hgtp://Bitfi

16.7K posts

hgtp://Bitfi banner
hgtp://Bitfi

hgtp://Bitfi

@TheBitfi

World’s only #Bitcoin & digital asset hardware wallet using computational key derivation. All funds are stored solely in your consciousness.

Security beyond cold storage. Inscrit le Temmuz 2018
570 Abonnements19K Abonnés
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
A man breaks into your home at 2AM. He’s not there for your TV. He’s not there for your watch. He knows you own Bitcoin. He finds your hardware wallet. Or your safe. Or your metal plate. He just needs the 24 words. This is what “self-custody” looks like in 2026? Cameras. Safes. Dogs. Guns. Multi-sig gymnastics. All to protect a recoverable secret written somewhere in the physical world. If it exists physically it can be found. If it can be found it can be taken. If it can be taken it can be forced out of you. That’s the flaw. Bitfi removes it completely. No stored keys. No seed phrases. Nothing hidden. Nothing to retrieve. Your private key doesn’t sit in a drawer waiting to be stolen, it is reconstructed only when needed, from a salt & phrase you know, then disappears. No object. No target. No leverage. Why build layers of defense around something that shouldn’t exist in the first place? As physical attacks increase, the model must change. Bitfi isn’t an improvement. It’s the end of the problem.
Julian Figueroa@kinetic_finance

if you keep >0.5 BTC on a wallet in your home, watch this video 👇

English
3
2
10
454
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
This is exactly the kind of nightmare scenario the Bitfi wallet was built to prevent, where every conventional cold-storage method fails the moment someone can force you to reveal the seed backup. Bitfi eliminates the seed entirely, so there’s nothing to steal, nothing to extort, and nothing to give up under coercion.
English
4
0
12
907
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
The recent issue affecting a small number of users sending Monero ($XMR) transactions has been fully resolved. This was due to the Monero daemon exceeding disk storage capabilities. All systems are now operating normally.
English
5
1
12
1.2K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
Contrary to popular belief, Bitcoin is already quantum resistant as long as the coins reside in an address that has never been spent from. Why? Because Bitcoin addresses are hashes of public keys (P2PKH, P2WPKH, P2TR). As long as the public key remains undisclosed, quantum computers have no public data to reverse engineer, making the funds safe even against theoretical quantum attacks. The risk begins only when a transaction is broadcast and the public key is revealed. That’s when a powerful enough quantum machine exists, which could be many years away.
hgtp://Bitfi tweet media
English
5
5
35
3.3K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
You can’t spoof a Bitfi device. Ever. Why? Because every Bitfi device contains an embedded cryptographic key in TEE, without it the device won’t even handshake with the network. And our 3-key device hash? It proves you’re on your device, every single time. Bitfi doesn’t store your keys. Bitfi doesn’t trust hardware. Bitfi verifies itself - mathematically. You can’t fake a Bitfi. You can only fail to understand it.
JP@rugpullfinder

🚨 The Fake Ledger That Stole Everything (1/8) James* thought he was safe. He used a Ledger hardware wallet, kept his 24 words private, and followed every crypto security tip out there. Then one day… a package arrived. 🧵👇

English
11
9
40
8.6K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
In your mind. Bitfi doesn’t store private keys, seed phrases, or any data on the device. Seize it, raid it, tear it apart, it’s just hardened plastic and air. No memory. No trace. Nothing to find.
INFOSEC F0X 🔥@infosec_fox

English
8
5
30
3.4K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
This is exactly why Bitfi was built. No seed to steal. No keys stored. Nothing to extract, no matter how violent the threat. With Bitfi, your wallet is just a private key generator. It holds nothing. Once you power it off, it forgets everything. There’s nothing to give up under a gun. Nothing to find in a drawer.
Tokyo 🗼@DefiTokyo

My friend got robbed for $3M in $BTC yesterday. The guy broke in, pointed a Glock, and said: “Give me the seed, or you're dead.” Still think your Ledger makes you safe?👇

English
10
9
26
7.6K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
9/ This is the Black Phone for the Real World. Bitfi doesn’t protect your data. It makes sure it never existed.
English
1
0
7
976
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
1/ You carry a spy device in your pocket. Here’s what we did about it.
hgtp://Bitfi tweet media
English
4
6
23
1.9K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
At Bitfi, we believe you should have total control. Unlike some competitor devices that generate and tell you what your seed words are, Bitfi users create and enter their own passphrase. This ensures that there is no possibility someone could ever see or capture your private keys in the supply chain.
Peter Brandt@PeterLBrandt

Hey crypto hodlers, how safe is your Ledger Nano X? It might be safe from a hack, but is it safe from a Ledger employee up to no good? I've a good friend. His Nano was hacked for all his BTC/others by someone using his seed phrases with a new device. Seed phrases were NOT on his computer, Nano drive remained in his possession. What other conclusion could you come to other than it was an inside job at Ledger??? I'm open to ideas. Comments please @Ledger -- any other possible explanation.

English
6
5
27
2K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
Bitfi is the only communication system where the encrypted tunnel between callers is established entirely without relying on a third party to broker or store encryption keys. Instead of depending on a central server to manage key exchange, Bitfi devices retrieve each other’s public keys directly from a smart contract on a permission-less blockchain. This decentralized lookup enables the devices to independently perform an Elliptic Curve Diffie-Hellman (ECDH) key exchange to derive a shared secret used for end-to-end encryption. No third party is involved in this process, and no one, including Bitfi, has access to the private keys or the shared session key, which is generated and stored only in volatile memory for the duration of the call or message session. In contrast, all other so-called “end-to-end encrypted” communication platforms depend on a centralized service that facilitates key exchanges and retains control over the key distribution infrastructure. While these services claim not to store user keys, the reality is that they act as intermediaries, and in doing so, can inject or replace keys, giving them the ability to silently eavesdrop on any conversation. Bitfi completely removes this vector by eliminating all intermediaries from the encryption process. Users don’t have to trust a company to “do the right thing”because mathematically and architecturally, there is no third party involved, and no third set of keys exists. In a world where traditional "secure" channels are routinely compromised, Bitfi stands as the last line of defense. Our technology is engineered for scenarios where intercepted communications could trigger international incidents or put lives in immediate danger. Entrusting your life to a company or organization, without visibility into their internal practices or any ability to control them is a fundamental security failure and is a non-starter for high stakes communications.
hgtp://Bitfi tweet media
English
7
9
28
1.3K
hgtp://Bitfi
hgtp://Bitfi@TheBitfi·
Analysis of the Bybit Hack & How Bitfi Would Have Prevented It What Happened in the Bybit Hack: 1.Fake Interface Attack: Hackers manipulated the front-end interface to display a legitimate transaction to signers. 2.Signing Mismatch: While signers believed they were approving a transfer to a warm wallet, the actual signing request changed the smart contract logic of the ETH cold wallet. 3.Loss of Control: This allowed the hackers to gain full control over the wallet and drain its funds. 4.Device Limitation: Since signing device (in this case a Ledger wallet) only signs raw transaction data, it could not detect that the transaction being signed was different from what was displayed on the interface. Why This Could NOT Have Happened with Bitfi The Bitfi Wallet architecture fundamentally eliminates this attack vector by ensuring What You See Is What You Sign (WYSIWYS): 1.No External Front-End Attack Surface - The Bitfi wallet does not rely on an external interface to display transactions. - There is no web-based or app-based UI where transaction details could be altered. - The signer always views transaction details directly on the Bitfi device. 2.No Smart Contract Signing Without Full Transparency - In the Bybit attack, the signing request modified the contract logic, which Ledger blindly signed. - Bitfi does not allow opaque signing of smart contracts without explicit visibility on-device. - Every single detail (recipient, amount, contract changes) is displayed before signing, ensuring no masked transactions. 3.No Blind Signing, All Details Shown on Device - With Ledger or other traditional wallets, the device cannot verify that what is displayed in the UI matches the actual transaction. - Bitfi eliminates this risk by showing the entire raw transaction on its secure screen. - Users must manually confirm the exact transaction data before signing. 4.No Third-Party Middleware or Multi-Sig Dependencies - Bybit’s multi-sig structure relied on an interface that could be compromised. - Bitfi does not depend on any third-party software to handle signing requests. - The only way a transaction can be signed is if the user physically verifies it on the device. How the Hack Could Have Been Prevented with Bitfi 1.No Masking of Transaction Details - The attack worked because signers saw one thing, while the transaction signed was different. - With Bitfi, signers would see the actual contract changes and refuse to sign. 2.No Remote Exploits - Ledger and other hardware wallets often integrate with external platforms, which can be compromised. - Bitfi has zero software integrations, making it impossible to inject a fraudulent transaction through a hacked UI. 3.No Smart Contract Logic Changes Without Explicit Approval - Even if a hacker tried to change the contract logic, Bitfi would show the contract update request on-screen before signing. - The user would see the unexpected contract modification and reject it. 4.No Private Key Storage, Nothing to Extract - If an attacker gains control of a traditional multi-sig wallet, they can manipulate funds indefinitely. - Bitfi never stores private keys. Every signature is computed in real time, making long-term takeover impossible. Why Bitfi is Immune to This Attack - Bitfi is fully air-gapped and does not rely on third-party front-ends. - Every transaction is displayed directly on the device before signing. - No smart contract modifications can be hidden from the user. - No external service can intercept or modify signing requests. - No stored keys mean hackers cannot extract credentials for later use. Bybit’s hack was a textbook example of why blind signing is dangerous. Bitfi was designed specifically to prevent such attacks, ensuring absolute signing transparency and eliminating the risk of compromised interfaces. We recommend that @benbybit & @Bybit_Official learn more about Bitfi. Lazarus Group stands no chance against this tech.
CZ 🔶 BNB@cz_binance

Some thoughts on the recent hack(s). There is a pattern where hackers were able to steal large amounts of crypto from multi-sig “cold storage” solutions, as with ByBit, Phemex, WazirX and potentially others. In the most recent ByBit case, the hackers were able to make the front-end user interface show a legitimate transaction while the actual signing was for a different transaction. I am less familiar with the other cases, but they sound similar based on limited available info. What’s more scary is that the affected exchanges used different multi-sig solution providers. The hackers, the Lazarus Group, are highly advanced and broad in their abilities to penetrate. It is still unclear whether the hackers were able to penetrate multiple signing devices, or the server side, or both in each of these cases. Some people questioned my suggestion of halting all withdrawals as a standard security precaution (in a tweet I posted from a shuttle bus to the plane). My intention was to share a practical approach based on my experiences and observations, yet there is no absolute right or wrong in either approach. My guiding principle is always to lean on the safer side. After any security incident, pause everything, make sure we fully understand what happened, how hackers penetrated the systems, which devices were compromised, triple-check all is safe, and then resume operations. Pausing withdrawals could cause more panic, of course. In 2019, we paused withdrawals for a week after a massive $40 million hack. When we resumed withdrawals (and deposits), we saw more deposits than withdrawals. Not saying this is a better approach. Every situation is different. It’s a judgment call. My tweet was to share what might work and my intention was to show support in a timely manner. I am sure Ben made the best decision based on the info he had. Ben did a good job maintaining transparent communication and calmness in dealing with a challenging situation. That shows a sharp contrast to other less transparent CEOs, like WazirX, FTX, etc. The cases mentioned here are all different. FTX was fraud. WazirX, I will refrain from commenting as there is an ongoing lawsuit. Most importantly, we should never take security for granted. It is important to learn about security yourself so that you can choose the right tools for your needs. For this, I will share an article I wrote a few years ago. It’s a little outdated, but the fundamental concepts still apply. Stay SAFU! binance.com/en/blog/from-o…

English
5
13
47
11.1K