I'm wondering if connecting a hardware wallet like a Ledger Nano S to the Ledger Live desktop app running on a computer that's connected to the internet not considered a 'fully cold' wallet setup. How about installing/running the Ledger Live app inside a VM that has the networking components disabled? I know that there is a possibility that VMs can be breached or compromised but I'm thinking that the probability of accessing the private seed or spend key would be low to non-existent.

Has anyone have experiences or research data on this subject?

1 Answer 1


The host running a virtual machine has complete, unfettered access to its guest, there's no breaching or compromising necessary. It provides absolutely no additional security in your described situation. It is likely trivial to access ECDSA private key material even between two unrelated virtual machines on a single host due to sidechannel attacks.

  • So can a malicious process/malware on the host machine access the seed/private keys inside the Ledger Live desktop app running in the VM or for that matter the Ledger Nano S device connected to it? The Nano S device is connected to a USB port on the host machine so I'm guessing there's no getting around that?
    – ncruz
    Commented Jun 19, 2019 at 18:27
  • No matter what, the host can always read the entire memory of the virtual machine and edit its disk. For USB devices it has absolute control over them and can read the traffic.
    – Claris
    Commented Jun 19, 2019 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.