to save or send the private key to the scammer immediately after creating a wallet or transferring money.
   
2. Generating a Non-Random Private Key
   Criminals may modify devices to generate private keys from a pre-defined set of values, rather than truly random ones.

When buying a hardware wallet, you must choose only reliable channels.

“When buying a hardware wallet, always choose a reliable channel, such as the official website of the manufacturer or an authorized dealer,” said Hella, a former team member of Jihan Wu (Bitmain co-founder) and a close friend of the victim.

Don’t trade a few money for the care of assets you worked so hard to earn. Things to consider when setting up or buying a new hardware wallet.

• Hardware Wallet must not have firmware before, we have to install it ourselves
• Buy only from trusted sources, such as manufacturers and official dealers
• Do not be too greedy for free and cheap things

Bought a fake hardware wallet. Can crypto back?

If your crypto is lost because you bought a fake hardware wallet, the answer is: “It is almost impossible to get your money back.”

• Crypto is a decentralized system.
  There is no bank or central company that can help “freeze” or “cancel” transactions.
• Transactions on the blockchain are irreversible.
  Once transferred = done, the transaction cannot be reversed.
• Fake hardware wallets often have the intention to steal from the beginning.
  For example, embedding software to store seed phrases / giving fake seed phrases / embedding vulnerabilities.
  When you use it to deposit crypto, the criminals can see the seed and withdraw the money immediately.
• The criminals are often anonymous.
  Using fake wallet addresses, VPNs, or other methods to hide in cyberspace

What can you do now?

• Stop using that wallet immediately
  And do not use the wallet or the Seed Phrase that was entered on that wallet again
• Quickly transfer the remaining crypto (if any) to a new wallet
  The new wallet must create a new Seed Phrase on a secure device only
• Report to the police + collect evidence
  Such as the website where you bought it, the box, tracking code, the name of the store, etc.
  Even if you do not get your money back, it may help warn others or track down the perpetrators in some cases
• Notify the community (Telegram / Discord / Facebook groups)
  To prevent others from becoming the next victim
  

Tips for future protection from Fake hardware wallet

Buy Hardware Wallets only from the brand’s official website, such as Top 5 best hardware wallet in the world
Do not buy from Shopee, Lazada, Facebook, Tiktok, or unauthorized stores
Do not enter the Seed Phrase on unknown websites or software
If the device comes with a Seed Phrase in the box (written by the seller) = it’s definitely fake

A fake hardware wallet user lost Summary

A user lost nearly $7 million after purchasing a discounted hardware wallet from Douyin, which turned out to be a tampered device. According to blockchain security firm SlowMist, the wallet’s private key was compromised at creation. The attacker had pre-installed fake firmware or used predictable key generation to steal the funds. The entire balance was drained within hours of use. Experts urge users to buy wallets only from official or trusted sources.

Reference: Bitcast

Join our gang by purchasing the Animalverse Club NFT, which is the key to accessing a ton of benefits.
Animalverse SoicialFi is a web3 social media platform designed to connect users around the world without the influence of algorithms, promoting equal access to information. The platform aims to create a decentralized environment where users can freely share and consume content and send crypto, which is fully consistent with the principles of blockchain technology. Let’s be a part of AVC ecosystem  Community  BlackMarketplace  Groups  Games  Jobs Financial Blog News