[1] A. Moxin, “Yeti Cold and Bitcoin Core With JW Weatherman, Will and Robert Spigler.”
[2] “Yeti Cold.” https://yeticold.com/.
[3] Sjors, “Coordinate multi-sig wallet · Issue #18142 · bitcoin/bitcoin,” GitHub, Feb. 13, 2020. https://github.com/bitcoin/bitcoin/issues/18142.
[4] fanquake, “offline / multisig UX · Issue #56 · bitcoin-core/gui · GitHub,” GitHub, Aug. 14, 2020. https://github.com/bitcoin-core/gui/issues/56.
[5] sipa, “Basic Miniscript support in output descriptors by sipa · Pull Request #16800 · bitcoin/bitcoin,” GitHub, Sep. 03, 2019. https://github.com/bitcoin/bitcoin/pull/16800.
[6] R. Spigler, “Port Qubes to ppc64 [2 bitcoin bounty] · Issue #4318 · QubesOS/qubes-issues,” GitHub, Sep. 17, 2018. https://github.com/QubesOS/qubes-issues/issues/4318.
[7] J. Lopp, “A Modest Privacy Protection Proposal,” Cypherpunk Cogitations, Sep. 29, 2018. https://blog.lopp.net/modest-privacy-protection-proposal/.
[8] J. Lopp, jlopp/physical-bitcoin-attacks. 2020.
[9] A. van Wirdum, “The Long Road to SegWit: How Bitcoin’s Biggest Protocol Upgrade Became Reality,” Bitcoin Magazine, Aug. 23, 2017. https://bitcoinmagazine.com/articles/long-road-segwit-how-bitcoins-biggest-protocol-upgrade-became-reality.
[10] A. van Wirdum, “NO2X: Breaking Bitcoin Shows No Love for the SegWit2x Hard Fork in Paris,” Bitcoin Magazine, Sep. 12, 2017. https://bitcoinmagazine.com/articles/no2x-breaking-bitcoin-shows-no-love-segwit2x-hard-fork-paris.
[11] A. van Wirdum, “Now the SegWit2x Hard Fork Has Really Failed to Activate,” Bitcoin Magazine, Nov. 17, 2017. https://bitcoinmagazine.com/articles/now-segwit2x-hard-fork-has-really-failed-activate.
[12] “SIM swap scam,” Wikipedia. [Online]. Available: https://en.wikipedia.org/w/index.php?title=SIM_swap_scam&oldid=995939685.
[13] S. Coonce, “The Most Expensive Lesson Of My Life: Details of SIM port,” Medium, May 20, 2019. https://medium.com/coinmonks/the-most-expensive-lesson-of-my-life-details-of-sim-port-hack-35de11517124.
[14] 6102, “With domains like this, how the hell are users expected to get this right? https://t.co/fj5LN17S6P,” @6102bitcoin, Dec. 14, 2020. https://twitter.com/6102bitcoin/status/1338580887403950081 (accessed Dec. 28, 2020).
[15] Andreas M. Antonopoulos, “Don’t overreact to the phishing scams that target hardware wallet buyers Hardware wallets are some of the best mechanisms we have to store crypto. Compromising a website database is not at all the same as compromising the security of the hardware wallet.,” @aantonop, Dec. 13, 2020. https://twitter.com/aantonop/status/1337924641575202818.
[16] “Trezor Hardware Wallet (Official).” https://trezor.io/
[17] “Hardware Wallet - State-of-the-art security for crypto assets,” Ledger. https://www.ledger.com
[18] “BitBox hardware wallet by Shift Crypto,” ShiftCrypto. https://shiftcrypto.ch/
[19] “Coldcard Wallet – Hardware Wallet - The Most Trusted and Secure Hardware Wallet,” ColdCard. https://coldcardwallet.com/
[20] prusnak, “enable stack protector · trezor/trezor-firmware@524f2a9,” GitHub, Jul. 31, 2014. https://github.com/trezor/trezor-firmware/commit/524f2a957afb66e6a869384aceaca1cb7f9cba60.
[21] prusnak, “set multisig_fp_mismatch when non-multisig input is encountered · trezor/trezor-firmware@137a60c,” GitHub, Feb. 25, 2015. https://github.com/trezor/trezor-firmware/commit/137a60ce017c402ac160258bcc4b5f7b5aba0560.
[22] S. Rashid, “Breaking into the (Digital) BitBox,” Saleem Rashid, Nov. 26, 2018. https://saleemrashid.com/2018/11/26/breaking-into-bitbox/.
[23] C. Reitter, “Trezor One dry-run recovery vulnerability,” invd blog, Dec. 09, 2019. https://blog.inhq.net/posts/trezor-one-dry-run-recovery-stack-overflow/.
[24] S. Lappo, “How (not) to lose your life savings while paying for a coffee with your Ledger Hardware Wallet,” Sergey’s blog. https://sergeylappo.github.io/ledger-hack/.
[25] B. Commons, “#SmartCustody,” Smart Custody, 2019. https://www.smartcustody.com/.
[26] “Casa | Secure Storage Solutions for Bitcoin.” https://keys.casa/ (accessed Dec. 28, 2020).
[27] L. Champine, “A Ransom Attack on Hardware Wallets,” Sia, Mar. 01, 2019. https://blog.sia.tech/a-ransom-attack-on-hardware-wallets-534c075b3a92.
[28] S. Crypto, “BitBox Desktop App 4.5.0 with Firmware 6.0.2 Release,” Medium, Mar. 08, 2019. https://medium.com/shiftcrypto/bitbox-desktop-app-4-5-0-with-firmware-6-0-2-release-fd77f8186a29.
[29] S. Crypto, “BitBox Desktop App 4.6.0 with Firmware 6.0.3 Release,” Medium, Mar. 28, 2019. https://medium.com/shiftcrypto/bitbox-desktop-app-4-6-0-with-firmware-6-0-3-release-ec46937afe7c.
[30] TheCharlatan, “A ransom attack on Coldcard’s change and keypath verification – TheCharlatan – Reproducibility Matters,” TheCharlatan. https://thecharlatan.ch/Ransom-Coldcard/.
[31] benma, “A theft attack on Trezor Model T,” Medium, Nov. 17, 2019. https://medium.com/shiftcrypto/a-remote-theft-attack-on-trezor-model-t-44127cd7fb5a.
[32] dgpv, “coldcard-multisig-change-vuln.txt,” GitHub. https://gist.github.com/dgpv/c580080cd6984fb0121b61f1e1b5db51.
[33] P. Rusnak, “Details of firmware updates for Trezor One (version 1.9.0) and Trezor Model T (version 2.3.0),” Medium, Apr. 17, 2020. https://blog.trezor.io/details-of-firmware-updates-for-trezor-one-version-1-9-0-and-trezor-model-t-version-2-3-0-46deb141fc09.
[34] Monokh, “Ledger App Isolation Bypass,” Monokh, Aug. 04, 2020. https://monokh.com/posts/ledger-app-isolation-bypass.
[35] benma, “Coldcard isolation bypass,” benma’s blog, Nov. 24, 2020. https://benma.github.io/2020/11/24/coldcard-isolation-bypass.html.
[36] “Coldcard/firmware,” GitHub. https://github.com/Coldcard/firmware.
[37] “Testnet Considered Useful,” Coinkite. https://blog.coinkite.com/testnet-considered-useful/.
[38] “Ten Immutable Laws Of Security (Version 2.0),” Microsoft, Jun. 16, 2011. https://docs.microsoft.com/en-us/archive/blogs/rhalbheer/ten-immutable-laws-of-security-version-2-0.
[39] J. Hoenicke, “Extracting the Private Key from a TREZOR.” https://jochen-hoenicke.de/crypto/trezor-power-analysis/.
[40] SatoshiLabs, “Fixing physical memory access issue in TREZOR,” Trezor, Aug. 18, 2017. https://blog.trezor.io/fixing-physical-memory-access-issue-in-trezor-2b9b46bb4522.
[41] SatoshiLabs, “TREZOR One: Firmware Update 1.6.1,” Trezor, Mar. 21, 2018. https://blog.trezor.io/trezor-one-firmware-update-1-6-1-eecd0534ab95.
[42] benma, “bootloader: disallow firmware downgrades · digitalbitbox/mcu@350c7a8,” GitHub, Mar. 05, 2018. https://github.com/digitalbitbox/mcu/commit/350c7a8eadc080436d0e7fa9ecebbb0e5246e5a4.
[43] S. Rashid, “Breaking the Ledger Security Model,” Saleem Rashid, Mar. 20, 2018. https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/.
[44] prusnak, “setup: disable SYSCFG registers · trezor/trezor-firmware@fdd5cbe,” GitHub, Aug. 27, 2018. https://github.com/trezor/trezor-firmware/commit/fdd5cbe20271634dc9ba4424ae40f1d11332cdf2.
[45] SatoshiLabs, “Details of Security Updates for Trezor One (Firmware 1.8.0) and Trezor Model T (Firmware 2.1.0),” Trezor, Mar. 06, 2019. https://blog.trezor.io/details-of-security-updates-for-trezor-one-firmware-1-8-0-and-trezor-model-t-firmware-2-1-0-408e59dc012.
[46] “Still Got Your Crypto: In Response to wallet.fail’s Presentation,” Ledger, Dec. 28, 2018. https://www.ledger.com/chaos-communication-congress-in-response-to-wallet-fails-presentation.
[47] media.ccc.de - wallet.fail. 2018. 25:15; 7:00
[48] C. O’Flynn, “Glitching Trezor using EMFI Through The Enclosure,” Colin O’Flynn. https://colinoflynn.com/2019/03/glitching-trezor-using-emfi-through-the-enclosure/.
[49] L. Ninja, “Hardware Wallet Review: COLDCARD Wallet - Short PIN brute-force attack,” Crypto Lazy Ninja, Mar. 15, 2019. https://www.cryptolazyninja.com/2019/03/coldcard-wallet-short-pin-brute-force.html.
[50] V. Servant, M. San Pedro, and C. Guillemet, “Breaking Trezor One with Side Channel Attacks,” Ledger Donjon, Jun. 17, 2019. https://donjon.ledger.com/Breaking-Trezor-One-with-SCA/.
[51] C. Reitter, “OLED Side Channel - Summary October 2019,” invd blog, Oct. 29, 2019. https://blog.inhq.net/posts/oled-side-channel-status-summary/.
[52] K. Abdellatif, C. Guillemet, and H. Olivier, “Unfixable Seed Extraction on Trezor - A practical and reliable attack,” Ledger Donjon, Jul. 01, 2019. https://donjon.ledger.com/Unfixable-Key-Extraction-Attack-on-Trezor/.
[53] TheCharlatan, “A practical supply chain attack on the Coldcard,” TheCharlatan. https://thecharlatan.ch/COLDCARD-Supply-Chain/.
[54] peter-conalgo, “Link to blog · Coldcard/firmware@e1fb05d,” GitHub, May 13, 2020. https://github.com/Coldcard/firmware/commit/e1fb05ddc5e739ff72b51b4374aafcb1314bc4ea.
[55] “Supply Chain Trust Minimized,” Coinkite, Mar. 02, 2020. http://blog.coinkite.com/supply-chain-trust-minimized/.
[56] bitcoin-core/HWI. Bitcoin Core.
[57] bitcoin-core/secp256k1. Bitcoin Core.
[58] sthz, “sthz comments on Bitcoin core code was tested so thoroughly that devs uncovered a bug in OpenSSL (used in 35% of all websites). Repost,” Reddit. https://old.reddit.com/r/Bitcoin/comments/76v747/bitcoin_core_code_was_tested_so_thoroughly_that/dohqyt4/?context=3.
[59] sipa, “memcmp with constants that contain zero bytes are broken in GCC,” GitHub, Sep. 23, 2020. https://github.com/bitcoin/bitcoin/issues/20005.
[60] P. Rusnak, “Details of firmware updates for Trezor One (version 1.9.1) and Trezor Model T (version 2.3.1),” Medium, Jun. 03, 2020. https://blog.trezor.io/details-of-firmware-updates-for-trezor-one-version-1-9-1-and-trezor-model-t-version-2-3-1-1eba8f60f2dd.
[61] “Irreversible Transactions - Bitcoin Wiki,” Bitcoin Wiki. https://en.bitcoin.it/wiki/Irreversible_Transactions.
[62] NVK Rodolfo Rebuttal to JWWeatherman on Coldard Coinkite Security of Hardware. 2020.
[63] “On Hacking MicroSD Cards,” bunnie:studios. https://www.bunniestudios.com/blog/?p=3554.
[64] C. Cimpanu, “Here’s a List of 29 Different Types of USB Attacks,” BleepingComputer, Mar. 13, 2018. https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/.
[65] luke-jr, “QR Code scanner · Issue #9913,” GitHub, Mar. 03, 2017. https://github.com/bitcoin/bitcoin/issues/9913.
[66] W. McNally and C. Allen, “Uniform Resources (UR),” GitHub, Jul. 09, 2020. https://github.com/BlockchainCommons/Research.
[67] S. Snigirev, “Hardware wallets can be hacked, but this is fine,” Medium, Jan. 05, 2019. https://medium.com/cryptoadvance/hardware-wallets-can-be-hacked-but-this-is-fine-a6156bbd199.
[68] P. Wuille, “[bitcoin-dev] Overview of anti-covert-channel signing techniques,” Mar. 03, 2020.
[69] A. van Wirdum, “Bitmain Can Remotely Shut Down Your Antminer (and Everyone Else’s),” Bitcoin Magazine, Apr. 26, 2017. https://bitcoinmagazine.com/articles/bitmain-can-remotely-shut-down-your-antminer-and-everyone-elses.
[70] A. van Wirdum, “Breaking Down Bitcoin’s ‘AsicBoost Scandal,’” Bitcoin Magazine, Apr. 11, 2017. https://bitcoinmagazine.com/articles/breaking-down-bitcoins-asicboost-scandal.
[71] W. WhalePanda, “ASICBoost, the reason why Bitmain blocked Segwit.,” Medium, Apr. 06, 2017. https://medium.com/@WhalePanda/asicboost-the-reason-why-bitmain-blocked-segwit-901fd346ee9f.
[72] “Reproducible builds,” Wikipedia. Dec. 11, 2020, [Online]. Available: https://en.wikipedia.org/w/index.php?title=Reproducible_builds&oldid=993548959.
[73] prusnak, “Fix deterministic build for Core release firmware · Issue #1170,” GitHub, Aug. 05, 2020. https://github.com/trezor/trezor-firmware/issues/1170.
[74] “digitalbitbox/bitbox02-firmware,” GitHub. https://github.com/digitalbitbox/bitbox02-firmware.
[75] Carl Dong, Bitcoin Build System Security | Carl Dong | Breaking Bitcoin 2019 Amsterdam. 2019.
[76] non_fingo, “Opinion regarding security,” Reddit. https://www.reddit.com/r/Bitcoin/comments/jp2fp3/opinion_regarding_security/.
[77] V. Costea, “S4 E7: Peter Todd on Hardware Wallets, Security & Proofmarshall,” Bitcoin Takeover, Feb. 04, 2020. 0:44:28 https://bitcoin-takeover.com/s4-e7-peter-todd-on-hardware-wallets-security-proof-marshall/.
[78] benma, “How nearly all personal hardware wallet multisig setups are insecure,” ShiftCrypto, Nov. 05, 2020. https://shiftcrypto.ch/blog/how-nearly-all-personal-hardware-wallet-multisig-setups-are-insecure/.
[79] “Comments:BIP 0039,” GitHub. https://github.com/bitcoin/bips/wiki/Comments:BIP-0039.
[80] Christopher Allen, “Today I learned that there is no BIP or SLIP docs specifying how the m/48’ HD derivation works for bitcoin multisig. This was apparently agreed upon by @ElectrumWallet , @Ledger , @Trezor & Copay and now used by @COLDCARDwallet & others. But many important details missing!,” @ChristopherA, Apr. 21, 2020. https://twitter.com/ChristopherA/status/1252436092755697664.
[81] “Wallets Recovery.” https://walletsrecovery.org/.
[82] benma, “A ransom attack on Trezor’s and KeepKey’s passphrase handling,” benma’s blog, Sep. 02, 2020. https://benma.github.io/2020/09/02/trezor-keepkey-passphrase.html.
[83] Sjors, “Slight improve create wallet dialog,” GitHub, Sep. 18, 2020. https://github.com/bitcoin-core/gui/pull/96.
[84] “Kernel Self Protection Project - Linux Kernel Security Subsystem.” https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project.
[85] “Qubes OS: A reasonably secure operating system,” Qubes OS. https://www.qubes-os.org/.
[86] “GNU’s advanced distro and transactional package manager — GNU Guix.” https://guix.gnu.org/.
[87] “Debian -- The Universal Operating System.” https://www.debian.org/.
[88] Whonix, “Whonix TM - Software That Can Anonymize Everything You Do Online.” https://www.whonix.org (accessed Dec. 28, 2020).
[89] K. Thompson, “Reflections on Trusting Trust,” Commun. ACM, vol. Volume 27, p. 3, Aug. 1984.
[90] “Bootstrappable builds.” https://bootstrappable.org/.
[91] “Join Bitcoin Design on Slack,” Slack. https://slack.com/join/shared_invite/zt-gytq2snl-4TEWJOTKrXRCB4YLBoDunA (accessed Dec. 28, 2020).
[92] grubles, “That hardware wallets are easier for noobs just means that we need to make the old laptop UX easier.,” @notgrubles, Dec. 03, 2020. https://twitter.com/notgrubles/status/1334565741169958915 (accessed Dec. 28, 2020).
[93] TheCharlatan, “List of Hardware Wallet Hacks.” https://thecharlatan.ch/List-Of-Hardware-Wallet-Hacks/.
On request, I can send a LibreOffice document version of this paper where the intext citations link to their appropriate sources on the reference page.
Copyright © 2022 Robert Spigler - All Rights Reserved.
I do not host this website. Default cookies for the purpose of analytics and performance tracking are loaded. I do not have control over how these cookies are stored. If this is a concern of yours, I suggest installing something like 'Privacy Badger' in addition to selecting "Decline". View 'Privacy Policy' for details.