Quote from: cAPSLOCK on September 08, 2025, 11:44:50 PM

Quote from: fillippone on September 08, 2025, 10:19:27 PM

Quote from: Paashaas on September 08, 2025, 06:37:54 PM

X.
https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the

I was about posting about this.

This is serious.

Long story short:

ALWAYS CHECK THE WHOLE ADDRESS IN THE HARDWARE WALLET DISPLAY.
DON'T BE COMPLACENT WITH SECURITY.

Don't trust your UI of the Wallet.
Don't trust the First and last characters to confirm the Wallet.

Discover more here:

Ledger CTO warns of a potential mass attack taking place

The red text is the key. I also came here to point this out.

The ledger guy is arguing a technicality. If you check the address in the screen of the hardware wallet, assuming it has one, then you will be safe, or at least you'll see the wrong address, but you must be very careful because this exploit is sophisticated and will actually calculate a address that looks as close to the one that you're sending to as they can find. So just checking a few digits, it's not enough in this case. If I were moving big coins from hardware wallets right now using their software, I would definitely check the entire address.

That points out another important point. The issue is with the wallet software, not the hardware. So if you're using Sparrow, for example, you're okay, because they don't use those libraries. (STILL CHECK) But most of the big commercial wallet designers use those libraries and their bundled software.

So a little extra security…. Send a few sats, then the wished amount.