Post
Topic
Board Hardware wallets
Re: Bitcoin Threat Model - State Actors and HW Security - Chip Supply Chain Attacks
by
BobbysTransactions
on 20/02/2025, 13:32:54 UTC

Here's what BobbysTransactions said:

Quote
This is all irrelevant if the Kendryte K210 chip on your device is hard-coded with a back door to leak your private key subliminally in a signed transaction.

He's not familiar with this stuff at all.

First, K210 devices aren't hardware wallets.  They're primarily used to make DIY toy robots and old school 1980s style handheld video games.  The devs at Krux realized some K210 devices have a camera and a large screen, which makes the ones with no radios perfect for DIY airgapped hardware wallets.  Remember, we're talking about devices that cost as little as $35 (though I don't recommend the $35 ones.  They're tiny and don't have a touchscreen - they're more like a Jade).

Did you even read the whole thread? 

Okay, it's arguably better if the K210 chips are used for generic devices but the material point still stands: you cannot verify the hardware and backdoors can be inserted without your knowledge.

Second, unlike some hardware wallets, not only is every line of code open source...  the device also shows you everything on a large screen, and the output is plaintext converted into a QR code.

The point is that the hardware is NOT open source.

Don't trust the QR code?  No worries.  Turn it into text and check it.  As the saying goes: "Don't trust. Verify."

Also, Krux isn't an app.  It's the OS, which means it's not being run on top of some other OS.  That's a benefit too.

Trusting any closed source code is a no for me.  Bitcoin is open source.  The code I use to secure it is open source, including both my hardware wallet and also the watch-only companion apps (BlueWallet, Sparrow, and occasionally Electrum).


But you are trusting close source - just in hardware form.