The nice Korean

You are holding an ordinary hardware wallet, and inside it there is a chip. A chip is a mini computer. It is not a file holding your private key or your seed phrase. It is not password-protected storage.

It is a mini computer. It does something in there, but nobody really knows what exactly. The source code of the chip is not published.

So the picture looks like this. You check out the company that made the wallet yourself, maybe you even check the code of the interface, you write down and back up your seeds yourself, and then you say: “I am the naive one here, so let my private key be processed inside a closed microcomputer where I have no idea what is going on.”

That is absurd at its very core.

It is like playing a football match for 89 minutes, controlling everything, watching everything, staying alert and covering yourself from every angle, and then in the last minute simply walking off the pitch, because “that is what etiquette says and everyone does it”. And the opposing coach reassures you that the ball will not leave the pitch anyway.

You hand your private key to someone else’s computer, and you have no idea how it works, how it used to work, how it will work, what exactly it does, or how any of it happens in there.

It is the classic business of sweeping a problem under the carpet. People want to hire a cleaner, but they are afraid: what if she empties the house?

So an idea appears: let us hire the cleaner through a “cleaning company”, because a company carries more responsibility. That the same cleaner from yesterday’s small ad works for that company is something the mind would rather not admit. Nor the fact that a limited company’s liability can start from a token amount of share capital.

This is exactly the same case.

My question to that is always the same: and you know this how? Seriously, how do YOU know? “Well, the experts decided!” Which experts, have you had tea with them? What made you decide they are experts? The fact that they have HSA+ and HDSFA++ in their name? The more letters, the more serious it must be?

Say you run a shop selling coffee machines in your own country. Does anyone abroad know who you are? Quite possibly not everyone in your own town knows you either.

Now think about why you know the company SUPER SECURITY HSA+ HDFSA++ from the United States, the one that licensed that super chip. Do you think they are such world-famous specialists that everybody knows them, or is it simply a company somebody pointed you at, quite deliberately, in a sponsored article?

On top of that, take TESLA cars. Do they have their own team of security experts? Presumably they do. And yet ten teams from around the world turn up at the Pwn2Own hackathon and crack that Tesla in two days. How does that happen? How does Tesla’s security team keep missing the elephant in the dark room?

So it is no surprise that after a while the founder of Ledger says publicly: if the police need it, we can extract the private key from our microchip wallet. And everyone goes: “Well. What a shock.” It is no shock at all. What is genuinely hard to believe is the person who thinks one mate commissioned an audit from another mate so the second one could write: he is a top security guy.

So handing your private key to someone else’s microcomputer, after all the effort you put into earning that money, is like saying: “I have earned 10 million, but I am the naive one, so would somebody kindly take my money into safekeeping.” Instead of simply looking after it yourself.

Picture it: there is a factory in Korea where these chips are made. Every intelligence service in the world knows chips are made there. The Korean government knows chips are made there, chips that billions in bitcoin will be stored on. Every worker and the local mafia know it too. And it is on that very production line that they are assembled and flashed with firmware.

And you go: “Great! I will take a black box off that conveyor belt, a microcomputer, and drop my bitcoin into it!”