Is it possible that malicious bitcoin wallet providers provide pre-generated private-keys for users?

Question

We trust wallets like Ledger, Trezor, and etc. We believe the math that the randomly generated private keys are safe. But could it be possible that the private keys you thought are “generated” are actually provided and already stored in the database?

Imagine I am the cold wallet company, and I pre-generated like one trillion private keys secretly and saved them in my own database. For each wallet chip, I carefully choose 100 private keys and write them into the chip, and mark the keys in my database as used. When a user received the wallet and tries to generate a private key, the program in the chip just picks one of the 100 keys I wrote in. No one knows whether the keys are really generated or given by the wallet provider.

When I’ve already sold enough wallets, I can iterate all the used private keys and steal all my customs bitcoins.

That sounds practical and horrible. I am using a wallet but I cannot convince myself that my private key really belongs to me. Is that scenario possible? Is there any way to guarantee that the private key is not saved by others when the wallet is not open source?

Thank you.

Answer 1

You can verify the legitimacy of Coinkite's Coldcard key generation, assuming that you've used Coldcard's feature of generating the entropy for the seed words by throwing dice (the key generated will be based on your dice throws and so wasn't surreptitiously built into the card).

The web page https://coldcardwallet.com/docs/verifying-dice-roll-math gives details on how you can verify that the Coldcard honestly generated your seed words and key from your dice throws.

I should mention that I haven't actually carried out the verification, but it looks doable. (Just be sure that you never enter the dice throws, seed words, private keys, etc., on any Internet-connected device, and never attach the Coldcard itself to the Internet or to any Internet-connected device.)

Answer 2

In some cases you can generate your own 12 or 24-word seed phrase using open-source software on an isolated computer and use that phrase in the hardware devices recovery mode.

For example

The recovery phrase to restore private keys from. BIP39/BIP44 recovery phrases are supported.

You should also, with some work, be able to independently verify that transactions generated by the device are indeed using public keys derived from that seed phrase.

In wouldn't characterise this as easy but it seems feasible to me.

Answer 3

One of the main points of cryptocurrencies is that you should not under any circumstances be able to calculate some else’s private keys.

Your only way to get it would be to find the sender and probably threaten them with bodily harm until they give it to you. Or find some security weakness that allows you to access their computer and steal the key from them, hoping that it’s not encrypted.