X account: What I am covering here is 1) randomness risk. The device could be using a weak or malicious random source like hash(time) 2) keep your old device because hardware hacks are Lindy. The older the device the more chances of someone publishing the hack, if it’s in use still. (The older the…
X account @toly warns that hardware devices may face risks including weak random sources, publicly disclosed hardware vulnerabilities, and the return of historical seed phrases, and recommends signing with a brand-new isolated device and then clearing the data.
Article
What I am covering here is
1) randomness risk. The device could be using a weak or malicious random source like hash(time)
2) keep your old device because hardware hacks are Lindy. The older the device the more chances of someone publishing the hack, if it’s in use still. (The older the version the more chances someone found the modem on it)
3) the device could phone home any previously loaded seed phrases. So if possible use a fresh air gapped mac when signing. Wipe it after signing so if the seed phrase is just passed from the hardware to the host software that memory is wiped.
Key points
01
What I am covering here is
02
1) randomness risk. The device could be using a weak or malicious random source like hash(time)
03
2) keep your old device because hardware hacks are Lindy. The older the device the more chances of someone publishing the hack, if it’s in use still. (The older the version the more chances someone found the modem on it)
04
3) the device could phone home any previously loaded seed phrases. So if possible use a fresh air gapped mac when signing. Wipe it after signing so if the seed phrase is just passed from the hardware to the host software that memory is wiped.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
Hardware wallet users and device security: If the relevant risks actually exist, weak random sources, hardware vulnerabilities, or seed phrase disclosure could result in asset theft; there is currently only a single social media source, so it cannot be confirmed that the risk has actually occurred.
Why it matters to readers
This is an X account @toly-issued security risk warning that provides no vulnerability identifier, test results, or vendor confirmation; at this stage, it can only be regarded as an unverified view and recommendation.
Focus: hardware wallet users and device security. Observation period: short to medium term
Risks and unknowns
Whether specific device models, vulnerability reproductions, vulnerability identifiers, or independent audit results emerge
Whether the relevant hardware wallet vendors issue security advisories, patches, or denial statements
Whether users report seed phrase disclosure or asset losses
Reversal condition for assessing the impact on hardware wallet users and device security: A vendor or independent security team proves that the device's random source, firmware, and host interaction do not have the alleged issues, or confirms that the claim lacks a technical basis.
