No reported cases as far as I know. In the first place, funds(or keys, to be technically specific) on hardware wallets are mostly being stolen via social engineering attacks and not really through technical vulnerabilities.
My advice: Ledger/Trezor for great security and great user experience. Coldcard for best security with decent user experience.
It's good to hear that the technology backing the wallets are solid. I don't expect my wallet to be social engineering proof
That's what I'm planning to do. Once I have a larger stack, I'll get around to investing into a Coldcard and keep most of my funds there.
I haven't tried using Trezor wallet but I have been using my Ledger Nano S for quite a few months now and have never encountered such security flaws when it comes to connecting your Ledger device to my personal computer. As far as I know, the private keys that has been generated by your HW is protected by a specialized secure chip called a "
Secure Element" in order for your private keys to never leave the device and to protect it regardless if you accidentally connect it to a compromised computer..
[1]
https://www.ledger.com/academy/security/the-secure-element-whistanding-security-attacks/I also don't see any articles or news yet regarding this kind of issue.
Thank you for the link. That's excellent.
I've seen some videos analyzing the differences between the wallets and the levels of security they provide. One interesting feature is Coldcard's ability to sign transactions without being plugged into a computer.
Has there ever been a case where a user's bitcoin had been stolen by way of simply connecting the hardware wallet to the computer?
No. Hardware wallets are designed specifically to deter these kinds of attack. The USB interface should not leak any private keys and all the signing of the transactions should be done within the hardware wallet itself. ColdCard's ability to sign transactions with only the SD card can be a bit of a hassle for some as compared to the better UI offered by both Ledger and Trezor.
I ask because I own both Ledger and Trezor products and I am wondering if I should upgrade for security purposes. Are Ledger and Trezor products inferior because they require to be plugged into the USB? When does security become paranoia?
That's not a point to consider. If they can leak private keys with the USB interface, I can guarantee no one would use their devices any more. You should be considering the vulnerabilities reported on both Ledger and Trezor. For example, Trezor is vulnerable to seed extraction attack[1] for which AFAIK Trezor offered a workaround but never a fix. Ledger also has it's fair share of vulnerabilities [2]. For both companies, you'll be happy to hear that there isn't any known vulnerabilities which doesn't requires physical access as of now.
[1]
https://donjon.ledger.com/Unfixable-Key-Extraction-Attack-on-Trezor/[2]
https://donjon.ledger.com/lsb/014/Great response. I guess I was paranoid seeing how other newer wallets (COBO) are going for the non plugged in approach. The only thing I have seen about Ledger has been that their customer email list has been leaked. This is worrisome but has no affect on my coins.
It's great that the majority of hardware wallets aren't just shilled trash but functional devices that gives you the power of banking.
