r/Bitcoin • u/Yodel_And_Hodl_Mode • 8h ago
Ledger Users Are Getting Robbed Because They Trusted Ledger (it's literally on the box)
331
u/ComasArentFun 7h ago
See this is why I hate the BTC community.
I love BTC and have a very healthy proportion of my stored wealth in it, but I despise you bitchy little fuckers
People went with best practice.
Self custody, hardware wallet, supplier rubber stamped by the manufacturer - just like every one of you oh so superior arseholes has been bleating about for years, but because they got caught in a very complex hardware scam that involved the taking over of an entire company, somehow they are suddenly idiots.
Take a fucking look at yourselves.
This is why BTC isn't viable as a currency and only rises based on the mechanisms of valuation through diminishing rewards.
You twats revelling in people losing money because they didn't do it to your standards.
This isn't the same as old ladies getting scammed by a phone-call from India. This was a sophisticated and prolonged attack that involved multiple levels of crime
Ghouls.
76
u/NUMBerONEisFIRST 7h ago
I also hold a lot of Bitcoin, and I agree with this comment.
If you try to act like Bitcoin is an exclusive community and you don't try to build community, how do you ever expect it to grow?
People for years on here have been saying, it's only really yours if it's on an external wallet.
How many of these people that got scammed took advice from the people on here?
17
u/Yodel_And_Hodl_Mode 6h ago edited 6h ago
Yeah. I agree with some of it too.
I don't post much in this sub because I know the things I'd say aren't what most people want to hear.
I've been begging people to stop trusting Ledger. But also, I strongly advocate for people to learn the basics and do DIY self custody. I recommend a fork of SeedSigner called ShieldSigner.
But again, I also say, people need to start by learning how Bitcoin self custody works. Too many people don't understand the basics. For example, they think their coins are in their wallets. No. Coins are on the blockchain. The wallet holds the keys.
I also encourage people to think like an attacker so they can understand things that make them vulnerable to attack. For example, buying a hardware wallet from a company means your name and address are in that company's hands. Ledger leaked their customer database, so thieves know who millions of Ledger users are.
Nobody here wants to hear any of that though. Everybody wants easy answers.
Self custody isn't hard, but it requires learning that too many people don't want to do.
Learn how to manually generate a random seed phrase. This protects you from firmware flaws like ColdCard's.
Learn how to build your own hardware wallet from off the shelf parts. SeedSigners are built on a Raspberry Pi and there are tons of tutorials. It's not hard. This protects you from supply chain attacks.
Use a stateless and airgapped hardware wallet. Again, SeedSigner is easy to recommend, but there's a fork named ShieldSigner which is even better because it adds advanced features to SeedSigner like encrypted SeedQR and passphrase QR.
Don't tell people you own Bitcoin. This protects you from social engineering attacks.
I know this sounds complicated, but Self Custody means Self Responsibility. It isn't hard, but it does require learning, which means it's not for the lazy or the dumb.
EDIT: I forgot the most important thing. Never trust your Bitcoin to any code that isn't open source. Bitcoin is open source. Your wallet should be too. No exceptions.
7
u/Gears6 5h ago
Nobody here wants to hear any of that though. Everybody wants easy answers.
That's always the problem. Easy answers meaning convenience. The complexity of crypto in general means, exactly this kind of thing, and the inability to reverse a transaction although by design is also the weakness. There's a reason why money today is designed and operate the way it does....
EDIT: I forgot the most important thing. Never trust your Bitcoin to any code that isn't open source. Bitcoin is open source. Your wallet should be too. No exceptions.
Even open source can screw you over unintentionally. Any time you have something that you cannot fully understand, cannot ensure 100% security or vulnerability and don't have full control of the chain, you're vulnerable. Otherwise, open source software wouldn't have vulnerabilities. More than ever, AI is making it even worse.
Ultimately, the question you have to answer is, do you trust the government/banks to hold (and guarantee) your funds, or do you want self control. If you want self control, you open yourself up to other risks.
1
u/Yodel_And_Hodl_Mode 4h ago
Even open source can screw you over unintentionally.
That's true. Really, I should have also said that you should only trust fully open source code which has been thoroughly vetted and tested. SeedSigner's code is a perfect example. They obviously test their code, just like how Ledger tests Ledger's code. But... SeedSigner's code is also used and thus battle tested by other devs in their own work. ShieldSigner is just one example of other devs building on SeedSigner's work, and the dev behind ShieldSigner often participates in improving SeedSigner's code.
If you want self control, you open yourself up to other risks.
Right.
The challenge is to limit those other risks.
This is why the hardware wallets I swear by are:
Built using a seed phrase I generated randomly by hand. This prevents ColdCard-style randomness flaws.
Air-gapped. Online hackers can't reach them.
Stateless. The seed & wallet aren't saved on the device, which means there's nothing on the device if thief to steals it.
Encrypted seed backups: I'm a diehard believer in encrypted SeedQR. Even if a thief finds my SeedQR, they have no way of knowing what it is. It's just a QR code that scans as blank.
Passphrase QR: Expecting users to manually enter a passphrase every time encourages the use of weak passphrases or not using passphrases at all. ColdCard owners who used strong passphrases were safe from that attack. Note that I said strong passphrases. A few weak passphrase wallets were hacked.
Runs on off-the-shelf parts: This prevents supply chain attacks, and it keeps your name & personal info from being leaked. SeedSigner runs on a Raspberry Pi which has no wifi.
Runs fully open source code. Closed source code can't be proven safe. This is also true for companion apps to use with a hardware wallet. Open source only. I trust Sparrow wallet for desktop (fully open source) and I pair it up with Bitcoin Core, which means I look up my wallets on my own node. This is really easy to set up.
Metal backups for everything required to restore the wallet manually. This includes the passphrase, of course.
Last, but not least, I swear by owning a safe and using home automation sensors on the safe. If my safe gets opened or moved, I instantly get notified on my phone, computer, etc. This kind of home automation is easy to set up, and it's cheap too. Aqara sensors are great. $60 total.
Self custody comes with self responsibility, so you have to think like an attacker to figure out how to avoid vulnerabilities that get people robbed.
I know the above list reads like a lot of work, but really, it's not. The more you learn about what a seed phrase actually is (it's entropy) and how transactions are signed, the easier it gets to keep your Bitcoin safe.
3
u/slightly_OCD 1h ago
The average Joe bloggs on the street isn't doing all that shit though are they
-1
u/Yodel_And_Hodl_Mode 1h ago
Then self custody isn't for them, is it?
I know nobody wants to admit this, but self custody requires work. Those who aren't willing to do the work are more likely to get robbed.
The good news is, people who aren't ready for self custody have other options. I'm a diehard hodler, but as attacks become more sophisticated, I think more people should probably be buying ETFs instead.
The sad thing is, the steps I outlined aren't hard. But people want easy answers, and anybody offering easy answers for Bitcoin self custody is somebody you should not trust.
To do self custody right, you must:
You must know your seed phrase is trustworthy. How do you, or I, prove the seed generated by a wallet is truly random? Many of the people trusted ColdCard got robbed because their seeds weren't truly random (they were from a reproducible set). This is an easily solvable problem. Generate your own random seed phrase.
You must know any device you enter your seed phrase in cannot be accessed over the internet. People are going to get robbed due to Ledger's key extraction API ("Ledger Recover"). Hackers are surely using AI to reverse engineer it. This is an easily solvable problem. Don't use devices that can connect to the internet.
You must know any code you use for your wallet is open source and battle tested not just by the damn company that made it. This is an easily solvable problem. Stop using trendy gadgets and stop trusting companies.
You must know you have metal backups for everything required to restore your wallet from scratch if anything goes wrong. This is so freaking easy to do, yet so many people don't do it.
...etc.
If this stuff is too hard for Average Joe, it means Average Joe isn't ready to do self custody of his Bitcoin. And that's fine. There are other options. For small sums, maybe keep them on an exchange and hope the exchange doesn't get hacked or go broke. Better yet, buy an ETF. I don't like those options for myself, so I do self custody... but I do the work to learn so I can do it right.
And by the way... I don't say any of this to suggest I have all the answers. I'm still learning too, and I always will be. Always learning is part of the job of doing self custody.
Everybody likes saying things like "Owning Bitcoin means being your own bank." That's true. But too many people forget it also means being your own bank security. Anybody who isn't up for the challenge of doing it right shouldn't be doing it at all, because they're not ready.
And anybody who needs Bitcoin self custody boiled down to a Twitter-sized TL:DR; shouldn't be doing self custody, because they're not ready.
10
u/Gears6 5h ago
Yup!
I think this is the reason that BTC/crypto can't become a replacement for fiat. It's because, fiat has evolved over time to deal with the sort of things that happens when we have humans involved. It's not simply just trusting the government, but also trusting the organizations handling your money and doing transactions on your behalf.
35
u/StormMedia 6h ago
Have said exactly this in a few threads. Bitcoin will never be viable as a true currency replacement to the masses due to this insanely high barrier to entry that is only raising with every attack.
On top of that, shaming people that lost potentially their entire lives savings after FOLLOWING the best practices at that time.
I would put my entire savings into one random pharmaceutical company’s stock before BTC again.
3
u/Gears6 5h ago
I would put my entire savings into one random pharmaceutical company’s stock before BTC again.
Why not put some in both, and some other companies?
I do....
There's no guarantees and so I wouldn't put all eggs in one basket. You can be concentrated, but not one fatal blow and you're completely out.
-3
u/LeagueofLagginz 5h ago
The best practice would be to have 10+ different wallets. You should never have your entire crypto portfolio in one wallet.
2
u/mossyskeleton 3h ago edited 3h ago
Preach. So many holier than thou jargon nerds who like to believe they're smarter than everyone else. And crypto in general is absurdly complicated, even after all these years. I honestly am surprised it has as much staying power as it has had. This is likely due to the technology itself having real promise, but a lot of the people who support and promote it just kinda suck. I've been engrossed in crypto world since like 2013, and I'm still finding myself wondering what the fuck it's all for.
Edit: On second thought, that was harsh. But it's obnoxious how byzantine crypto is. It's all nerds who just forge an expansive trail of complexity and jargon ever outward, without bringing the rest of the world along with them.
2
0
-47
u/UnreasonableEconomy 7h ago
a sophisticated and prolonged attack that anyone with a modest understanding of the technology could see coming from a billion miles away.
if you leave the front door open and tell everyone you're going on vacation and someone burgles the place, you can't exactly be shocked to see your place trashed when you get back. that doesn't make it not a crime, but that doesn't not make you a fool neither.
12
14
27
u/ComasArentFun 7h ago edited 7h ago
Bollocks. Utter revisionism.
If an attack requires an aggressive take over of a company to secure their 3rd party contracts and slaps NDA's on people (with a very likely "tell anyone and I'll fucking kill you" caveat baked in) and you think that is something you can see a billion miles away, then mate, sell access to your crystal ball.
Or more likely, you're talking utter bollocks and just feeling superior because it hasn't happened to your security stack.
"modest understanding" - pretensious, facile, condescending shite.
Have some fucking empathy
5
u/Gears6 5h ago
a sophisticated and prolonged attack that anyone with a modest understanding of the technology could see coming from a billion miles away.
if you leave the front door open and tell everyone you're going on vacation and someone burgles the place, you can't exactly be shocked to see your place trashed when you get back. that doesn't make it not a crime, but that doesn't not make you a fool neither.
That's not even the same. Not even close. They didn't leave the front door open nor tell anyone they're going on vacation. They did what the recommended practice was and to an extent is. In other words, they locked the door, removed news papers/mail, turned the light on at night to look like they were home, turned the alarm system on and went on vacation. Came back and found, it was an inside job done by the security alarm company employees.
60
u/acrxhd 6h ago
Wasn’t self custody cold storage the infallible method y’all have been harping about for years? Now all the sudden ledger owners are fools for trusting them?
What’s next, do we need to build our own photolithography labs in our backyards because we can’t trust TSMC to not backdoor their semiconductors? This is not the fault of people who bought ledgers. This is exactly why the crypto community gets the bad rep it does. You can’t expect crypto to be adopted by normies when you clown them for trusting hot wallets while simultaneously clowning people who drank the kool aid and invested in cold storage.
8
u/Walla_Walla_26 5h ago
Sounds like it’s only if you bought a Ledger from a third party. Should be good to go if you bought it through Ledger, no?
11
u/Michichael 6h ago
A good lawyer would argue that ledger is liable because of these claims.
-2
u/MedivalBlacksmith 5h ago
What's the claim according to you?
That they were engineered to be tamper proof?
Which doesn't mean that they are...
8
u/Michichael 5h ago
It's a claim of security and trust that was ultimately proven to be entirely defeated and weak. Making financial decisions, in the millions of dollars, based on that warranty is something a lawyer can argue creates liabilities. The vetted vendors is even further claims of fitness for purpose.
Ledger is gonna have a lot of legal fights on their hands, or they would if the country where this happened has laws governing such warranties of fitness.
-5
u/F1shB0wl816 5h ago
They’re not going to have a legal fight because there is no legal fight. They’re not a bank, they’re not under lawful obligations to protect assets. There wouldn’t be anyone in the cold storage industry if they were liable for it, there’d be next to no upside and potentially near infinite risk.
5
u/Michichael 5h ago
When you sell a product for financial storage and claim it's tamperproof and safe if it's through your trusted partners, talk up how you vet them, and losses are incurred DIRECTLY because of failures in those claims, liability can be established.
Misuse, leaking your keys, or other losses that can't be directly traced to failures by Ledger? Nah. This? Oh they fucked up.
But you believe whatever you want there champ.
Anyone that bought Ledgers after they added a built in key export service kinda deserves to get scammed imo, and hopefully this will kill the company's rep for good.
•
u/NorskKiwi 46m ago
Ledger also has to abide by the law of the countries they do business in too, to a limited degree.
10
u/Ok_Option_3 5h ago
I'm a bit out-of-the-loop here. Can someone link me a breakdown of this Ledger supply chain attack?
26
u/CatatonicMan 5h ago
Ledger has contracts with third-parties to sell their devices. One of the third-parties was secretly bought out, and signed an NDA so that nobody would know they were bought out.
The new owners modified the Ledgers they were selling, installing a sophisticated bit of man-in-the-middle hardware that would snoop and broadcast the wallet seed words when they were entered into the device, before they entered the secure element, thus compromising the wallet and all the funds therein.
9
u/SeriousGains 7h ago
Are Ledgers straight from the manufacturer still considered safe?
6
u/ecafyelims 6h ago
Did you pick it up from the manufacturer itself? It could be compromised during shipment.
2
17
u/loupiote2 7h ago
An anti tampering sticker would offer no actual additional security in the current case (spying implants).
3
u/MedivalBlacksmith 6h ago
Hehe no shit?!
1
u/HedgehogGlad9505 5h ago
Because it's so easy to make a fake sticker for those thieves. A sticker will only raise the cost of an attack like a few thousand bucks in total.
13
u/toccoas 7h ago
Hah, tamper-proof! They only missed the "minor" attack vector of OLED screen data exfiltration. Of course, had they designed them to be not-all-your-eggs-in-one-basket multi-sig devices with some standard so we could mix vendors, we wouldn't be in this mess. But if they did that they wouldn't be able to "recover" your seed phrase in case you end up labeled a criminal now would they?
5
u/fishburgr 2h ago
So I shouldnt be using my ledger any more or is it only ledgers from a certain supoplier? Ive had mine for years.
7
u/SequentialHustle 5h ago
most people would be better off leaving their crypto in coinbase lol
2
u/classygorilla 1h ago
Oh, easily. 90+% of people who hold Bitcoin probably only hold it because it's value skyrocketed and actually know very little about what it is.
I agree with the other poster, Bitcoin honestly is a fucking trash currency. It just is. It's too complicated. Even the very nature of how it works when it works right offers zero consumer protection.
I can and have used my credit cards charge back feature several times. Bitcoin? Fucked. It's gone.
I consider myself somewhat savvy about how to use technology, have done the basics for cold storage etc and I'm sweating every time I need to move my BTC and I don't even have a lot. Between that and the swings and more and more it seems to be losing its appeal.
8
u/Spooplevel-Rattled 6h ago
Again. Wouldn't it just be more secure to use a device that's not marketed for this. Thus not targeted? Jeez just buy an old laptop and gap it.
8
u/ThePlumKing 6h ago
Someone on this subreddit asked about cold storage wallets and my only recommendation was to make sure you didn’t buy it 3rd party. My inbox was flooded with commenters saying buying off Amazon and other 3rd party sellers was completely fine, blah blah blah blah I was just being paranoid. I don’t understand why that’s such a controversial position for someone, just buy the fucking hardware directly from the seller. In general, the crypto community on reddit is some of the worst people on the internet by far.
3
u/Gears6 5h ago
But what do you do if the seller is compromised too?
Also, there's a lot of middle men between the seller and you. In fact, there's a lot of middle men from manufacturing, and it going to the seller. By seller, I assume you mean Ledger.
This is the flaw of a system designed on absolutely trust in a third party that has no authority over the transfer of the underlying assets and isn't insured against failures. Banks are backed by the government, and insured. They also have ability (to a degree) to revert things. With crypto, there's no such mechanism.
1
2
u/Accurate_Ad_3233 6h ago
Got an email spam this morning about Ledger implementing 'seedless verification' as well.
"Ledger is retiring the 24-word Secret Recovery Phrase. All devices move to a fully seedless architecture. Private keys are generated, stored, and signed entirely inside the secure element. The key never leaves the chip."
The lengths some people will go to. (Though IIRC there was legit mention of seedless verification at some point?)
2
u/draculap2020 6h ago
BTC with no trust mechanism but people use trust for buying cold storage, trusting online exchange ,trusting the store where you are buying. Titanium door and Plastic wall scenario.
4
u/Walla_Walla_26 5h ago
Never understood why anyone would even think to use a third party seller whether they are “authorized” or not. Just buy direct
8
u/No-Kitchen-6511 4h ago
Go to the Philippines and place an order for a Ledger and see how that goes.
0
u/Yodel_And_Hodl_Mode 8h ago
See that pic?
That picture is a mic-drop, except the mic was dropped on a landmine. BOOM.
Ledger falsely stated in writing that their devices offered a level of security capability which the devices were not capable of delivering. And, because of that, Ledger customers are being robbed.
There is no anti-tampering sticker on this box.
FAIL. Customers had no warning.
A cryptographic mechanism checks the integrity of your Ledger device's internal software each time it is powered on.
FAIL. The cryptographic mechanism didn't work.
The Secure Element chip prevents any interception or physical replacement attempt. Ledger devices are engineered to be tamper-proof.
EPIC FAIL. Ledger devices weren't tamper proof. Ledger users who bought devices through authorized resellers are now getting robbed.
Ledger printed that false statement of security capability on the box as if was a fact. It's right there, in writing, on the box.
Brutal.
Anyone who makes apologies for Ledger or attempts any form of whataboutism is not serious about Bitcoin self custody.
23
u/Kinimodes 7h ago
Reads like an LLM
-4
u/Yodel_And_Hodl_Mode 7h ago
My complaints? You think I'm a bot?
For the record, I'm a former Ledger user. I hate this company. They're dirty.
6
u/crooks4hire 7h ago
Oh I thought he meant the print on the box lmao 🍿
1
u/Yodel_And_Hodl_Mode 7h ago
Oh! Maybe he did! If that's the case, I apologize.
Ledger's text isn't from an LLM though. That nonsense has been on Ledger boxes for years.
The funny thing is, Ledger's text had to have gone through lawyers before it was printed on their boxes, right? I'd assume that, anyway.
This whole thing is such an epic fail on so many levels.
2
u/read_more_comments 7h ago edited 7h ago
Technically, they said it's engineered to be tamper proof .... Not that it is.
They also saved 2 cents by skipping the tamper evident sticker, which would also not prove it wasn't tampered with had it been included.
Ledger are clowns, after making firmware that exports your seed to the cloud. It defeated the entire purpose of a hw wallet.
6
u/Yodel_And_Hodl_Mode 7h ago
Ledger are clowns, after making firmware that exports your seed to the cloud. It defeated the entire purpose of a hw wallet.
THANK YOU.
More people need to say that.
I'm blown away by how many people don't understand, the entire point of using a hardware wallet is to be able to use your keys to sign transactions on a device which cannot be accessed over the internet*.
Ledger said this, again and again, in print:
"Your keys are always stored on your device and never leave it"
Then, Ledger wrote an API to extract keys over the internet from Ledger devices... and Ledger sold access to that API as a feature.
That's not a feature. It's poison.
And the craziest part is, idiots cheered Ledger for adding poison to their hardware wallets without their consent. Just... wow.
2
u/read_more_comments 6h ago
I am pretty sure they told us the secure element prevented export of your seed. Then they made the firmware export your seed. The bigger issue people don't realize is that even if you don't use the service, there are now hooks already in the device to extract the seed, which means more potential attack vectors that never needed to exist. And makes the risk of their codebase being poisoned even more risky.
1
u/Yodel_And_Hodl_Mode 5h ago
That's right.
Adding to what you said... there's an even more basic issue:
The firmware is closed source. Even if a user chooses to not use that feature, how can they prove the key extraction API cannot be accessed over the internet? Can't prove it? Can't trust it.
And since the firmware is closed source, the only people regularly checking the code are Ledger (who cannot be trusted) and hackers working with AI to reverse engineer Ledger's code.
I'm a former Ledger user. The day Ledger's key extraction API was outed... that's the day I was out. I only used my Ledgers once after that. I used them to send my coins to a wallet with new seed I made (a seed I never entered in a Ledger!), and then I wiped the Ledger devices.
1
u/read_more_comments 5h ago
Right, put the two together - you have a device that openly tells you it can export your seed. And you are using their software that transfers data to their api. It could be randomly exporting your seed and you'd never know it. They could later claim it was a bad comment in their code (like disabling the RNG with coldcard), or someone hacked their git repo and made unauthorized changes. They don't even have to be involved for this to happen.
You have to give Ledger a lot of trust and I don't think its been earned. The fact that they decided the backlash from exporting seed was worthwhile in order to get reoccurring cash inflow, marketed to paranoid geeks who only want to secure their seed, shows how desperate they are for money.
2
u/RateMyWallets 2h ago
The irony of that box copy is brutal given what the community teardowns are showing.
Ledger's argument was always that tamper-evident stickers were unnecessary because the CC EAL-certified Secure Element would catch any physical replacement attempt. But the attack vector completely bypassed the chip boundary
Beyond the Southeast Asia distributor breach (CryptoBilis), European retail stock (MediaMarkt / Saturn linked to distributor Aqipa GmbH) has confirmed modified units, with battery date stamps (code 2406) suggesting devices may have circulated since early 2024.
Woof.
1
u/read_more_comments 2h ago
holy shit balls. That means a lot of people need to be checking their hardware.
1
u/Walla_Walla_26 5h ago
I bought a ledger nano 2 years or so ago and it’s still in the box because I’m so paranoid
1
u/MedivalBlacksmith 6h ago
To be honest, they never said they were tamper proof. They were engineered to be that.
1
u/Aprice40 5h ago
I mean..... speaking technically.... the hack was to add hardware (not remove or modify existing hardware), and the crypto mechanism only checks the devices internal software for tampering, not to prevent mitm attacks. Everything they claimed was true. It may have even led the attacker to go down the path they did, because it spells out the flaw by explaining the design.
2
u/All-I-Do-Is-Fap 7h ago
All ledgers are fkd now?
9
u/frog_tree 6h ago
hardware wallets in general seem a lot riskier now. I wouldnt like it if my bank secured assets with a $100 dollar device from some random company
3
u/MedivalBlacksmith 5h ago
As I understand it: there was/is some shady reseller modifying the devices. This does not affect all of the devices.
2
u/Walla_Walla_26 5h ago
Again it sounds like if you buy straight from the manufacturer and it arrives with no evidence of tampering, then you’re good.
1
1
1
1
1
1
u/LeoRisingGemini 1h ago
Not a techie, so apologies if this question is very basic. Was everything that was typed into the modified devices sent out? So even having a 100-character super duper airtight passphrase wouldn't have helped? Also, if the info was sent to the cloud, then someone other than the actual thief who installed the modification could swoop in and steal the info before the thief could use it to steal funds from any given device?
-1
5h ago
[deleted]
1
u/order_of_the_beard 5h ago
Cold wallets became popular because people leaving their crypto on exchanges like Coinbase were getting hacked all the time. Not your keys, not your coins is still true.
0
5h ago edited 5h ago
[deleted]
1
u/order_of_the_beard 2h ago
Sorry kid, it's embarrassing to be so wrong, but https://www.cm-alliance.com/cybersecurity-blog/cracking-the-coinbase-breach-what-went-wrong-and-what-we-can-learn
That was just last year, just at Coinbase. Try this https://crystalintelligence.com/investigations/the-10-biggest-crypto-hacks-in-history/
Educate yourself son and maybe you'll start understanding why cold wallets started looking pretty good.
0
189
u/BuildAnything4 8h ago
lol. Is this real? This is the kind of note I would make if I tampered with a device and wanted to scam people.