# Daedalus wallet hacked? **URL:** \ **Category:** Report a Scam\ **Created:** [27 May 2021 10:54 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032 "2021-05-27T10:54:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Karolisc](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/karolisc/32/36421_2.png) [@Karolisc](https://forum.cardano.org/u/Karolisc)\ **Post date:** [27 May 2021 10:54 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032/1 "2021-05-27T10:54:09Z")
Hello, I downloaded daedalus desktop wallet, sent ada from binance, staked and just open from time to time to see how staking is going. That’s it. And few days transaction was made with my funds… I don’t understand how this happend. My ada just got transffered to these two addresses - addr1q80vwwctph4aykcy3nnj5n0mu392cs6cl00l0vhpsr5jp5x7cuaskr0t6fdsfr889fxlhez243p4377l77ewrq8fyrgq3gzy7w addr1q8usjzgpkrmzjd4x5twqwdm8flk9kny2597xg0q5x9qm468vcmvzl7zcqdjl8tchlx5pudqwwpsh9dw9z62h9x5htz4snxu0kw I see others had same thing. So it’s a hack and you can’t get back your ada?.. ---
**Author:** ![tomdx](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/tomdx/32/44498_2.png) [@tomdx](https://forum.cardano.org/u/tomdx)\ **Post date:** [27 May 2021 11:16 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032/2 "2021-05-27T11:16:42Z")
Please have a look at this … > [@Can I move payment and stake keys to Daedalus Wallet?](https://forum.cardano.org/t/can-i-move-payment-and-stake-keys-to-daedalus-wallet/58793/2): > > IMHO, the best method of generating keys for your pool is through a HW wallet as described [here](https://github.com/vacuumlabs/cardano-hw-cli/blob/develop/docs/poolRegistration.md). The reasoning goes something like this… As soon as you enter your private key seed (i.e. your 24-words) into a piece of software you can never be sure that this software or any of its libraries isn’t compromised and never will be. Who/What is reading your screen, your keyboard, your memory? How is it guaranteed that libraries (which the wallet process uses) cannot access that memory? A HW wallet gu… I recommend this to all of our [(loyal) delegators](https://twitter.com/AstorPool/status/1397862584779431940), because [stuff like this happens](https://www.trendmicro.com/vinfo/nz/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets) a little too often for my liking. In short, put your private key in hardware - don’t give it to software especially not to a phone. ---
**Author:** ![nguoi-ai-len](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/nguoi-ai-len/32/23794_2.png) [@nguoi-ai-len](https://forum.cardano.org/u/nguoi-ai-len)\ **Post date:** [27 May 2021 11:30 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032/3 "2021-05-27T11:30:40Z")
He said he had a desktop wallet, but you specifically mentioned a phone. Has anyone done security analysis on phones. Specifically a non-rooted Android phone that only has apps installed via Google Play. > Who/What is reading your screen, your keyboard, your memory? > I have recently restored a wallet on my phone. I would like to know if there is any reported cases of this occurring? Additionally, I would like to know if it would be secure to buy a new phone from a secure vendor and only install Yoroi. What are the possibilities of my funds been maliciously withdrawn by another party with this method. FYI, I live in a country where importing electronic goods (ie a hardware wallet) is not so straightforward, so this option may have to wait a year or so. ---
**Author:** ![tomdx](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/tomdx/32/44498_2.png) [@tomdx](https://forum.cardano.org/u/tomdx)\ **Post date:** [27 May 2021 11:43 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032/4 "2021-05-27T11:43:40Z")
HW vs. SW wallet is a general security concern, because the attack surface on software is an order of magnitude higher than on a dedicated chip. In the latter case, the attacker will have to sit next to you and press the buttons on the device because there is no other way to sign a Tx that unlocks your coin - no software attack can do that. You still have a mnemonic (i.e. 24-words) with your HW wallet, but you only have to touch it once every so many years when you want to replace your device for one reason or the other. This can then be done off-line. You’re welcome to PM me, in case you’d like me to send you a Ledger. I’d gladly do that if it’s of any help. ---
**Author:** ![nguoi-ai-len](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/nguoi-ai-len/32/23794_2.png) [@nguoi-ai-len](https://forum.cardano.org/u/nguoi-ai-len)\ **Post date:** [27 May 2021 12:08 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032/5 "2021-05-27T12:08:24Z")
> You’re welcome to PM me, in case you’d like me to send you a Ledger. I’d gladly do that if it’s of any help. I think it’s best to buy ledgers direct from hardware wallet manufacturer websites and not random guys on message boards (no offence, this is just something I have heard from numerous sources) ---
**Author:** ![tomdx](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/tomdx/32/44498_2.png) [@tomdx](https://forum.cardano.org/u/tomdx)\ **Post date:** [27 May 2021 12:40 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032/6 "2021-05-27T12:40:06Z")
Of course it is, and I would not have offered if you didn’t say “not so straightforward, so this option may have to wait a year or so” ---
**Author:** ![raph\_cardano](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/raph_cardano/32/56254_2.png) [@raph\_cardano](https://forum.cardano.org/u/raph_cardano)\ **Post date:** [9 June 2021 00:08 UTC](https://forum.cardano.org/t/daedalus-wallet-hacked/63032/7 "2021-06-09T00:08:12Z")
Just one precision though, the security of a hardware wallet is only as good as the security of the recovery seed. If you do the initialization offline and never type it then it’s ok (provided your computer wasn’t compromised beforehand, obviously) but there have been many cases of users being deposessed of their currencies mainly because they believed currencies were “secure in their wallet”. The fake Trezor app for instance, people downloaded it and tried to “restore” their secure hardware wallet by using their recovery seed. Needless to say, their currencies were then stolen quite easily, without any access to the physical device. The attack vector is a software in this case, and the weak link, the human, as often.