Hardware wallets have had quite the year. Coldcard's seed-generation bug,Trezor's TROPIC01 chip vulnerability, and years of side-channel and physical attack research have shown just how deep hardware security goes. We're live with @Tangem right now talking about security, self custody, hardware wallets and what it actually takes to keep users' assets safe. Come join us 👇

"Four hardware wallet customer data leaks this year. Three of them in the last two weeks alone."

For 86 minutes arrayref depended on a crate whose build script fetched a binary and ran it mid-compile. libsecp256k1, schnorrkel and ledger-apdu all take it at ^0.3. 2,285 downloads in that window. The registry counts fetches, not builds, so I don't know what that number means.

Checking only the first 4 and last 4 characters of a wallet address is no longer enough. In this address-poisoning case, a user first sent 100 USDT as a test. The attacker then generated a lookalike address and sent 1.01 USDT to the victim—just to place the fake address in their transaction history. Minutes later, the wrong address was copied. ~2.5M USDT was gone. No private key was stolen. No wallet was hacked. One address was simply mistaken for another. This is why transaction verification matters: check more of the address, verify on-device, and never blindly copy from transaction history. Security should protect the decision—not just the key. #UnionKey #CryptoSecurity #AddressPoisoning #SelfCustody

Comprehensive updates to Sparrow Wallet. Following the Coldcard incident, there were likely a large number of AI-generated reports. In preparation for future AI-driven attacks, Craig Raw personally conducted a full self-audit and proactively addressed all necessary areas. He also stated: “Don’t just send me everything you don’t understand as a vulnerability.”