Malicious Insider Key Theft

In a typical customer setup, Casa provides all the hardware wallets (we are an authorized reseller of both Trezor and Ledger). The Casa app is downloaded directly from either the Apple iOS App Store or Google Play Store. If an insider attacker got a customer to install a malicious version of the app and provided the customer with malicious hardware devices, it would be possible for an insider to steal the user’s keys.

Mitigation:

• Casa is an authorized reseller of both Trezor and Ledger, so the devices we provide come directly from the manufacturer.

• Casa supports the use of hardware wallets obtained directly from manufacturer or from other authorized hardware wallet retailers.