PSA: There is a supply chain attack on Bitcoin wallets going on.
HARDWARE WALLETS AND SIGNAL MAY BE AFFECTED. READ FURTHER.
I have not studied the full scope of this attack yet, but from what I hear, it can impact websites/webapps (including "local" webapps like Signal Desktop) and cause them to display a thief's address instead of the intended one.
This means hardware wallets will correctly display the actual send-to address, but you the human may compare the address to one that has already been replaced!
Regardless of what wallet you use, verify the address you are sending to without trusting a computer. Call your recipient and verify verbally.
Login to reply
Replies (12)
Always double check with the address on the airgapped cold wallet
what is harder? pagers in Lebanon or every kyc'd bitcoiner's "wallet"? asking for a friend
Any reported cases?
Thanks for summarizing. So if you do not send any BTC you are not in danger? Any news on patches yet?
So easy to just check the last few digits.
I should clarify, with this attack, now it's worth checking the whole thing. Probably will do that forever now 💪
This concerns web3 and metamask predominantly?
Is there any way to make a utility to make it easier to verbally verify swnd-to addresses? Might not matter in the world of deep fakes ...
Sending to exchanges will be problematic
Even hardware wallets with companion apps that used npm.
Haven’t heard of Signal Desktop Wallet? Was that a typo?
This is why you use @Branta
Protects against this exact form of attack
View quoted note →