
Bitcoin Security | Specter DIY HWWs at @ClavaStack | @_einundzwanzig_ Tutorial Guy | President of the @SpecterDIY Association
Joined June 2023
- Tweets4.7K
- Following1.2K
- Followers2K
- Likes6.7K
Pinned Tweet
Mein kostenloser Bitcoin Nachlassplaner ist live!
Wenn du deine Bitcoin Vererben möchtest dann solltest du ein einen Nachlassplan erstellen.
Den sauber zu erstellen kann einiges an Zeit und Arbeit kosten und birgt das Risiko Dinge zu vergessen.
Deswegen habe ich ein offline Planungstool gebaut, das dir diese nervige Arbeit abnimmt.
👉clavastack.com/de/inheritanc…
That's the idea of Bitcoin mixing.
In the end you have a lot of outputs that look exactly the same.
You own some of the outputs.
It's not possible to know who is now in control of the new outputs even though your past Bitcoin UTXO's were deanonymised.
Bitcoin has two distinct private Key attack surfaces:
1. Seed attack
An attacker tries to guess the seed phrase. A properly generated 12-word BIP-39 seed has ~2¹²⁸ entropy
-> astronomically large if the words are truly random.
2. Public-key attack
Once the full public key is known, an attacker can theoretically attack the corresponding private key on secp256k1 directly. The classical security level is also roughly 128 bits. This would require insanely powerful computers and astronomical amounts of energy.
The public-key attack is more efficient because it skips most of the derivation steps. Without the public key, the only realistic path is guessing seeds → deriving keys → checking addresses. With the public key exposed, a direct cryptographic attack becomes possible.
This mainly matters for:
- old P2PK outputs
- address reuse
- Taproot addresses (public key is revealed on first spend)
In normal use the public key stays hidden behind a hash, that’s the Bitcoin address you receive on.
Main takeaway:
12 random words are not “too few.” They wouldn’t realistically be attacked before someone successfully attacks Satoshi’s coins, which already have their public keys sitting on the blockchain.
I went to the @BTCParaguay Bitcoin Meetup in Paraguay.
They hold two meetups a month. One is only for expats, which is the one I attended.
Here, @kotasjn told us about a Sovereign Conference they are organizing.
This is why I do use 12 words for my Bitcoin Seedphrase
Replying to @0xshpd @SujalJethwani
BIP-39 maps 11 bits per word. A 12-word seed encodes 128 bits of entropy. A 24-word seed encodes 256 bits. The extra 128 bits do not reach the private key in any meaningful way, because Bitcoin private keys have a security level of 128 bits regardless of seed length. The ECDSA curve order is 256 bits, but brute-forcing a Bitcoin address via RIPEMD-160 collapses that to 160-bit preimage space, and the actual attack surface against a secp256k1 key sits at roughly 128 bits of effective security.
Schnuartz retweeted
The Specter Fan @arh9992 made a full Chinese one‑hour guide for the @SpecterDIY Hardware Wallet without Smartcards.
Everything from assembly to antiphishing words and making your first transaction.
Highly valuable even auto‑translated to English:
🎬 youtube.com/watch?v=DPW9j0Qt…
2 weeks ago Paraguay had a crazy hail with big ice balls.
This is how the car of one of the bolts I took looked like.
Schnuartz retweeted
What changes when a hardware wallet communicates without a cable or Bluetooth?
@Schnuartz will compare cable and Bluetooth devices with air-gapped signing via SD card and QR code, and explain the security and transparency trade-offs.
📅22 Oct · Lugano👇️
luma.com/yawcgo0t?utm_source…
Here’s exactly how you can get where I am as well, step by step:
What you get (nearly same practical status as locals):
- Live in Paraguay indefinitely (card renewed every 10 years)
- Cédula (Paraguayan ID)
- Work freely, open bank accounts, get a RUC, sign contracts, buy property, get utilities & driver’s licence
- Enter/leave freely (re-enter at least once every 3 years)
- Permanent Residency (make sure to not be off paraguay for more than 3 years)
What you don’t get:
- No Paraguayan passport
- Voting rights only in municipal elections (not national)
- No eligibility for most public offices
- Still subject to the 3-year absence rule
1. Prepare the documents in your home country
- Valid passport (at least 6 months validity recommended)
- Birth certificate (apostilled)
- Police clearance / criminal record (for presentation abroad) (apostilled; must not be too old when you submit)
2. Contact a imigration Helper
Highly recommend starting with this before or while preparing the documents.
In theory this works without one, but I don't recommend it anybody. It will take a lot longer, you will need to find everything out yourself and need good spanisch.
I used @ParaguayProfis. If you message them, write them Schnuartz sent you. You don't pay extra but you support my work.
He will give you all the advice you need.
3. Cédula and Temporary Residency
- Bring everything mentioned + Do the staff your imigration helper told you
- Paraguay Profis will bring you to the imigration center.
- You need to do fingerprints, Foto, signature etc.
3-4 Month afterwards you will receive your Cédula (like a ID in Paraguay) + your temporary Residency.
-> They can send it to you or you via post to your country / a trustworthy person picks it up and brings to you.
Both last for about 2 years.
Costs:
~€2,2k for migration helper (includes Cedula etc) + flight (~€1k from Germany) + normal vaccation costs
4. Second trip (~365 days after the first one)
- Here the time Slot is very important. You do not want to risk to be more than 365 days outside of Paraguay. so try to set this trip exactly in the middle of the 3 trips you need to do.
- Before this trip contact your imigration helper to be sure you do everything right.
- It could be the case that some extra cost come here. Prepare €900
- Nothing special more, this is for having a stamp in your passport.
5. Third Trip (~365 days afterwards)
- Timeslot is very important as well. You have 90 day time window. BUT you don't want to be more than 365 days off Paraguay.
- Speak with your imigration Helper what you need before!
- Passport, Cedula, Residency, Police card (you will receive as well the last time) is minimum
- You are doing: New picture, new fingerprints and new signature
- You get:
->Permanent resedency for Paraguay (Here it's highly recommended to not be off Paraguay for more than 3 years. Otherwise it could taken from you in theory)
-> New Cedula that last for 10 years
- You will receive both under the conditions like last time after 3-4 month
- Cost is €1,7k
(6.) Bonus: Paraguay Consulting
- There is Lia. A German YouTuber with 7k Subs.
- She is a female Bitcoiner and does consulting for migration etc.
-> wohin-auswandern.com/
- Tell her that I (Schnuartz) sent you to her. So you get 15% off
[I'm not a professional. Ask your immigration helper about the details. Do not trust ChatGPT or simple Google Search about that topic. The informations there are often misleading]
Schnuartz retweeted
Replying to @El_FreedomFairy
I’m a German Bitcoiner in my early 20s.
I don't like the way Germany has gone. I didn't left my country as I prefer to do business here. And as you can still live here somehow.
I still want to be able to build something big, have a family in the future, raise my kids without crazy totalitarian politics, and give back to my community.
I’ve travelled tens of thousands of kilometres to Paraguay and back to get myself a permanent residency as a plan b there and been in some scary and wonderful situations. Everyday I feel as though my effort brings me closer to getting where I want in my live.
If you were in my position, what would be your next step?
It's confirmed. In 3-4 month I will receive the permanent residency for Paraguay.
And a Cédula (like an ID) that will last 10 years until I need to extend it.
Hope I will never need it.
Right now I’m at the Paraguayan immigration office.
I'm trying to convert my temporary residence permit into a permanent one.
Everything’s been prepared thoroughly, but I’m still nervous
Why was @Ledger not doing that?
🎉 proof.clavastack.com is LIVE
🥷Supply Chain Attacks are real! How can you make sure that your Bitcoin Hardware Wallet is safe?
🔒 Now you don't have to trust — you can verify. One photo proves your @SpecterDIY arrived untouched, anchored to the Bitcoin blockchain.
Looks likesome Ledger Hardware Wallets from Mediamarkt und Saturn are manipulated 🤯
“ACTUALIZACIÓN: Puedo confirmar que la cadena de suministro de Ledger también está comprometida en Europa. @Ledger debería iniciar un retiro inmediato de productos para proteger a los usuarios.
Acabo de comprar un segundo dispositivo en una ubicación diferente de Mediamarkt hoy, grabé el proceso de desempaquetado y descubrí spyware una vez más (video enlazado en el segundo tuit).
El dispositivo estaba comprometido de exactamente la misma manera, presentando modificaciones idénticas (como cables adicionales y un módulo LTE). Esto indica que se trata de un problema generalizado en lugar de un incidente aislado, que potencialmente afecta el inventario de Ledger en tiendas MediaMarkt y Saturn en toda Europa (que comprende más de 1.000 tiendas en 11 países).
Mi hipótesis inicial era que estos dispositivos eran devoluciones que parecían sin abrir a los empleados y simplemente se volvieron a vender como nuevos; sin embargo, un empleado de MediaMarkt confirmó que el dispositivo que compré no era una devolución, y que los Ledger devueltos se envían directamente de vuelta al fabricante en lugar de revenderse.
Los registros de la tienda muestran que el inventario se originó en Aqipa GmbH. Aunque el CTO de Ledger no estaba seguro de si Aqipa actúa como el distribuidor directo entre Ledger y MediaMarkt, parece que es el caso. Dado que Aqipa distribuye en toda Europa, cualquier tienda minorista física que reciba existencias a través de ellos podría estar en riesgo.
Envié el primer ledger a mark y el segundo está yendo a ledger ahora, para que puedan analizarlo.
Si compraste un ledger de alguien que no sea la tienda oficial de ledger, ¡asegúrate de revisar tu dispositivo!!” h/t @0xJohannes_
Schnuartz retweeted
Replying to @realcryptoboost
Please 🙄 .... can you just get a workshop or consultation with @Schnuartz from @ClavaStack on how to do multisig with Sparrow/Specter wallet and multiple different signers?
clavastack.com/products/bitc…
Schnuartz retweeted
On my way to check the @ledger at the nearest MediaMarkt 🇱🇺
Mediamarkt hat manipulierte Ledger Hardware Wallets verkauft!?💀
Inzwischen gibt es auch Berichte von manipulierten @Ledger-Geräten, die in Europa über Mediamarkt vertrieben worden sein sollen. 🚨
Eine offizielle Bestätigung steht noch aus, aber bei kürzlich über Resellern erworbenen Wallets sollte man jetzt besonders vorsichtig sein. ⚠️
Schnuartz retweeted
Ledger from European official reseller also found to have malicious hardware modification.
PSA the ledger incident isn't limited to Asia
This is a device purchased in store from an official reseller in Europe (a legitimate device doesn't have any of these cables as can be seen in picture 2)
This even seems to be an old version of the 'spy implant' even though the device was purchased a couple of weeks ago. The newer versions usually hide the implant by the screen so it's easier to miss
What's interesting is that this compromised ledger never transfered funds to an exploiter. Either the device didn't work or they were waiting for a more widespread usage of the comprised devices?
If you own a ledger that didn't directly come from the ledger online store make sure to not just rely on the software genuinely check by ledger but to actually open up the ledger yourself to make sure its original, again there are reported cases in Asia, south America and now Europe as well.
@MagicalTux made some useful videos on how to open the ledger and what to look for.
In the end, I was able to make a Specter Shield Lite Hardware Wallet Workshop in 2025.
8 Bitcoiners built one.
I will go to Paraguay again soon. And I'm really sad that I cannot do a workshop, as we are still developing Specter 2.

























