Curriculum·Freshman·F104
Wallet Architecture, Done Properly
April 2026. A fake Ledger Live application, published on the Mac App Store under the developer name Leva Heal Limited, an account not tied to Ledger, tricks users into entering their recovery phrase (BleepingComputer).
Lesson 1 opens on
The Ledger Connect Kit supply chain attack, December 2023
On 14 December 2023 an attacker took over the npm account of a former Ledger employee, reportedly using a stolen session token that bypassed two-factor authentication, on access rights that had never been revoked.7 of Ledger Connect Kit, a JavaScript library that decentralized applications embed in their front ends to talk to wallets.cash and Zapper, was served a wallet drainer.
The lessons
- F104-01The wallet taxonomyClassify any wallet on the three axes that matter, rather than by the name of the productabout 24 min · opens on The Ledger Connect Kit supply chain attack, December 2023
- F104-02The three-tier architectureDefine the three tiers by the job each one does and the loss each one is allowed to sustainabout 30 min · opens on Slope wallet, August 2022
- F104-03Hardware wallet setup, end to endEstablish provenance before opening the box, and state why tamper-evident packaging proves almost nothingabout 24 min · opens on The Ledger data breach and the counterfeit devices, 2020 to 2021
- F104-04Backup strategyDesign against theft and loss simultaneously, and name which of your choices trades one for the otherabout 31 min · opens on James Howells and the Newport landfill
- F104-05Recovery drillsState why an untested backup is a hypothesis, and name the four failures only a drill can detectabout 24 min · opens on The backup nobody tested
- F104-06Choosing your setupDistinguish a guarantee enforced by physics or mathematics from one enforced by a vendor's policyabout 25 min · opens on Ledger Recover, May 2023
- F104-07Seed provenance: where the randomness came fromExplain why a seed phrase is only as strong as the randomness that produced it, and why a valid checksum says nothing about thatabout 30 min · opens on Milk Sad, the Libbitcoin Explorer seed weakness, disclosed August 2023
- F104-08Air-gapped and connected signingDefine an air-gap as a reduction in channels, and list the channels a signing device still has when the cable is goneabout 31 min · opens on Dark Skippy, disclosed August 2024
- F104-09Signing offline: build, verify, broadcastDescribe the three stages of an offline signing flow and which machine performs eachabout 31 min · opens on The Bybit cold wallet theft, 21 February 2025
Labs
F104-L1
Build the three-tier architecture
Stand up vault, daily and burner tiers in the sandbox, on BSC testnet, funded from the faucet: three wallets, a send between tiers in each direction, and the one-page specification from F104-06 filled in for what you built. Doing the same on a chain that carries value, with small amounts, is optional enrichment and is done on your own devices; the platform never asks for it.
F104-L2
Factory-reset the daily wallet and restore from backup. If you cannot restore it, you do not pass Freshman year. The highest-value fifteen minutes in the program.