{ "name": "Hardware Wallet Security Incidents", "source": "https://bitcoinerreviews.com/security-incidents", "license": "CC BY 4.0 (credit Bitcoiner Reviews with a link)", "updated": "2026-10-30", "count": 309, "incidents": [ { "id": "trezor-2026-10-implant-reported-in-a-trezor-safe-5-sold", "date": "2026-10-30", "company": "Trezor", "wallets": [ "trezor-safe-5" ], "title": "Implant reported in a Trezor Safe 5 sold by reseller CryptoBilis", "summary": "Trezor's security team received a responsible disclosure report on October 28, 2026 of a single hardware implant in a Trezor Safe 5 bought from the reseller CryptoBilis in August 2026. Trezor has not yet examined the device but is treating the report as credible, and no CryptoBilis buyer has reported a loss of funds. Buyers who purchased from CryptoBilis since March 2026 are told to move funds to a new wallet with a new seed.", "severity": "major", "type": "supply-chain", "sourceUrl": "https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis", "sourceName": "Trezor Blog" }, { "id": "foundation-2026-10-envoy-seed-qr-screenshot", "date": "2026-10-28", "company": "Foundation", "wallets": [], "title": "Envoy dropped screenshot protection when switching to the seed QR code", "summary": "Envoy 2.3.7 fixed screenshot protection so it stays on when the user switches from the seed words back to the seed QR code. The release also moved the Passport Prime security check to a new onion address as a precaution.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/Foundation-Devices/envoy/releases/tag/v2.3.7", "sourceName": "Foundation: Envoy v2.3.7 release notes" }, { "id": "satochip-2026-10-satochip-utils-secrets-in-logs", "date": "2026-10-27", "company": "Satochip", "wallets": [], "title": "Satochip-Utils 0.4.1 stopped writing SeedKeeper secrets to logs", "summary": "Satochip-Utils, the desktop app for Satochip, SeedKeeper, Satodime and Satocash cards, wrote SeedKeeper secret values and Satocash token proofs to its logs. Version 0.4.1 stopped logging them and now clears copied clipboard data after 30 seconds.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/Toporin/Satochip-Utils/releases/tag/v0.4.1", "sourceName": "Satochip (GitHub release): Satochip-Utils v0.4.1" }, { "id": "foundation-2026-10-phishing", "date": "2026-10-25", "company": "Foundation", "wallets": [ "foundation-passport" ], "title": "Phishing emails sent from Foundation's own domains", "summary": "Attackers used compromised Cloudflare API keys to send more than 23,000 phishing attempts that appeared to come from Foundation. Customer details from old order tables and recent Shopify orders sat in systems the attackers could reach. Foundation found no evidence that Passport devices or their keys were compromised.", "severity": "major", "type": "phishing", "sourceUrl": "https://x.com/FoundationHQ/status/2114564656199069844", "sourceName": "Foundation" }, { "id": "electrum-2026-10-malicious-server-rbf", "date": "2026-10-24", "company": "Electrum", "wallets": [], "title": "Malicious Electrum servers swapped broadcast transactions to steal fee bumps", "summary": "A malicious server could hide a user's broadcast transaction and show a forged one paying the attacker; if the user fee-bumped it, Electrum signed a real payment to the attacker. Electrum said some servers ran the attack in the wild and one user lost money. Version 4.8.3 fixed it (CVE-2026-117601); people using their own server were not affected.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v", "sourceName": "Electrum security advisory GHSA-6jp4-8v48-cc5v" }, { "id": "keystone-2026-10-website-breach", "date": "2026-10-20", "company": "Keystone", "wallets": [ "keystone-3-pro", "keystone-essential" ], "title": "Website breach exposed buyer data and the device authentication key", "summary": "An attacker got into Keystone's website through a third-party data monitoring tool and took 25,964 buyer records, 12,873 unpaid checkout records, and the key Keystone uses to prove a device is genuine. That key is set at the factory and can't be changed on existing devices. Keystone is destroying 18,835 unsold devices and says seed phrases and private keys were not exposed.", "severity": "critical", "type": "data-breach", "sourceUrl": "https://x.com/KeystoneWallet/status/2114054080754770137", "sourceName": "Keystone" }, { "id": "seedsigner-2026-10-psbt-fee-display", "date": "2026-10-20", "company": "SeedSigner", "wallets": [ "seedsigner" ], "title": "SeedSigner showed fees without verifying PSBT input amounts", "summary": "SeedSigner displayed the transaction fee without checking the input amounts in the PSBT, so a malicious coordinator could inflate an input and hide a large fee paid to miners. The merged fix verifies each input against its previous transaction and discards PSBTs whose amounts cannot be proven.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/SeedSigner/seedsigner/pull/995", "sourceName": "SeedSigner GitHub: Verify PSBT input amounts before displaying the fee" }, { "id": "secux-2026-10-app-banner-phishing", "date": "2026-10-19", "company": "SecuX", "wallets": [], "title": "Hacked SecuX app banner pointed users to seed phishing sites", "summary": "SecuX said attackers modified the banner inside the SecuX App to point users to fake SecuX websites. The sites claimed wallets were affected by critical security vulnerabilities and asked for the seed phrase. SecuX told users never to enter their seed phrase anywhere.", "severity": "major", "type": "phishing", "sourceUrl": "https://secuxtech.com/blogs/blog/security-alert-beware-of-fake-secux-websites", "sourceName": "SecuX" }, { "id": "ngrave-2026-10-liquid-alert", "date": "2026-10-17", "company": "NGRAVE", "wallets": [ "ngrave-zero" ], "title": "Fake security alert in the LIQUID app phished seed phrases", "summary": "Attackers took over the push-notification provider for NGRAVE's LIQUID app and sent a fake alert linking to a page that asked for the seed phrase. NGRAVE traced at least $2.56 million stolen from about 70 addresses, including about $1.77 million in bitcoin. NGRAVE says no ZERO device was breached.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october", "sourceName": "NGRAVE" }, { "id": "keepkey-2026-10-firmware-7-14-2-signing-fixes", "date": "2026-10-16", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "KeepKey 7.14.2 security release aligns on-screen approvals with signing", "summary": "KeepKey firmware 7.14.2 was released as a security release so that what the device asks the user to approve matches what it signs. It fixes display of messages, amounts, fees and chain IDs, and puts blind-signing paths behind Advanced Mode.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/keepkey/keepkey-firmware/releases/tag/v7.14.2", "sourceName": "KeepKey firmware release notes (GitHub)" }, { "id": "satochip-2026-10-applet-security-review-fixes", "date": "2026-10-16", "company": "Satochip", "wallets": [], "title": "Satochip applet v0.16 fixed 2FA bypass and taproot flaws after code review", "summary": "A security code review of the Satochip applet led to fixes for a 2FA bypass in MuSig2 signing, a non-compliant taproot tweak that did not bind to the internal key, and missing checks against invalid-curve attacks. The fixes shipped in applet v0.16-0.1 with breaking changes for client software.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/Toporin/SatochipApplet/releases/tag/v0.16-0.1", "sourceName": "Satochip (GitHub release)" }, { "id": "satochip-2026-10-pysatochip-secrets-in-logs", "date": "2026-10-15", "company": "Satochip", "wallets": [], "title": "pysatochip 0.18.5 stopped printing private keys and logging seed phrases", "summary": "pysatochip, the Python library that desktop wallets use to talk to Satochip and SeedKeeper cards, printed a raw private key on import and logged SeedKeeper master seeds and mnemonics. Version 0.18.5 removed 12 print() calls, masked sensitive APDU logging, and fixed checks that let a card skip signature verification or set up a secure channel after an error status.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/Toporin/pysatochip/blob/master/CHANGELOG.md", "sourceName": "Satochip (GitHub): pysatochip CHANGELOG" }, { "id": "onekey-2026-10-onekey-ended-reseller-cryptobilis-and-of", "date": "2026-10-12", "company": "OneKey", "wallets": [ "onekey" ], "title": "OneKey ended reseller CryptoBilis and offered free device replacements", "summary": "After Ledger confirmed implanted hardware in devices sold by the reseller CryptoBilis, OneKey ended CryptoBilis's authorization and stopped adding new resellers. OneKey says it has no reports of its users losing assets. Anyone who bought a OneKey device from CryptoBilis between March 1, 2026 and the statement date can request a free replacement by December 31, 2026, and OneKey advises moving assets to a new recovery phrase.", "severity": "minor", "type": "supply-chain", "sourceUrl": "https://onekey.so/blog/en/updates/cryptobilis-incident-free-onekey-replacement-and-reseller-review/", "sourceName": "OneKey blog" }, { "id": "coinkite-2026-10-x-account-phishing", "date": "2026-10-11", "company": "Coinkite", "wallets": [], "title": "Phishing link posted on Coldcard's official X account", "summary": "A fake security warning appeared on Coldcard's official X account around 02:00 UTC on October 11, 2026, claiming a seed-generation problem and linking to migrate.coldcardwallet.io. Coldcard's internal review found no unauthorized access or logins, and it asked X to investigate how the post was made.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.tradingview.com/news/cryptobriefing:47f3e8e9a094b:0-coldcard-investigates-phishing-link-posted-on-its-x-account-after-exploit/", "sourceName": "Crypto Briefing (via TradingView)" }, { "id": "krux-2026-10-kef-gcm-overflow", "date": "2026-10-03", "company": "Krux", "wallets": [ "krux" ], "title": "Krux KEF encryption had a 12-byte buffer overflow", "summary": "An anonymous researcher reported a 12-byte buffer overflow during AES-GCM encryption and decryption for Krux's KEF format. The maintainer judged it not practically exploitable, fixed it in 26.09.0, and said existing KEF envelopes need no change.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/selfcustody/krux/releases/tag/v26.09.0", "sourceName": "Krux v26.09.0 release notes" }, { "id": "bitkey-2026-10-mobile-pay-cache-race", "date": "2026-10-03", "company": "Bitkey", "wallets": [ "bitkey" ], "title": "Bitkey Mobile Pay race could skip the daily spending limit", "summary": "A race in Mobile Pay could cache a signed transaction before its daily-spend record was saved, so retries might broadcast without counting against the daily allowance. Block fixed it on the server and reported no customer impact.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bitkey.world/security-updates", "sourceName": "Bitkey security updates" }, { "id": "bitkey-2026-10-nfc-pin-preonboarding", "date": "2026-10-02", "company": "Bitkey", "wallets": [ "bitkey" ], "title": "Attacker near a new Bitkey could set a PIN over NFC before setup", "summary": "Before onboarding, an attacker with an NFC radio close to a Bitkey could enable an unreleased PIN feature and set a PIN that might later unlock the device. This alone could not access funds. Production builds no longer allow unlocking by PIN.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://bitkey.world/security-updates", "sourceName": "Bitkey security updates" }, { "id": "ledger-2026-10-implants", "date": "2026-10", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus", "ledger-stax", "ledger-flex", "ledger-nano-gen5" ], "title": "Implanted Ledger devices sold through a reseller", "summary": "Ledger confirmed a hardware implant attack on genuine devices sold through a third-party distribution channel and says it found no flaw in its own chip, operating system, or servers. CoinDesk reported the reseller and on-chain estimates of up to $93.2 million lost, a figure Ledger has not verified.", "severity": "critical", "type": "supply-chain", "sourceUrl": "https://www.ledger.com/blog-response-hardware-implant-attack", "sourceName": "Ledger" }, { "id": "coinkite-2026-09-q-seed-replacement", "date": "2026-09-30", "company": "Coinkite", "wallets": [], "title": "Coldcard Q scan flow could replace the master seed unintentionally", "summary": "Coldcard Q firmware 1.5.3Q fixed a bug where scanning seed words or an extended private key from the Ready To Sign or Key Teleport retry screen could replace the master seed. The release also hardened PSBTv2 parsing.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.md", "sourceName": "Coinkite: COLDCARD firmware change log" }, { "id": "trezor-2026-09-trezor-t-bootloader-firmware-update-retry", "date": "2026-09-29", "company": "Trezor", "wallets": [], "title": "Bootloader update retry could skip firmware header checks in unreleased code", "summary": "A researcher found that during a firmware update the bootloader could be made to install firmware other than the one it had checked. Trezor says the flaw affected only unreleased code and was fixed before release.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/trezor-t-bootloader-firmware-update-retry-could-skip-header-checks", "sourceName": "Trezor Security Portal" }, { "id": "seedsigner-2026-09-fake-change-psbt", "date": "2026-09-19", "company": "SeedSigner", "wallets": [ "seedsigner" ], "title": "SeedSigner change checks could be fooled by forged PSBT key data", "summary": "SeedSigner relied on the coordinator's derivation claims when deciding which outputs were change, so a malicious coordinator could dress up an attacker's output as change. In one multisig test case the v0.8.7 release showed 10,000 sats coming back to the user while the money went elsewhere. The fix rebuilds each claimed change script from the seed and rejects PSBTs whose claims contradict it.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/SeedSigner/seedsigner/pull/1032", "sourceName": "SeedSigner GitHub: [security] Verify that change outputs actually pay this seed" }, { "id": "dcent-2026-09-app-wallet", "date": "2026-09-16", "company": "D'CENT", "wallets": [ "dcent" ], "title": "D'CENT App Wallet drained", "summary": "Attackers drained wallets in the D'CENT App Wallet, the software wallet in the same phone app used with the Biometric device. D'CENT says a hardware wallet is exposed too if its seed phrase was ever entered into the App Wallet, and told affected users to move funds to a new seed phrase.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://store.dcentwallet.com/blogs/post/app-wallet-incident-report", "sourceName": "D'CENT" }, { "id": "satochip-2026-09-pysatochip-ecdsa-timing-leak", "date": "2026-09-11", "company": "Satochip", "wallets": [], "title": "pysatochip 0.18.0 dropped an ecdsa library with a timing leak (CVE-2024-23342)", "summary": "pysatochip depended on the pure-Python ecdsa package, which is affected by CVE-2024-23342: its private-key operations, including ECDSA signing and ECDH key exchange, leak information through timing. Version 0.18.0 removed the dependency and moved private-key operations to a side-channel-hardened backend.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/Toporin/pysatochip/blob/master/CHANGELOG.md", "sourceName": "Satochip (GitHub): pysatochip CHANGELOG" }, { "id": "bitbox-2026-09-brevo", "date": "2026-09-10", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "Newsletter list exposed and phishing sent through Brevo", "summary": "Attackers used a login flaw at Brevo, BitBox's newsletter provider, to send two phishing emails from the BitBox account and download the subscriber list. Only email addresses were exposed. BitBox says its shop, app, and devices were not affected.", "severity": "minor", "type": "data-breach", "sourceUrl": "https://blog.bitbox.swiss/en/email-address-exposure-at-newsletter-provider-brevo/", "sourceName": "BitBox" }, { "id": "trezor-2026-09-brevo", "date": "2026-09-10", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Phishing email sent from Trezor's newsletter account", "summary": "An attacker got into Brevo, Trezor's newsletter provider, and sent a fake security alert from Trezor's account that pushed an app asking for the wallet backup. Brevo confirmed 347,149 newsletter email addresses were exported. Trezor took the phishing domain down within 20 minutes.", "severity": "major", "type": "phishing", "sourceUrl": "https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider", "sourceName": "Trezor" }, { "id": "blockstream-2026-09-liquid-incident-impersonation-phishing", "date": "2026-09-09", "company": "Blockstream", "wallets": [ "jade" ], "title": "Impersonators used the Liquid incident to push fake updates and seed requests", "summary": "After the September 2026 Liquid Network incident, impersonators posed as Liquid, Blockstream, and support staff through emails, lookalike sites, and DMs. Lures included fake security update portals, emails claiming to contain firmware, and requests to move coins to a recovery address. Blockstream said Jade firmware is only installed through its official app or firmware pages.", "severity": "minor", "type": "phishing", "sourceUrl": "https://blog.blockstream.com/phishing-alert-do-not-act-on-unsolicited-liquid-or-blockstream-messages/", "sourceName": "Blockstream blog: Phishing Alert: Do Not Act on Unsolicited Liquid or Blockstream Messages" }, { "id": "alby-2026-09-hub-management-api", "date": "2026-09-09", "company": "Alby", "wallets": [], "title": "Alby Hub flaw let attackers send funds from publicly exposed Hubs", "summary": "Alby disclosed what it called a critical vulnerability in Alby Hub v1.7.0 to v1.18.5: an attacker who could reach a publicly exposed Hub's management API could gain access and send funds. Alby said one user was affected. Versions 1.19.0 and later are not affected.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://x.com/getAlby/status/2097574956049498150", "sourceName": "Alby on X: Important: Update your Alby Hub" }, { "id": "specter-2026-09-diy-trng-change", "date": "2026-09-06", "company": "Specter", "wallets": [ "specter-diy" ], "title": "Specter-DIY hardened RNG and change detection in v1.10.5", "summary": "Specter-DIY firmware v1.10.5 rejects dead hardware RNG output instead of using it, and now treats an output as change only after verifying it derives from the wallet descriptor.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/cryptoadvance/specter-diy/releases/tag/v1.10.5", "sourceName": "Specter-DIY v1.10.5 release notes" }, { "id": "foundation-2026-09-keyos-multisig-change", "date": "2026-09-04", "company": "Foundation", "wallets": [ "foundation-passport" ], "title": "Passport Prime multisig change checks could be fooled by malicious PSBTs", "summary": "KeyOS 1.4.0 fixed bugs where Passport Prime could label attacker-controlled multisig scripts or outputs as change, and where repeated cosigner keys could silently lower the signing threshold. Foundation called the release an important security update for all Passport Prime users.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/Foundation-Devices/KeyOS/releases/tag/v1.4.0", "sourceName": "Foundation: KeyOS v1.4.0 release notes" }, { "id": "coinkite-2026-09-q-psram-oob", "date": "2026-09-03", "company": "Coinkite", "wallets": [], "title": "Coldcard Q 1.5.2Q fixed PSRAM out-of-bounds access from a USB host", "summary": "Coldcard Q firmware 1.5.2Q fixed an integer underflow in virtual-disk file handling that allowed out-of-bounds PSRAM writes, reads, and mappings from a compromised USB host. The same release made the device abort signing if a Virtual Disk firmware import overwrote the reviewed PSBT.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/Coldcard/firmware/blob/master/releases/History-Q.md", "sourceName": "Coinkite: COLDCARD Q firmware release history" }, { "id": "ledger-2026-08-lsb023-command-interleaving", "date": "2026-08-27", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus", "ledger-stax", "ledger-flex", "ledger-nano-gen5" ], "title": "SDK let host change signing data during on-screen review (LSB 023)", "summary": "A regression in the Ledger Secure SDK introduced in August 2025 let a host send a new command while a review was pending, so an app could display one set of parameters and sign different ones. Ledger hardened apps and fixed the SDK in v26.6.1, and said it had no evidence of exploitation.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/023/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2026-08-lsb024-eth-array-truncation", "date": "2026-08-27", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus", "ledger-stax", "ledger-flex", "ledger-nano-gen5" ], "title": "Ethereum app showed one of 257 operations it signed (LSB 024)", "summary": "The Ethereum app stored a 16-bit array count in an 8-bit field, so for an array of 257 elements the device reviewed only one entry while the signature authorized all of them. Bitfinding reported it, and Ethereum app 1.22.3 fixed it.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/024/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2026-08-lsb025-swap-approval", "date": "2026-08-27", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus", "ledger-stax", "ledger-flex", "ledger-nano-gen5" ], "title": "Swap flow signed a token approval instead of a payment (LSB 025)", "summary": "In swaps, the Ethereum app checked the address and quantity but not the operation type, so a token approval could be signed without being displayed. The permission could only go to the swap provider's deposit address for the accepted amount, and Ethereum app 1.22.3 fixed it.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/025/", "sourceName": "Ledger Donjon" }, { "id": "blockstream-2026-08-jade-1041-security-fixes", "date": "2026-08-25", "company": "Blockstream", "wallets": [ "jade", "jade-plus", "jade-core" ], "title": "Jade 1.0.41 fixed multiple externally reported issues", "summary": "Jade firmware 1.0.41 fixed a number of reported issues, many surfaced by AI-assisted code scanning, and raised stack protection and memory clearing. Blockstream said the release did not warrant an urgent upgrade notice and that less serious reports would be handled in 1.0.42, while the 1.0.41 changelog says all users should upgrade as soon as possible.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.blockstream.com/reflections-on-the-coldcard-fallout/", "sourceName": "Blockstream blog: Reflections on the Coldcard Fallout from the Jade Team" }, { "id": "coinkite-2026-08-callgate-bounds", "date": "2026-08-20", "company": "Coinkite", "wallets": [], "title": "Coldcard callgate range checks hardened after Karma-X review", "summary": "A public Karma-X review raised a callgate-bounds concern in Mk4 and Q firmware. Coinkite changed the range checks to validate the full caller-provided span and avoid address-plus-length wraparound, shipping the change in 5.6.1 and 1.5.1Q.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "coinkite-2026-08-rng-seed-error", "date": "2026-08-20", "company": "Coinkite", "wallets": [], "title": "Coldcard RNG could stay unavailable after a transient seed error", "summary": "After the July seed-generation hotfix, a public report showed a transient STM32 seed error could leave the RNG unavailable for the rest of the boot session. Firmware 5.6.1 and 1.5.1Q added bounded retry and fail-closed handling. No field occurrence was established.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "coinkite-2026-08-sighash-single", "date": "2026-08-20", "company": "Coinkite", "wallets": [], "title": "Coldcard now blocks SIGHASH_SINGLE signing by default", "summary": "Coldcard firmware 5.6.1 and 1.5.1Q block SIGHASH_SINGLE signing by default because later outputs may remain modifiable, and separate the SE1 check nonce from the PIN digest. Both changes were credited to @instagibbs.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "coinkite-2026-08-bip322-text-validation", "date": "2026-08-20", "company": "Coinkite", "wallets": [], "title": "Coldcard BIP-322 message signing skipped text-safety checks", "summary": "Coldcard's BIP-322 message signing did not apply its existing text-safety checks before approval. Firmware 5.6.1 and 1.5.1Q now apply them and reject unsupported message content.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "coinkite-2026-08-four-input-validation-reports", "date": "2026-08-20", "company": "Coinkite", "wallets": [], "title": "Four privately reported Coldcard input-validation flaws fixed", "summary": "Researcher @drk1wi privately reported four issues: USB access to staged PSRAM data, duplicate or device-owned keys in multisig enrollment, held keys counted as multiple dice rolls, and malformed BBQr scans on the Q returning stale memory bytes. Fixes shipped in firmware 5.6.1 and 1.5.1Q.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "coinkite-2026-08-staged-psbt-substitution", "date": "2026-08-20", "company": "Coinkite", "wallets": [], "title": "Compromised USB host could swap a Coldcard PSBT after review", "summary": "A compromised USB host could rewrite a PSBT in staged memory after the user reviewed it but before Coldcard signed it. Firmware 5.6.1 and 1.5.1Q re-verify the staged bytes and abort if they changed. FreeZ Agent reported the issue with a proof of concept.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "coinkite-2026-08-base58check-oob-read", "date": "2026-08-20", "company": "Coinkite", "wallets": [], "title": "Coldcard Base58Check decoder could read out of bounds", "summary": "Malformed, overlong Base58Check input could cause an out-of-bounds read in the libngu decoder before checksum validation. The reporter rated it low severity and claimed no write or code execution. The bound check shipped in firmware 5.6.1 and 1.5.1Q.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "safepal-2026-08-order-data", "date": "2026-08-16", "company": "SafePal", "wallets": [ "safepal-s1" ], "title": "Order-tracking plug-in exposed 39,798 customers", "summary": "A flaw in an order-tracking plug-in exposed order data for 39,798 customers who ordered between March 2, 2025 and April 11, 2026. SafePal emailed affected customers on August 16, 2026.", "severity": "major", "type": "data-breach", "sourceUrl": "https://www.safepal.com/en/blog/security-update", "sourceName": "SafePal" }, { "id": "trezor-2026-08-authenticity", "date": "2026-08-16", "company": "Trezor", "wallets": [ "trezor-safe-7" ], "title": "Safe 7 authenticity proofs not bound to each secure element", "summary": "A researcher found that the Safe 7's authenticity checks weren't tied to each secure element separately. Trezor fixed it and paid a bug bounty.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/authenticity-proofs-not-bounded-to-their-secure-element", "sourceName": "Trezor" }, { "id": "trezor-2026-08-monero-payment-id-could-be-signed", "date": "2026-08-13", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Monero payment ID could be signed without being shown on the device", "summary": "In some Monero transactions the device could sign a payment ID without displaying it. Trezor fixed this in firmware 2.13.0.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/monero-payment-id-could-be-signed-without-being-shown", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-08-shipmonk-data-breach", "date": "2026-08-13", "company": "Trezor", "wallets": [], "title": "Shipping provider ShipMonk breach exposed 80,689 customers", "summary": "ShipMonk, a Trezor fulfillment partner, told Trezor on August 10, 2026 that its systems had been breached. Trezor first reported 11,742 customers with full exposure of name, email, phone number and shipping address, then said on September 4, 2026 that about 67,000 more US customers from 2019 to 2021 orders were exposed, for 80,689 affected in total.", "severity": "major", "type": "data-breach", "sourceUrl": "https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident", "sourceName": "Trezor Blog" }, { "id": "trezor-2026-08-missing-bounds-check-in-jpeg-image", "date": "2026-08-12", "company": "Trezor", "wallets": [], "title": "Missing bounds check in JPEG image decoding", "summary": "A crafted JPEG image could make the device image decoder attempt to write past its buffer. The write failed and the device crashed, so no memory was corrupted. Fixed in firmware 2.13.0.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/missing-bounds-check-in-jpeg-image-decoding", "sourceName": "Trezor Security Portal" }, { "id": "bitkey-2026-08-delay-notify-endpoint", "date": "2026-08-11", "company": "Bitkey", "wallets": [ "bitkey" ], "title": "Bitkey test endpoint could shorten another account's Delay & Notify", "summary": "A test-account-only endpoint could be used to shorten the review period of another account's Delay & Notify window. Block reviewed every privileged action in production and found all still carried the full seven-day window.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bitkey.world/security-updates", "sourceName": "Bitkey security updates" }, { "id": "bitkey-2026-08-tokens-in-telemetry", "date": "2026-08-11", "company": "Bitkey", "wallets": [ "bitkey" ], "title": "Bitkey app bearer tokens were recorded in internal logging tools", "summary": "Short-lived mobile app bearer tokens could be recorded in Bitkey's observability tools. The tokens could not change security settings or reach spending keys, and Block found no reuse of any logged token.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bitkey.world/security-updates", "sourceName": "Bitkey security updates" }, { "id": "bitkey-2026-08-release-automation-key", "date": "2026-08-11", "company": "Bitkey", "wallets": [], "title": "Bitkey release automation secret was reachable from repository workflows", "summary": "Bitkey release automation workflows could have been altered by someone with write access to the repository. Block found no evidence the automation secret was exposed and removed the affected GitHub App integration.", "severity": "minor", "type": "supply-chain", "sourceUrl": "https://bitkey.world/security-updates", "sourceName": "Bitkey security updates" }, { "id": "bitkey-2026-08-atlantis-auth", "date": "2026-08-11", "company": "Bitkey", "wallets": [], "title": "Bitkey internal infrastructure service had overly broad sign-in exceptions", "summary": "An internal service used to review and apply infrastructure changes had broader sign-in exceptions than intended, so unauthenticated requests could reach it and possibly expose status and version information. Block found no evidence of exploitation.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bitkey.world/security-updates", "sourceName": "Bitkey security updates" }, { "id": "foundation-2026-08-envoy-passphrase-activity-leak", "date": "2026-08-11", "company": "Foundation", "wallets": [ "foundation-passport" ], "title": "Envoy showed passphrase account transactions while the passphrase was inactive", "summary": "Envoy 2.3.1 fixed a privacy bug where transactions from passphrase-protected accounts could appear in the global Activity feed while the passphrase was not active. The feed now hides them until the passphrase is entered.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/Foundation-Devices/envoy/releases/tag/2.3.1", "sourceName": "Foundation: Envoy 2.3.1 release notes" }, { "id": "specter-2026-08-desktop-hwi-bridge-auth", "date": "2026-08-09", "company": "Specter", "wallets": [], "title": "Specter Desktop HWI bridge settings lacked login and CSRF protection", "summary": "A community security audit flagged a high-priority issue with Specter Desktop's HWI bridge configuration. The fix requires an admin login and CSRF protection before the HWI bridge whitelist settings can be viewed or changed.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/cryptoadvance/specter-desktop/pull/2679", "sourceName": "Specter Desktop GitHub: Protect HWI bridge settings with auth and CSRF" }, { "id": "trezor-2026-08-stellar-signer-weight-not-shown-when", "date": "2026-08-08", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Stellar signer weight not shown when adding a signer", "summary": "When adding a signer to a Stellar account, the device did not show the signer weight, so a malicious host could grant more authority than intended. Fixed in firmware 2.12.5.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/stellar-signer-weight-not-shown-when-adding-a-signer", "sourceName": "Trezor Security Portal" }, { "id": "coinkite-2026-08-fake-audit-phishing", "date": "2026-08-05", "company": "Coinkite", "wallets": [], "title": "Fake COLDCARD security audit emails installed remote access software", "summary": "Proofpoint found phishing emails impersonating COLDCARD that claimed a hardware security audit was underway after the seed-generation theft. The emails came from compliance@coldcardteamnews.com and linked to coldcardcompliance.com, where a fake diagnostic tool installed ScreenConnect remote access software.", "severity": "minor", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-attack-installs-remote-access-tool/", "sourceName": "BleepingComputer" }, { "id": "zeus-2026-08-infrastructure-breach", "date": "2026-08-05", "company": "Zeus", "wallets": [], "title": "Attacker breached Zeus infrastructure through a BTCPay Server flaw", "summary": "An attacker used a BTCPay Server vulnerability to take the admin credential for a connected LND node, stole funds from Zeus's own operational wallets, and force-closed most of its public and many private LSP channels. Zeus said no customer funds were lost, replaced affected channels at no cost, and switched off Zaplocker during its security review.", "severity": "major", "type": "data-breach", "sourceUrl": "https://zeusln.com/blog/post-mortem-security-update-august-5th-2026/", "sourceName": "Zeus blog: Post-Mortem: Security Update - August 5th, 2026" }, { "id": "trezor-2026-08-solana-token-transfer-displays-the-address", "date": "2026-08-04", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana token transfer could show the wrong token address", "summary": "In some Solana token transfers the device could show an incorrect token address on the confirmation screen. Fixed in firmware 2.12.5.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-token-transfer-displays-the-address-lookup-table-account-instead-of-the-token-mint", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-08-solana-stake-lockup-settings-not-shown", "date": "2026-08-04", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana stake lockup settings not shown when staking", "summary": "When staking SOL, some stake account settings were not shown on the device, which could cause the user to lose access to staked SOL. Fixed in firmware 2.12.5.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-stake-lockup-settings-not-shown-when-staking", "sourceName": "Trezor Security Portal" }, { "id": "krux-2026-08-entropy-overflow-psbt-fee", "date": "2026-08-04", "company": "Krux", "wallets": [ "krux" ], "title": "Krux fixed camera entropy overflow and PSBT fee display checks", "summary": "Krux 26.08.0 fixed a heap buffer overflow in the camera entropy module that only the discontinued Maix Bit could trigger, and tightened PSBT fee checks so the fee shown on screen is verified.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/selfcustody/krux/releases/tag/v26.08.0", "sourceName": "Krux v26.08.0 release notes" }, { "id": "trezor-2026-08-trezor-model-one-advanced-recovery-requirement", "date": "2026-08-02", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Model One advanced recovery requirement could be bypassed", "summary": "A host could get around the Model One requirement to use advanced recovery for 12- and 18-word backups, undoing an earlier recovery mitigation. Fixed in firmware 1.14.2.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/trezor-model-one-advanced-recovery-requirement-could-be-bypassed", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-08-ethereum-1inch-swap-minimum-output-not", "date": "2026-08-01", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Ethereum 1inch swap minimum output not shown on the device", "summary": "For some 1inch swaps the device did not show the minimum amount the user would receive, so a malicious host could weaken slippage protection. Fixed in firmware 2.12.5.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/ethereum-1inch-swap-minimum-output-not-shown-on-the-device", "sourceName": "Trezor Security Portal" }, { "id": "bitkey-2026-08-inheritance-claim-delay", "date": "2026-08-01", "company": "Bitkey", "wallets": [ "bitkey" ], "title": "Bitkey inheritance claim delay could be shortened with a modified app", "summary": "Bitkey's internal team fixed a bug where a beneficiary using a modified app and a separate test-account relationship could shorten an inheritance claim's delay period. Block verified that no claim ever advanced before its intended delay window.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bitkey.world/security-updates", "sourceName": "Bitkey security updates" }, { "id": "bitkey-2026-08-enrollment-secret-randomness", "date": "2026-08-01", "company": "Bitkey", "wallets": [ "bitkey" ], "title": "Bitkey enrollment secrets used non-cryptographic randomness", "summary": "A researcher reported that the Bitkey app generated recovery contact and inheritance enrollment secrets with a general-purpose random number generator. Exploiting it required extensive access to Block's infrastructure during a live enrollment, and the affected value was not a private key. Block found no evidence any customer was exploited.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bitkey.world/blog/relationship-enrollment-bug-in-bitkey", "sourceName": "Bitkey blog: Relationship-enrollment bug in Bitkey" }, { "id": "bitbox-2026-08-dixence", "date": "2026-08", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "Silent payments and memory corruption flaws fixed in 9.26.5", "summary": "Firmware 9.26.5 fixed a flaw that could lock silent payment funds to an unintended address and a memory corruption bug in the Multi edition only. No funds were stolen.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.bitbox.swiss/en/bitbox-08-2026-dixence-update/", "sourceName": "BitBox" }, { "id": "coldcard-2026-07-seed-drain", "date": "2026-07-30", "company": "Coinkite", "wallets": [], "title": "Coldcard seed-generation flaw drained at least 1,778 BTC", "summary": "An attacker drained funds from wallets whose seeds came from a seed-generation flaw in Coldcard firmware. Galaxy Research counts at least 1,778 BTC taken from more than 8,600 addresses. Coinkite has patched the flaw.", "severity": "critical", "type": "device-flaw", "sourceUrl": "https://www.galaxy.com/insights/research/coldcard-exploit-abates-as-total-losses-climb-to-at-least-1700-btc", "sourceName": "Galaxy Research" }, { "id": "imkey-2026-07-counterfeit-devices-fake-app", "date": "2026-07-30", "company": "imKey", "wallets": [], "title": "Counterfeit imKey devices paired with a fake app stole seed phrases", "summary": "imKey confirmed user reports of counterfeit hardware wallets sold with manuals whose QR codes led to a fake app. Victims created or recovered a wallet inside the attackers' setup, which let the attackers steal the seed phrase and move the funds. imKey said none of the stores selling imKey devices on JD.com are authorized.", "severity": "major", "type": "supply-chain", "sourceUrl": "https://support.imkey.im/hc/en-001/articles/60601101048217-Security-Alert-Beware-of-Scams-Involving-Counterfeit-Hardware-Wallets-and-Fake-Apps", "sourceName": "imKey Support: Security Alert: Beware of Scams Involving Counterfeit Hardware Wallets and Fake Apps" }, { "id": "trezor-2026-07-ethereum-calldata-tail-unconfirmed", "date": "2026-07-21", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Safe devices confirmed only the first Ethereum calldata chunk (CVE-2026-65058)", "summary": "For Ethereum contract interactions, Trezor Safe 3, Safe 5 and Safe 7 firmware showed only the first chunk of calldata while the signature covered all of it. An attacker could show a victim one calldata and then swap in a different tail, changing the signed transaction.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-65058", "sourceName": "NVD" }, { "id": "foundation-2026-07-keyos-130-audit-fixes", "date": "2026-07-17", "company": "Foundation", "wallets": [ "foundation-passport" ], "title": "KeyOS 1.3.0 fixed a lock screen bypass and encryption flaws found in an audit", "summary": "KeyOS 1.3.0 for Passport Prime shipped a hardening pass driven by a third-party security audit. It fixed a bug where launching an app could override the lock screen, fixed counter-material reuse in AES-GCM streaming, stopped encrypted eMMC from proceeding with all-zero keys, and fixed U2F signing that skipped validation of the application parameter.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/Foundation-Devices/KeyOS/releases/tag/v1.3.0", "sourceName": "Foundation: KeyOS v1.3.0 release notes" }, { "id": "trezor-2026-07-e-shop-cart-could-be-modified", "date": "2026-07-16", "company": "Trezor", "wallets": [], "title": "E-shop cart, including shipping address, could be changed without login", "summary": "Anyone who knew a cart identifier on the Trezor e-shop could view and change that cart, including the shipping address, without logging in. Trezor paid a 500 USD reward for the report.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/e-shop-cart-could-be-modified-without-authorization", "sourceName": "Trezor Security Portal" }, { "id": "tangem-2026-07-donjon-laser-password-reset", "date": "2026-07-09", "company": "Tangem", "wallets": [ "tangem" ], "title": "Ledger Donjon laser attack resets Tangem card passwords", "summary": "Ledger Donjon used a single laser pulse on the card's EAL6+ chip to skip a firmware check and set the card's password to an attacker-chosen value, giving access to its funds. The flaw affects all Tangem cards in circulation and cannot be patched, but requires physical access and a lab setup costing around $250,000. It was disclosed to Tangem on February 10th, 2026.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/blog/bypassing-tangem-card-security-with-laser-attack/", "sourceName": "Ledger Donjon" }, { "id": "foundation-2026-07-magic-backup-server", "date": "2026-07-08", "company": "Foundation", "wallets": [ "foundation-passport" ], "title": "Envoy Magic Backup server allowed unauthenticated access to backups", "summary": "Foundation fixed a flaw in its Magic Backup server that allowed unauthenticated listing, downloading, and deletion of backup data. Foundation said it was certain the flaw was not exploited and paid a bounty to the researcher who reported it.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://github.com/Foundation-Devices/envoy/releases/tag/v2.3.0", "sourceName": "Foundation: Envoy v2.3.0 release notes" }, { "id": "foundation-2026-07-prime-security-check", "date": "2026-07-08", "company": "Foundation", "wallets": [ "foundation-passport" ], "title": "Passport Prime authenticity check could report errors as success", "summary": "Envoy 2.3.0 fixed a flaw in the Passport Prime security check where a device error response could be reported as a successful verification. The same release addressed three medium-severity findings from an ngwallet security audit.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://github.com/Foundation-Devices/envoy/releases/tag/v2.3.0", "sourceName": "Foundation: Envoy v2.3.0 release notes" }, { "id": "bitbox-2026-07-oeschinen-display-and-app-flaws", "date": "2026-07-08", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "Oeschinen update also fixed display spoofing and app data flaws", "summary": "Besides the USB out-of-bounds write, the Oeschinen release fixed bug bounty reports that let a malicious app or DApp show manipulated text on the BitBox screen during self transfers and EIP-712 signing, and bypass the confirmed Ethereum chain ID. It also fixed a BitBoxApp issue where a compromised partner widget could read account data. BitBox said none of the issues directly affected user funds.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.bitbox.swiss/en/bitbox-07-2026-oeschinen-update/", "sourceName": "BitBox blog: BitBox 07.2026 Oeschinen update" }, { "id": "coinkite-2026-07-legacy-input-spoofing", "date": "2026-07-01", "company": "Coinkite", "wallets": [], "title": "Coldcard legacy input-amount spoofing fixed in 5.5.1 and 1.4.1Q", "summary": "Witness-UTXO-only PSBT data could be used where Coldcard signed a non-SegWit input, allowing the input amount to be spoofed. The fix shipped in Mk4/Mk5 firmware 5.5.1 and Q firmware 1.4.1Q. No public proof of concept or loss report was found.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "bitbox-2026-07-oeschinen", "date": "2026-07", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "USB out-of-bounds write fixed in 9.26.3", "summary": "Firmware 9.26.3 fixed an out-of-bounds write in USB handling. Combined with phishing and older bootloader versions, it could have led to malicious firmware. The BitBox02 Nova was not affected.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.bitbox.swiss/en/bitbox-07-2026-oeschinen-update/", "sourceName": "BitBox" }, { "id": "bitbox-2026-07-bootloader-malicious-firmware", "date": "2026-07", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "BitBox02 bootloader flaw could let phished users install malicious firmware", "summary": "A bootloader flaw on the BitBox02 could let an attacker who phished a user into installing a fake BitBoxApp load malicious firmware onto a genuine device and steal funds. It was fixed in firmware 9.26.2; in August BitBox said it was more severe than first reported. The BitBox02 Nova was not affected, and there were no reports of exploitation.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.bitbox.swiss/en/bitbox-08-2026-dixence-update/", "sourceName": "BitBox blog: BitBox 08.2026 Dixence update" }, { "id": "trezor-2026-06-thp-pairing-could-be-completed-without", "date": "2026-06-29", "company": "Trezor", "wallets": [ "trezor-safe-7" ], "title": "Safe 7 THP pairing could be completed without the pairing code", "summary": "A host could complete Trezor Safe 7 pairing without the code shown on the device by supplying a degenerate value in the key exchange. Such values are now rejected.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/thp-pairing-could-be-completed-without-the-pairing-code", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-06-desktop-update-could-install-before-signature", "date": "2026-06-16", "company": "Trezor", "wallets": [], "title": "Suite desktop update could install before signature check finished", "summary": "A downloaded Trezor Suite update could be installed on quit before signature verification had finished. Installation is now blocked until verification completes.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/desktop-update-could-install-before-signature-verification-completed", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-06-solana-account-creation-confirmation-completeness", "date": "2026-06-14", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana account-creation fields missing from confirmation screens", "summary": "Some fields signed as part of Solana account-creation instructions were not displayed on the device confirmation screens. The screens now show the complete set of relevant fields.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-account-creation-confirmation-completeness", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-06-solana-signing-display-improvement", "date": "2026-06-12", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana account-creation signing did not show all signed fields", "summary": "Certain Solana account-creation instructions did not show all signed fields on the confirmation screen, weakening what-you-see-is-what-you-sign for those flows. The screens now display the complete set of fields.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-signing-display-improvement", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2026-06-lsb022-monero-keccak-leak", "date": "2026-06-04", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus" ], "title": "Monero app leaked secret keys via Keccak state (LSB 022)", "summary": "An APDU handler in the Monero app returned the full internal Keccak state, letting a compromised host recover the secret view and spend keys without on-screen confirmation. Ledger found it internally and fixed it in Monero app 2.1.4.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/022/", "sourceName": "Ledger Donjon" }, { "id": "trezor-2026-06-tropic01", "date": "2026-06-03", "company": "Trezor", "wallets": [ "trezor-safe-7" ], "title": "TROPIC01 secure element broken by laser fault injection", "summary": "Ledger Donjon extracted secrets from the Safe 7's TROPIC01 chip with a lab laser attack that needs physical possession and decapsulation. Trezor says it doesn't expose the PIN, funds, or wallet backup, and that a firmware update can't fix it.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/blog/news/Trezor-response-TROPIC01-chip-disclosure-no-impact-to-your-funds", "sourceName": "Trezor" }, { "id": "trezor-2026-06-coordination-fee-cap-shown-on-coin", "date": "2026-06-03", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "CoinJoin authorization did not show the coordination fee cap", "summary": "The CoinJoin authorization screen did not display the maximum coordination fee rate being authorized. That limit is now shown before confirmation.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/coordination-fee-cap-shown-on-coin-join-authorization", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-06-solana-token-transfer-recipient-spoofing-via", "date": "2026-06-01", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana token-transfer recipient spoofing via lookup table reference", "summary": "Token transfers whose destination was referenced through a Solana lookup table showed the lookup table address as the recipient. These transfers now use the detailed confirmation screen.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-token-transfer-recipient-spoofing-via-address-lookup-table-reference", "sourceName": "Trezor Security Portal" }, { "id": "coinkite-2026-06-delta-mode-seed-vault", "date": "2026-06", "company": "Coinkite", "wallets": [], "title": "AI review found Coldcard Delta Mode path exposing a Seed Vault value", "summary": "An AI-assisted firmware review produced 85 candidate findings, which Coinkite reviewed by hand. Most high-severity items were false positives, but one real Delta Mode path could expose a Seed Vault value through Seed XOR, and guards were added.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "trezor-2026-05-open-redirect-on-trezor-io-via", "date": "2026-05-29", "company": "Trezor", "wallets": [], "title": "Open redirect on trezor.io via a Cloudflare rewrite rule", "summary": "A redirect rule on trezor.io accepted unvalidated input, so a link that appeared to point at Trezor could send visitors elsewhere. The rule now uses a fixed destination.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/open-redirect-on-trezor-io-via-admin-cloudflare-rewrite", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-erc-20-clear-signing-hides-non", "date": "2026-05-25", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "ERC-20 clear signing hid ETH sent in the same transaction", "summary": "When clear signing an ERC-20 approval or transfer, the device did not display native ETH sent in the same transaction. A malicious host could attach an ETH transfer the user would not see; the device now shows any non-zero ETH amount.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/erc-20-clear-signing-hides-non-zero-eth-value-on-trezor-firmware", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-unauthenticated-remote-do-s-via-xpub", "date": "2026-05-19", "company": "Trezor", "wallets": [], "title": "Blockbook remote denial of service via xpub change-index amplification", "summary": "An unbounded change-index list in Blockbook xpub descriptor handling let a single unauthenticated request trigger large amounts of work and exhaust server memory. The fix bounds per-request work and limits the cache.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/unauthenticated-remote-do-s-via-xpub-change-index-amplification", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-unauthenticated-remote-memory-exhaustion-via-unbounded", "date": "2026-05-19", "company": "Trezor", "wallets": [], "title": "Blockbook memory exhaustion via unbounded timestamp array", "summary": "Blockbook fiat-rate endpoints accepted an unbounded list of timestamps, so one unauthenticated connection could force an out-of-memory crash. The fix bounds timestamps per request and limits concurrent work.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/unauthenticated-remote-memory-exhaustion-via-unbounded-timestamp-array", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-ethereum-s-slip-24-payment-request", "date": "2026-05-16", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "SLIP-24 verified-swap safeguard inactive, allowing hidden calldata", "summary": "A safeguard meant to stop extra calldata being attached to a SLIP-24 verified-swap transaction was not active in production firmware. A malicious host could inject attacker calldata while the device showed a normal verified-swap confirmation.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/ethereum-s-slip-24-payment-request-branch-in-production-firmware-signs-attacker-calldata-under-cover-of-verified-swap-ui", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-solana-stake-claim-recipient-amount-display", "date": "2026-05-16", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana stake claims showed only a combined total, hiding redirects", "summary": "Solana stake claims covering several withdrawals showed only a combined total, so a claim could be redirected without the diverted amount being visible. Mixed-recipient claims are now confirmed one withdrawal at a time.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-stake-claim-recipient-amount-display", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-unverifiable-external-inputs-not-rejected-in", "date": "2026-05-07", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "CoinJoin signing did not reject some unverifiable external inputs", "summary": "A check meant to reject unverifiable external inputs in CoinJoin signing only caught them when fields were entirely absent, so a malicious host could slip one past verification. The classification has been corrected.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/unverifiable-external-inputs-not-rejected-in-coin-join-signing", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-missing-output-confirmation-in-bitcoin-replacement", "date": "2026-05-07", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Bitcoin RBF replacements could add a recipient without confirmation", "summary": "When signing a replace-by-fee transaction, the device skipped the recipient confirmation for outputs not in the original transaction, so a malicious host could add an external recipient. Replacements can no longer add new recipients.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/missing-output-confirmation-in-bitcoin-replacement-transactions", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-05-cross-origin-popup-takeover-in-trezor", "date": "2026-05-03", "company": "Trezor", "wallets": [], "title": "Cross-origin message flaw in the Trezor Connect popup", "summary": "The Trezor Connect v9 popup processed cross-window messages without verifying they came from a trusted source. A malicious page could read non-sensitive device information and request read-only operations; signing still required device confirmation.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/cross-origin-popup-takeover-in-trezor-connect-popup", "sourceName": "Trezor Security Portal" }, { "id": "blockstream-2026-04-jade-recovery-signing-outputs", "date": "2026-04-30", "company": "Blockstream", "wallets": [ "jade", "jade-plus" ], "title": "Jade 1.0.40 made Green recovery signing confirm every output", "summary": "Jade firmware 1.0.40 changed Green recovery signing so the user always confirms all outputs, and cleared secrets from memory more diligently after they are shown on screen. Green 2of3 recovery signing had been added in 1.0.39.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/Blockstream/Jade/blob/master/CHANGELOG.md", "sourceName": "Blockstream Jade GitHub: CHANGELOG.md (1.0.40)" }, { "id": "electrum-2026-04-plugin-authorization-bypass", "date": "2026-04-28", "company": "Electrum", "wallets": [], "title": "Electrum external plugin authorization could be bypassed by local malware", "summary": "A program already running on the computer with write access to Electrum's data folder could install and enable a plugin without the plugin password, running its code inside Electrum. Version 4.7.2 fixed it.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf", "sourceName": "Electrum security advisory GHSA-vw94-r84p-66qf" }, { "id": "electrum-2026-04-nwc-spending-limit", "date": "2026-04-28", "company": "Electrum", "wallets": [], "title": "Electrum's Nostr Wallet Connect plugin could exceed its daily spending limit", "summary": "A malicious or compromised client with a valid Nostr Wallet Connect connection could spend more than the configured daily limit through concurrent requests and rounding in the budget check. The plugin is off by default. Version 4.7.2 fixed it.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585", "sourceName": "Electrum security advisory GHSA-q7m2-785w-r585" }, { "id": "krux-2026-04-ai-audit-fixes", "date": "2026-04-27", "company": "Krux", "wallets": [ "krux" ], "title": "Krux 26.04.0 fixed signing and SD card flaws found by AI audits", "summary": "Krux 26.04.0 addressed issues raised by AI audits, including PSBT sighash checks, multisig quorum validation, memory exhaustion from crafted QR or SD card data, and directory traversal via crafted FAT entries.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/selfcustody/krux/releases/tag/v26.04.0", "sourceName": "Krux v26.04.0 release notes" }, { "id": "ledger-2026-04-counterfeit-nano-s-plus", "date": "2026-04-17", "company": "Ledger", "wallets": [ "ledger-nano-s-plus" ], "title": "Counterfeit Nano S Plus sold on Chinese marketplace", "summary": "A researcher bought a Nano S Plus from a Chinese marketplace that failed Ledger's Genuine Check and contained modified hardware and firmware with WiFi and Bluetooth antennas. The box QR code pointed to a malicious Ledger Live app built to obtain the seed phrase.", "severity": "major", "type": "supply-chain", "sourceUrl": "https://cointelegraph.com/news/fake-ledger-device-sold-chinese-market-place", "sourceName": "Cointelegraph" }, { "id": "ledger-2026-04-fake-ledger-live-app-store", "date": "2026-04-14", "company": "Ledger", "wallets": [], "title": "Fake Ledger Live on Apple's App Store drained $9.5 million", "summary": "A malicious Ledger Live app for macOS on Apple's App Store tricked users into entering their seed phrase, draining about $9.5 million from 50 victims. Apple removed the app and terminated the developer account.", "severity": "critical", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/", "sourceName": "BleepingComputer" }, { "id": "trezor-2026-04-lock-bypass-in-sd-protect-only", "date": "2026-04-14", "company": "Trezor", "wallets": [], "title": "Lock bypass on devices with SD-card protection and no PIN", "summary": "On devices with SD-card protection enabled and no PIN, manual lock or auto-lock did not fully re-engage, so the device could keep authorizing protected operations. The fix requires the SD-card secret again after locking.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/lock-bypass-in-sd-protect-only-configuration-allows-signing-after-lock-device-autolock", "sourceName": "Trezor Security Portal" }, { "id": "specter-2026-04-desktop-redirect-bypass", "date": "2026-04-09", "company": "Specter", "wallets": [], "title": "Specter Desktop open redirect protection could be bypassed", "summary": "A user reported that Specter Desktop's login redirect check could be bypassed with an encoded tab character, letting an attacker redirect users to any malicious site. The fix shipped in Specter Desktop v2.1.7.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/cryptoadvance/specter-desktop/releases/tag/v2.1.7", "sourceName": "Specter Desktop v2.1.7 release notes and issue #2590" }, { "id": "trezor-2026-04-solana-alt-recipient-confirmation-mismatch", "date": "2026-04-06", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana lookup-table recipient confirmation mismatch", "summary": "Solana predefined transfer confirmations could display an address lookup table reference instead of the real destination, creating a mismatch with the account credited on-chain. Handling of these references was improved.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-alt-recipient-confirmation-mismatch", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-04-solana-account-type-misclassification", "date": "2026-04-06", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Solana account permissions mislabeled in detail views", "summary": "A flaw in Solana account classification could mislabel account permissions in unsupported-instruction detail views. The classification was corrected.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/solana-account-type-misclassification", "sourceName": "Trezor Security Portal" }, { "id": "keystone-2026-04-usb", "date": "2026-04-01", "company": "Keystone", "wallets": [ "keystone-3-pro" ], "title": "USB memory bug fixed in Keystone 3 Pro firmware 2.4.0", "summary": "OneKey's security team found a USB memory bug that could let an attacker run code on a Keystone 3 Pro with physical possession, the PIN, and an approved USB connection. Firmware 2.4.0 fixed it. Keystone reported no known exploitation.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://onekey.so/blog/learn/usb-sdk-vulnerability-hardware-wallet-seed-extraction/", "sourceName": "OneKey" }, { "id": "onekey-2026-04-shared-pairing-key", "date": "2026-04", "company": "OneKey", "wallets": [ "onekey" ], "title": "Researchers say all OneKey wallets share one seed pairing key", "summary": "A Hardwear.io talk by Michael Mouchous and Karim Abdellatif describes fault injection attacks on OneKey's STM32F405 and ATECC608 chips that recover the pairing key protecting the seed. They report that a misconfigured random number generator gave every OneKey wallet the same pairing key and that the flaws cannot be fixed.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://hardwear.io/talks/onekey-is-all-it-takes-the-misuse-of-secure-components-in-hardware-wallets/", "sourceName": "Hardwear.io" }, { "id": "trezor-2026-03-reflected-xss-on-connect-trezor-io", "date": "2026-03-25", "company": "Trezor", "wallets": [], "title": "Reflected XSS on connect.trezor.io documentation endpoint", "summary": "A URL parameter on the Trezor Connect documentation endpoint could load and run arbitrary JavaScript on the trusted connect.trezor.io domain. The reflected XSS has been resolved.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/reflected-xss-on-connect-trezor-io-via-hash-fragment", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-03-eip-712-domain-spoofing-via-double", "date": "2026-03-21", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "EIP-712 domain spoofing via double-fetch", "summary": "A compromised host could show a trusted EIP-712 domain on the Trezor screen while the device signed data for a different, attacker-controlled domain. Trezor says this could enable malicious permit approvals and fund theft.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/eip-712-domain-spoofing-via-double-fetch", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-03-open-redirect-on-affiliate-page", "date": "2026-03-20", "company": "Trezor", "wallets": [], "title": "Open redirect on Trezor affiliate page", "summary": "An affiliate marketing tool on the Trezor site allowed redirects to any website. An attacker could use a legitimate-looking Trezor URL in a phishing campaign.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/open-redirect-on-affiliate-page", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-03-biometric-verification-bypassed-in-trezor-suite", "date": "2026-03-09", "company": "Trezor", "wallets": [], "title": "Trezor Suite biometric check bypassed with external monitor", "summary": "Biometric authentication in Trezor Suite could be bypassed when the host could not offer it, such as a laptop with its lid closed on an external monitor. This let other users of the computer open the app.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/biometric-verification-bypassed-in-trezor-suite-with-external-monitor", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2026-02-fake-authentication-check-letters", "date": "2026-02-14", "company": "Trezor", "wallets": [], "title": "Printed letters impersonating Trezor asked owners for their seed phrase", "summary": "Trezor owners received printed letters claiming an \"Authentication Check\" would become mandatory by February 15, 2026, with a QR code leading to a phishing site. The final page asked for a 12-, 20- or 24-word seed phrase. BleepingComputer said the targeting criteria were unclear.", "severity": "minor", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks/", "sourceName": "BleepingComputer" }, { "id": "trezor-2026-02-recovery-flow-padding-weakness-on-model", "date": "2026-02-06", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Model One standard recovery weak for 12- and 18-word backups", "summary": "On Model One, standard recovery pads 12- and 18-word backups with random extra words; repeating recovery or a backup check let a malicious host spot the fake words, cutting security to 28 or 52 bits. Trezor now forces advanced recovery for those lengths.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/recovery-flow-padding-weakness-on-model-one-with-12-18-words", "sourceName": "Trezor Security Portal" }, { "id": "bitbox-2026-01-nova-secure-chip-config", "date": "2026-01-26", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "BitBox02 Nova secure chip flaws allowed password brute force", "summary": "Trezor's Andrew Kozlik reported two flaws in the BitBox02 Nova's OPTIGA secure chip configuration, one of which let an attacker with advanced physical access brute-force the device password past the limit of 10 attempts. The seed key is erased in the process, so only users who reuse the same password on another device were at risk. Firmware 9.25.0 fixed both.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.bitbox.swiss/en/bitbox-01-2026-marmorera-update/", "sourceName": "BitBox blog: BitBox 01.2026 Marmorera update" }, { "id": "trezor-2026-01-bug-in-multisig-verification", "date": "2026-01-10", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5", "trezor-safe-7" ], "title": "Multisig fee-bump display bug could mislead signers", "summary": "Incorrect on-device display could mislead users into approving a seemingly minor fee bump that was actually malicious in a Bitcoin multisig wallet. The attacker would need to control one signer and the other signers would need a compromised Trezor Suite.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/bug-in-multisig-verification", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2026-01-global-e", "date": "2026-01", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus", "ledger-stax", "ledger-flex" ], "title": "Customer data exposed through checkout partner Global-e", "summary": "Global-e, the company that runs checkout on Ledger.com, disclosed that attackers had accessed order records with Ledger customers' names, contact details, and order details. Ledger says seed phrases and funds were not affected.", "severity": "major", "type": "data-breach", "sourceUrl": "https://www.theregister.com/security/2026/01/06/ledger-confirms-customer-data-lifted-after-global-e-snafu/2443622", "sourceName": "The Register" }, { "id": "blockstream-2025-12-jade", "date": "2025-12", "company": "Blockstream", "wallets": [ "jade", "jade-plus" ], "title": "Jade descriptor registration buffer overflow fixed in 1.0.37", "summary": "DARKNAVY reported a buffer overflow in Jade's descriptor registration command on firmware 1.0.24 to 1.0.36. QR mode was never exposed. Blockstream fixed it in 1.0.37, added downgrade protection in 1.0.38, and reported no known exploitation.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.blockstream.com/jade-security-disclosure/", "sourceName": "Blockstream" }, { "id": "cypherock-2025-11-darknavy-supply-chain-attack", "date": "2025-11-21", "company": "Cypherock", "wallets": [], "title": "DARKNAVY backdoors Cypherock X1 firmware and passes the authenticity check", "summary": "DARKNAVY chained firmware bugs in the Cypherock X1 Vault to replace its firmware, bypass secure boot and pass the vendor's device authenticity check, gaining control over newly generated seed phrases. The attack was shown at GEEKCON 2025 as a simulated supply chain attack. DARKNAVY said Cypherock silently patched two earlier reported vulnerabilities without acknowledging them.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://www.darknavy.org/blog/how_and_why_we_hacked_cypherock_hardware_wallet_the_full_story/", "sourceName": "DARKNAVY" }, { "id": "trezor-2025-10-inability-to-cancel-certain-flows-on", "date": "2025-10-31", "company": "Trezor", "wallets": [ "trezor-safe-7" ], "title": "Cancel did not work in some flows on pre-production Safe 7 firmware", "summary": "In pre-production Safe 7 firmware given to a small group after launch, pressing Cancel did not cancel some non-critical flows such as staking delegation. The fix shipped in the public release.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/inability-to-cancel-certain-flows-on-pre-production-firmware-1", "sourceName": "Trezor Security Portal" }, { "id": "ellipal-2025-10-xrp-theft-seed-imported-app", "date": "2025-10-19", "company": "Ellipal", "wallets": [], "title": "Investor loses 1,209,990 XRP after importing his seed into Ellipal app", "summary": "An investor reported that about 1,209,990 XRP, worth more than $3 million, was drained on Oct. 12 from a wallet he viewed in Ellipal's mobile app. Ellipal said its review indicated the hardware wallet's seed phrase had been imported into the app, which stores keys on the phone and makes it a hot wallet. CoinDesk did not independently verify the investor's account.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://www.coindesk.com/tech/2025/10/19/xrp-investor-says-usd3m-in-xrp-was-stolen-cold-wallet-maker-says-seed-import-made-wallet-hot", "sourceName": "CoinDesk" }, { "id": "ledger-2025-10-fake-data-security-incident-email", "date": "2025-10", "company": "Ledger", "wallets": [], "title": "Fake 'Ledger Data Security Incident' email phished seed phrases", "summary": "In October 2025 Ledger added a new fake email to its phishing warnings page. The email, headed 'Important: Ledger Data Security Incident', claimed a breach of a Ledger database and pushed a 'Secure My Account Now' button that led to a site asking for the seed phrase. Ledger did not report an actual breach.", "severity": "minor", "type": "phishing", "sourceUrl": "https://web.archive.org/web/20251020070457/https://www.ledger.com/phishing-campaigns-status", "sourceName": "Ledger phishing campaigns status page (archived October 20, 2025)" }, { "id": "coinkite-2025-09-delta-pin-key-recovery", "date": "2025-09-29", "company": "Coinkite", "wallets": [], "title": "Coldcard Delta PIN mode allowed private-key recovery from two signatures", "summary": "Nathan Landon of Karma-X reported that the Delta PIN duress feature repeatedly signed a fixed digest, which allowed full private-key recovery from two transaction signatures. Coinkite patched it the same day, and the fix shipped in firmware 5.4.4 and 1.3.4Q.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "trezor-2025-09-fix-side-channel-in-bip-39", "date": "2025-09-24", "company": "Trezor", "wallets": [ "trezor-model-one", "trezor-safe-3", "trezor-safe-5" ], "title": "Side channel in BIP-39 seed processing on unlocked devices", "summary": "A non-constant-time function used after unlock could let an attacker holding an unlocked device extract the seed. It affected all Model One devices and Model T, Safe 3 and Safe 5 on universal firmware with a BIP-39 backup.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked", "sourceName": "Trezor Security Portal" }, { "id": "tangem-2025-09-donjon-brute-force", "date": "2025-09-17", "company": "Tangem", "wallets": [ "tangem" ], "title": "Ledger Donjon speeds up password guessing on Tangem cards", "summary": "Ledger Donjon used a tearing technique against Tangem's secure channel to skip the security delay after failed attempts, allowing about 2.5 password guesses per second. Existing cards cannot be patched, so users are advised to set strong passwords. Tangem concluded the finding would not be classified as a vulnerability.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/blog-brute-force-attack-tangem", "sourceName": "Ledger Donjon" }, { "id": "blockstream-2025-09-fake-firmware-email", "date": "2025-09-12", "company": "Blockstream", "wallets": [ "jade" ], "title": "Fake Jade firmware update emails linked to malicious downloads", "summary": "Blockstream warned of phishing emails telling Jade owners to download new firmware through a malicious link. Blockstream said it never sends firmware files by email and that no data had been compromised.", "severity": "minor", "type": "phishing", "sourceUrl": "https://www.tradingview.com/news/cointelegraph:2034e3e0a094b:0-blockstream-sounds-the-alarm-on-new-email-phishing-campaign/", "sourceName": "Cointelegraph (via TradingView)" }, { "id": "trezor-2025-06-contact-form", "date": "2025-06-23", "company": "Trezor", "wallets": [ "trezor-safe-3", "trezor-safe-5" ], "title": "Support contact form abused to send phishing", "summary": "Attackers abused Trezor's support contact form to send phishing emails asking for wallet backups. Trezor said the issue was contained.", "severity": "minor", "type": "phishing", "sourceUrl": "https://x.com/Trezor/status/1937085759028089100", "sourceName": "Trezor" }, { "id": "ledger-2025-06-douyin-tampered-cold-wallet", "date": "2025-06-14", "company": "Ledger", "wallets": [], "title": "Tampered Ledger bought on Douyin led to about $6.5 million theft", "summary": "SlowMist reported that a user who bought a tampered cold wallet on Douyin lost about 50 million yuan in crypto, with the private key stolen at the moment it was generated. SlowMist co-founder Yu Xian put the theft at about $6.5 million and said the scam revolved around the Ledger hardware wallet. The device came from a third-party seller, not Ledger.", "severity": "major", "type": "supply-chain", "sourceUrl": "https://panews.io/articles/g79gci5g", "sourceName": "PANews" }, { "id": "ledger-2025-05-macos-fake-ledger-live", "date": "2025-05-30", "company": "Ledger", "wallets": [], "title": "macOS stealers replaced Ledger Live with seed-phishing clones", "summary": "Moonlock Lab reported 4 active campaigns in which macOS stealers such as AMOS delete Ledger Live and install a fake version that asks for the seed phrase. The technique had been active since at least August 2024.", "severity": "major", "type": "phishing", "sourceUrl": "https://moonlock.com/malware-fake-ledger-apps", "sourceName": "Moonlock" }, { "id": "tangem-2025-05-donjon-genuine-check-bypass", "date": "2025-05-15", "company": "Tangem", "wallets": [ "tangem" ], "title": "Ledger Donjon bypasses Tangem Android genuine check", "summary": "Ledger Donjon found a flaw in the Tangem Android app that could let a counterfeit, backdoored card pass the genuine check. Tangem fixed it in Android app version 5.18.3 and paid a $15,000 bounty. Donjon reported that 30% of users had not yet updated by February 26, 2025.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://www.ledger.com/tangem-genuine-check-bypass-on-android-application", "sourceName": "Ledger Donjon" }, { "id": "ledger-2025-05-discord-moderator-phishing", "date": "2025-05-11", "company": "Ledger", "wallets": [], "title": "Hijacked moderator account posted seed phishing links in Ledger's Discord", "summary": "An attacker took over a contracted moderator's account on Ledger's Discord server and used a bot to post links asking users to verify their seed phrase on a fake site. Ledger removed the account and bot, and some members said the attacker banned or muted them as they tried to warn others.", "severity": "major", "type": "phishing", "sourceUrl": "https://cointelegraph.com/news/ledger-discord-channel-secure-after-security-breach", "sourceName": "Cointelegraph" }, { "id": "keystone-2025-04-zknox-firmware-key-overwrite", "date": "2025-04-07", "company": "Keystone", "wallets": [ "keystone-3-pro" ], "title": "ZKNOX exploit replaces Keystone 3 Pro firmware update key", "summary": "ZKNOX published tools that exploit a buffer overflow in Keystone 3 Pro firmware 1.2.2 and 1.2.4 to install a custom firmware update key, letting the owner sign and load their own firmware. The bug was reported on 19.08.24 and fixed in firmware 1.2.6. The exploit works because no memory protection was set and all memory areas were executable.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/ZKNoxHQ/ks3-devkit", "sourceName": "ZKNOX (GitHub)" }, { "id": "ledger-2025-04-letters", "date": "2025-04", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus", "ledger-stax", "ledger-flex" ], "title": "Printed phishing letters asked owners for their seed phrase", "summary": "Ledger owners received physical letters posing as Ledger and asking them to enter their seed phrase. Ledger confirmed the letters were a scam.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.theblock.co/post/352479/ledger-confirms-physical-scam-letters-requesting-seed-phrase", "sourceName": "The Block" }, { "id": "tangem-2025-03-nfc-read-without-pin", "date": "2025-03-30", "company": "Tangem", "wallets": [ "tangem" ], "title": "DARKNAVY: Tangem cards return wallet data over NFC without a PIN check", "summary": "DARKNAVY found that a Tangem card answers the read command without checking the PIN, so anyone tapping the card can read its card and wallet information. It also noted that the delay against PIN guessing arrived only in card firmware 1.21, and cards cannot be updated.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.secrss.com/articles/77226", "sourceName": "DARKNAVY (via secrss.com)" }, { "id": "trezor-2025-03-donjon-safe3", "date": "2025-03", "company": "Trezor", "wallets": [ "trezor-safe-3" ], "title": "Ledger Donjon bypassed Safe 3 firmware checks", "summary": "Ledger Donjon showed it could bypass the Safe 3's authenticity and firmware checks with a fault-injection attack on the microcontroller, a supply-chain attack that needs access to the device before it reaches the buyer. Trezor says the Safe 5 is not affected.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/donjon-s-trezor-safe-3-evaluation", "sourceName": "Trezor" }, { "id": "ledger-2025-01-lsb021-mcu-update-validation", "date": "2025-01-10", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-flex", "ledger-stax" ], "title": "Firmware update accepted unvalidated reset handler (LSB 021)", "summary": "Guanxing Wen found the bootloader did not validate the reset_handler address during firmware updates, letting an attacker permanently brick a device. Ledger said funds were never at risk and fixed it in Nano X 2.4.2, Flex 1.2.2 and Stax 1.6.2.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/021/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2025-01-balland", "date": "2025-01", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus", "ledger-stax", "ledger-flex" ], "title": "Ledger co-founder kidnapped for ransom", "summary": "Ledger co-founder David Balland was kidnapped in France and held for a bitcoin ransom.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.dlnews.com/articles/regulation/ledger-cofounder-david-balland-and-wife-kidnapped-in-france/", "sourceName": "DL News" }, { "id": "tangem-2024-12-private-keys-in-app-logs", "date": "2024-12-31", "company": "Tangem", "wallets": [ "tangem" ], "title": "Tangem app logged private keys of seed phrase wallets", "summary": "Tangem disclosed that when users activated a wallet with a seed phrase, the mobile app wrote the private key to its logs, which could reach the support team if the user contacted support through the app within 7 days. Tangem said fewer than 0.1% of users could be affected and no funds were lost. The bug was fixed in app versions 5.19.1 on iOS and 5.19.2 on Android, and support logs were erased.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://tangem.com/en/blog/post/tangem-resolves-log-issue", "sourceName": "Tangem" }, { "id": "coinkite-2024-12-edge-policy-deserialization", "date": "2024-12-18", "company": "Coinkite", "wallets": [], "title": "Coldcard Edge miniscript policies could fail to load", "summary": "On Edge firmware, a miniscript policy whose key placeholders were not strictly ascending could be saved in a form that later failed to load, blocking use of that wallet. The Liana team reported it, and it was fixed in 6.3.4X and 6.3.4QX. Coinkite said backups remained correct.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "ledger-2024-12-spoofed-breach-email", "date": "2024-12-17", "company": "Ledger", "wallets": [], "title": "Fake breach emails asked users to verify their seed phrase", "summary": "Phishing emails appearing to come from Ledger's support address, sent through SendGrid, claimed a data breach had exposed seed phrases. They linked to a fake verification page that collected the seed phrase.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/new-fake-ledger-data-breach-emails-try-to-steal-crypto-wallets/", "sourceName": "BleepingComputer" }, { "id": "krux-2024-11-aes-cbc-entropy", "date": "2024-11-19", "company": "Krux", "wallets": [ "krux" ], "title": "Krux AES-CBC encrypted backups did not use camera entropy", "summary": "An implementation error meant camera-captured entropy was not used as intended in Krux's AES-CBC encryption mode, weakening encrypted backups for users who had switched from the default AES-ECB. Krux 24.11.1 fixed it and advised affected users to recreate their encrypted backups.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/selfcustody/krux/releases/tag/v24.11.1", "sourceName": "Krux v24.11.1 release notes" }, { "id": "krux-2024-11-sd-card-code-execution", "date": "2024-11-11", "company": "Krux", "wallets": [ "krux" ], "title": "Krux could run code from the SD card before internal flash", "summary": "MicroPython on Krux would import .mpy modules from an SD card before checking internal flash, which could be used to run unintended code. Krux 24.11.0 blocked running any code from the SD card.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/selfcustody/krux/releases/tag/v24.11.0", "sourceName": "Krux v24.11.0 release notes" }, { "id": "onekey-2024-11-pro-bluetooth-pairing-while-locked", "date": "2024-11", "company": "OneKey", "wallets": [ "onekey" ], "title": "OneKey Pro could be paired over Bluetooth while locked", "summary": "A SlowMist audit of OneKey Pro firmware v4.10.0 found that the device allowed Bluetooth pairing while the wallet was locked, so a malicious device could pair without the owner's approval and then send signature requests. SlowMist rated the issue medium and marked it fixed in firmware v4.11.0.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/slowmist/Knowledge-Base/blob/master/open-report-V2/blockchain-application/SlowMist%20Audit%20Report%20-%20OneKey%20Pro_en-us.pdf", "sourceName": "SlowMist: Audit Report - OneKey Pro" }, { "id": "blockstream-2024-08-jade-pset-stack-overflow", "date": "2024-08-09", "company": "Blockstream", "wallets": [ "jade" ], "title": "Jade 1.0.31 fixed a stack overflow crash from Liquid PSETs sent as PSBTs", "summary": "Jade firmware 1.0.31 added protection against a stack overflow crash triggered when an Elements or Liquid PSET was presented in place of a PSBT. The same release fixed a bug in identifying change outputs when a signer placeholder was reused in a registered descriptor policy.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/Blockstream/Jade/blob/master/CHANGELOG.md", "sourceName": "Blockstream Jade GitHub: CHANGELOG.md (1.0.31)" }, { "id": "onekey-2024-05-offside-mini-mnemonic-exposure", "date": "2024-05-30", "company": "OneKey", "wallets": [ "onekey" ], "title": "Offside Labs bug let attackers read OneKey Mini mnemonic before unlock", "summary": "Offside Labs found that a typo in OneKey Mini firmware left factory-only flash read and write commands enabled, and a missing length check allowed a buffer overflow that gave code execution. The researchers used it to access the mnemonic before the device was unlocked. OneKey merged a patch on 2023-12-20, paid a $5,000 bounty and pushed mandatory updates in January 2024.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.offside.io/p/one-key-bug-in-onekey-mini", "sourceName": "Offside Labs" }, { "id": "trezor-2024-03-x-account-hijacked", "date": "2024-03-19", "company": "Trezor", "wallets": [], "title": "Trezor X account hijacked to promote a fake token presale", "summary": "Attackers took over Trezor's official X account on March 19, 2024 and posted fraudulent presale token offers with harmful links. SatoshiLabs said the cause was a phishing attack planned over several weeks, using a fake interview request and a malicious Calendly link, and that its products were unaffected.", "severity": "major", "type": "phishing", "sourceUrl": "https://cointelegraph.com/news/trezor-phishing-not-sim-swap-compromised-x-account", "sourceName": "Cointelegraph" }, { "id": "trezor-2024-01-support-portal-breach", "date": "2024-01-17", "company": "Trezor", "wallets": [], "title": "Support ticket portal breach exposed contact details of up to 66,000 users", "summary": "An unauthorized party accessed the third-party support ticketing portal Trezor used on January 17, 2024, exposing names and email addresses of up to 66,000 people who had contacted support since December 2021. The intruder emailed 41 users asking for seed phrase information; Trezor said no seed phrases were disclosed.", "severity": "major", "type": "data-breach", "sourceUrl": "https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8", "sourceName": "Trezor Blog" }, { "id": "keystone-2024-01-offside-firmware-vulnerability", "date": "2024-01", "company": "Keystone", "wallets": [ "keystone-3-pro" ], "title": "Offside Labs finds hidden firmware vulnerability in Keystone 3 Pro", "summary": "Offside Labs reviewed the Keystone 3 Pro and found a firmware vulnerability that Keystone fixed in firmware V1.2.8. Keystone paid a bounty and did not publish technical details of the flaw.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.keyst.one/keystone-x-offside-labs-redefining-the-hardware-wallet-security-92fcb73dbf6c", "sourceName": "Keystone" }, { "id": "ledger-2023-12-connect-kit-supply-chain", "date": "2023-12-14", "company": "Ledger", "wallets": [], "title": "Malicious Ledger Connect Kit published to NPM drained users", "summary": "An attacker phished a former Ledger employee whose NPM access had not been revoked and published malicious Ledger Connect Kit versions 1.1.5 to 1.1.7. The code tricked users of DApps that load the kit into signing draining transactions; Ledger deployed a fix within 40 minutes of learning of it.", "severity": "critical", "type": "supply-chain", "sourceUrl": "https://www.ledger.com/blog/security-incident-report", "sourceName": "Ledger" }, { "id": "trezor-2023-11-missing-confirmation-in-the-ecdh-session", "date": "2023-11-26", "company": "Trezor", "wallets": [ "trezor-safe-3" ], "title": "Safe 3 returned ECDH session key without confirmation", "summary": "The Trezor Safe 3 returned the ECDHSessionKey without user interaction, skipping address confirmation screens. It concerned only the SSH feature and was fixed in firmware 2.6.4.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/missing-confirmation-in-the-ecdh-session-key-call", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2023-11-lsb020-eip712-parsing", "date": "2023-11-20", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Ledger Live misparsed some EIP-712 messages (LSB 020)", "summary": "A library used by Ledger Live decoded odd-length hexadecimal integers in EIP-712 messages incorrectly, so the signed message could differ from the intended one. Ian Fisher reported it, and Ledger Live 2.70.0 fixed it.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/020/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2023-11-fake-ledger-live-microsoft-store", "date": "2023-11-05", "company": "Ledger", "wallets": [], "title": "Fake Ledger Live Web3 app on Microsoft Store stole bitcoin", "summary": "A fake app called Ledger Live Web3 passed Microsoft Store checks and asked users for their seed phrase. The scammer took at least 16.8 BTC before Microsoft removed the app.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.windowscentral.com/microsoft/a-ledger-app-on-the-microsoft-store-may-be-fake-and-stealing-your-cryptocurrency", "sourceName": "Windows Central" }, { "id": "keystone-2023-11-keylabs-tamper-response", "date": "2023-11", "company": "Keystone", "wallets": [ "keystone-3-pro" ], "title": "Keylabs audit finds high-severity tamper response flaw in Keystone 3", "summary": "A Keylabs audit of the Keystone 3 found one high-severity firmware weakness: tamper events were written only to external secure elements without checking the write succeeded, so an attacker could disrupt I2C traffic to avoid detection. Keylabs also reported low-severity entropy and memory-clearing issues. Keylabs verified the high-severity and two low-severity firmware issues were fixed.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://keylabs.io/reports/2023-11-keystone3/", "sourceName": "Keylabs" }, { "id": "blockstream-2023-10-shipping-provider-data-leak", "date": "2023-10-27", "company": "Blockstream", "wallets": [ "jade" ], "title": "Shipping provider leak exposed Blockstream Store buyer emails", "summary": "Blockstream said its investigation into the October 2023 Jade phishing campaign found that customer data may have leaked from a third-party shipping provider. The leak included emails, and Blockstream could not rule out that phone numbers and shipping addresses were also taken. Blockstream took possession of the secure-blockstream.com phishing domain.", "severity": "major", "type": "data-breach", "sourceUrl": "https://www.nobsbitcoin.com/blockstream-is-investigating-a-potential-email-database-leak/", "sourceName": "No Bullshit Bitcoin (quoting Blockstream)" }, { "id": "blockstream-2023-10-fake-emergency-firmware-email", "date": "2023-10-21", "company": "Blockstream", "wallets": [ "jade" ], "title": "Phishing emails told Jade owners to install fake emergency firmware", "summary": "Jade users received emails claiming the Jade had been exploited and Blockstream had issued an emergency firmware release. Blockstream said it did not send them, and the emails came from an unrelated third-party domain rather than Blockstream's mail server.", "severity": "minor", "type": "phishing", "sourceUrl": "https://coingape.com/scam-alert-blockstream-users-targeted-by-phishing-email/", "sourceName": "CoinGape" }, { "id": "specter-2023-09-desktop-redirect-electron", "date": "2023-09-21", "company": "Specter", "wallets": [], "title": "Specter Desktop fixed login open redirect and Electron code execution", "summary": "Specter Desktop v2.0.2 fixed a login open redirect caused by manipulating the next parameter and patched an Electron flaw allowing out-of-package code execution when launched with an attacker-controlled working directory.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/cryptoadvance/specter-desktop/releases/tag/v2.0.2", "sourceName": "Specter Desktop v2.0.2 release notes" }, { "id": "seedsigner-2023-09-dice-seed-debug-print", "date": "2023-09-11", "company": "SeedSigner", "wallets": [ "seedsigner" ], "title": "SeedSigner printed dice-generated seed phrases to debug output", "summary": "SeedSigner's dice-to-seed tool printed the dice rolls and the resulting seed phrase to the debug console. A pull request removed both prints before the next release.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/SeedSigner/seedsigner/pull/454", "sourceName": "SeedSigner GitHub: Removing debugging prints (0.7.0 release notes)" }, { "id": "coinkite-2023-09-mk4-se2-laser", "date": "2023-09", "company": "Coinkite", "wallets": [], "title": "Ledger Donjon laser faults exposed part of Coldcard Mk4 SE2 memory", "summary": "Ledger Donjon researchers used double laser faults to bypass read protection on part of the DS28C36 chip used as the Mk4's second secure element. No full seed recovery was shown because the Mk4 needs material from SE1, SE2, and the microcontroller.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "bitbox-2023-08-fee-attack-fix-bypass", "date": "2023-08-23", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "BitBox02 firmware 8.0.0 fee attack fix could be circumvented", "summary": "BitBox engineers found during internal testing that the BitBox02 firmware 8.0.0 fix for the excessive-fee attack could be circumvented, and the Motterascio update patched it. The bug was found internally, and BitBox had no reason to believe anyone else knew of it.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://bitbox.swiss/blog/bitbox-08-2023-marinelli-update/", "sourceName": "BitBox blog: BitBox 08.2023 Motterascio update" }, { "id": "ngrave-2023-08-zero-1-3-2-pin-memo", "date": "2023-08", "company": "NGRAVE", "wallets": [ "ngrave-zero" ], "title": "ZERO firmware 1.3.2 fixes PIN change without fingerprint and hidden memo", "summary": "NGRAVE ZERO firmware v1.3.2 fixed two bugs. With 2FA enabled for unlocking, the device now asks for a fingerprint scan when the PIN code is changed in settings. The optional memo set in the LIQUID app is now shown on the ZERO confirmation screen so it can be checked before signing.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.ngrave.io/en/zero-release-notes-v1-3-2", "sourceName": "NGRAVE: ZERO Release Notes Version 1.3.2" }, { "id": "trezor-2023-05-unciphered-trezor-t-claim", "date": "2023-05-24", "company": "Trezor", "wallets": [], "title": "Unciphered claims physical seed extraction from Trezor Model T", "summary": "Recovery firm Unciphered said it could extract the seed from a Trezor Model T in its physical possession using a hardware flaw in the STM32 chip. Trezor said the attack resembled the read protection downgrade attack it had acknowledged years earlier.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.coindesk.com/tech/2023/05/24/crypto-security-firm-unciphered-claims-ability-to-physically-hack-trezor-t-wallet", "sourceName": "CoinDesk" }, { "id": "ledger-2023-05-ledger-recover-backlash", "date": "2023-05-16", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Ledger Recover seed backup service drew security backlash", "summary": "Ledger confirmed an optional $9.99-per-month Ledger Recover service for Nano X that encrypts and splits a version of the private key among Coincover, Ledger and an independent backup provider. Critics said sending key fragments off the device undermined Ledger's security and privacy commitments.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://sg.finance.yahoo.com/news/ledger-bats-back-criticism-wallet-183005552.html", "sourceName": "CoinDesk (via Yahoo Finance)" }, { "id": "ledger-2023-05-lsb019-miniscript-addresses", "date": "2023-05-11", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus" ], "title": "Bitcoin app produced wrong miniscript addresses (LSB 019)", "summary": "Bitcoin app versions 2.1.0 and 2.1.1 mishandled the miniscript a: fragment and produced wrong addresses. Ledger said impact was limited because no deployed wallet fully integrated such policies, and version 2.1.2 fixed it.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/019/", "sourceName": "Ledger Donjon" }, { "id": "trezor-2023-05-kaspersky-counterfeit-model-t", "date": "2023-05-10", "company": "Trezor", "wallets": [], "title": "Kaspersky documents counterfeit Trezor Model T used to steal funds", "summary": "Kaspersky examined a Trezor Model T bought through a classifieds site that had a swapped microcontroller and modified firmware. The firmware replaced the random seed with one of 20 pre-generated seed phrases, so the attackers knew the keys and later took the funds. Trezor said the supply chain attack happened over a year earlier.", "severity": "major", "type": "supply-chain", "sourceUrl": "https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155/", "sourceName": "Kaspersky" }, { "id": "bitbox-2023-05-phishing-from-leaked-list", "date": "2023-05-03", "company": "BitBox", "wallets": [], "title": "Fake BitBox update emails tied to the 2022 ActiveCampaign leak", "summary": "Some BitBox users received a well-formatted phishing email urging them to download a new BitBox version. BitBox said it was not sent from a BitBox address and was most likely tied to the ActiveCampaign leak from July 2022.", "severity": "major", "type": "phishing", "sourceUrl": "https://groups.google.com/a/shiftcrypto.ch/g/security-announce/c/r30szplKUAg", "sourceName": "Shift Crypto security announcements" }, { "id": "keepkey-2023-03-cve-2023-27892-memory-exfiltration", "date": "2023-03-07", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "CVE-2023-27892: Ethereum code could display device memory, including the seed", "summary": "Christian Reitter found that Ethereum processing code added in firmware v7.5.2 could be used to show confidential device memory on the KeepKey screen, revealing the seed of an unlocked device. KeepKey fixed it in firmware v7.7.0.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-CVE-2023-27892/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "trezor-2023-02-fake-breach-sms-email-phishing", "date": "2023-02-27", "company": "Trezor", "wallets": [], "title": "SMS and email phishing claimed a fake Trezor data breach", "summary": "Starting February 27, 2023, Trezor customers received SMS and email messages claiming Trezor had suffered a data breach and linking to a fake site that asked for the seed phrase. Trezor warned users and said it found no evidence of a recent database breach.", "severity": "minor", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/trezor-warns-of-massive-crypto-wallet-phishing-campaign/", "sourceName": "BleepingComputer" }, { "id": "blockstream-2023-02-jade-evil-maid", "date": "2023-02-15", "company": "Blockstream", "wallets": [ "jade" ], "title": "Ledger Donjon decrypted original Jade firmware via side-channel attack", "summary": "Ledger Donjon showed that an attacker with a stolen original Jade could recover the ESP32 flash encryption key through power analysis, decrypt the firmware, and inject malicious code in an evil maid attack. On a Jade, the team collected around 500K traces in 2 hours to attack the key.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet", "sourceName": "Ledger Donjon: Evil-Maid Attacks on Blockstream Jade" }, { "id": "onekey-2023-02-unciphered-mini-seed-extraction", "date": "2023-02-10", "company": "OneKey", "wallets": [ "onekey" ], "title": "Unciphered extracts the seed from a OneKey Mini in one second", "summary": "Unciphered showed that the OneKey Mini's processor and secure element communicated without encryption, so a tool placed between them could put the device in factory mode and read out the seed phrase. The attack required disassembling the device. OneKey said it had already patched the firmware without any users being affected.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://cointelegraph.com/news/onekey-says-it-s-fixed-the-flaw-that-got-its-hardware-wallet-hacked-in-1-second", "sourceName": "Cointelegraph" }, { "id": "trezor-2023-02-xss-in-trezor-connect-legacy-versions", "date": "2023-02-07", "company": "Trezor", "wallets": [], "title": "XSS in legacy Trezor Connect versions", "summary": "Deprecated Trezor Connect versions still served for legacy integrations contained XSS flaws similar to those reported in August 2020. Trezor fixed it by removing those versions.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/xss-in-trezor-connect-legacy-versions", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2023-01-new-screen-oled-pin-leak", "date": "2023-01-19", "company": "Ledger", "wallets": [ "ledger-nano-x", "ledger-nano-s-plus" ], "title": "New Nano X and Nano S Plus screen needed a redesigned PIN pad", "summary": "Ledger Donjon said the newer screen used in the Nano X and Nano S Plus needed stronger defenses against the OLED power side channel that can leak PIN digits. Ledger shipped a new PIN entry screen whose power pattern does not depend on the PIN typed.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/blog/new-pin-screen", "sourceName": "Ledger Donjon" }, { "id": "specter-2022-12-desktop-tarfile-traversal", "date": "2022-12-07", "company": "Specter", "wallets": [], "title": "Specter Desktop patched a tarfile path traversal flaw (CVE-2007-4559)", "summary": "Trellix researchers found an unsanitized tarfile extractall() call in Specter Desktop, which a crafted .tar file could use for a directory path traversal attack. Their patch checks that every archive member extracts safely before extracting.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/cryptoadvance/specter-desktop/pull/1927", "sourceName": "Specter Desktop GitHub: CVE-2007-4559 Patch" }, { "id": "specter-2022-10-desktop-spellcheck-leak", "date": "2022-10-17", "company": "Specter", "wallets": [], "title": "Specter Desktop disabled spellcheck that could send input to third parties", "summary": "Specter Desktop added spellcheck=\"false\" to all its input fields after a report that browser spellcheck features could send typed data to a third-party spell checker. The project noted that all data in Specter is sensitive.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://github.com/cryptoadvance/specter-desktop/pull/1892", "sourceName": "Specter Desktop GitHub: Privacy Fix: Fix possible Chrome data leakage by disabeling spellcheck" }, { "id": "ledger-2022-08-lsb018-vault-hsm", "date": "2022-08-05", "company": "Ledger", "wallets": [], "title": "Ledger Vault HSM firmware command flaw hotfixed (LSB 018)", "summary": "A pentest firm commissioned by Ledger found a flaw that would let an attacker with high privileges perform business operations on the Vault HSMs. Ledger deployed hotfixes for it and a variant and said it was not exploited.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/018/", "sourceName": "Ledger Donjon" }, { "id": "coinkite-2022-07-virtual-disk-wraparound", "date": "2022-07-29", "company": "Coinkite", "wallets": [], "title": "Coldcard Mk4 Virtual Disk boundary error exposed PSRAM blocks", "summary": "An off-by-four boundary in the Mk4 Virtual Disk exposed four extra 512-byte blocks that wrapped to the area of PSRAM where a PSBT could be stored. Coinkite found it internally, found no exploit, and fixed it in firmware 5.0.6; Virtual Disk is disabled by default.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "bitbox-2022-07-activecampaign-breach", "date": "2022-07-21", "company": "BitBox", "wallets": [], "title": "BitBox mailing list stolen from ActiveCampaign and used for phishing", "summary": "An unauthorized party downloaded BitBox's email lists from its marketing provider ActiveCampaign, exposing names or aliases, email addresses, and IP addresses of subscribers and recent buyers. Phishing emails followed. Shipping data, wallets, and the BitBoxApp were not affected.", "severity": "major", "type": "data-breach", "sourceUrl": "https://blog.bitbox.swiss/en/data-breach-of-marketing-platform-activecampaign/", "sourceName": "BitBox blog: Data breach of marketing platform ActiveCampaign" }, { "id": "ledger-2022-07-lsb017-hw1-keycard-bypass", "date": "2022-07-06", "company": "Ledger", "wallets": [], "title": "Keycard bypass on discontinued Ledger HW.1 and Nano (LSB 017)", "summary": "Niv Yehezkel of Hexagate found the keycard replacement on the HW.1 and original Ledger Nano lacked brute-force protection, so an attacker with the PIN and physical access could replace the keycard and sign transactions. The products were discontinued and no fix was provided.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/017/", "sourceName": "Ledger Donjon" }, { "id": "bitbox-2022-06-windows-installer-taskkill", "date": "2022-06-21", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "BitBoxApp Windows installer could run planted malware with admin rights", "summary": "Dmitry Zemlyakov reported through the bug bounty program on 21 May 2022 that the BitBoxApp installer for Windows called the taskkill command in a way that could run a file named taskkill placed in the same folder. The installer could then run malware with admin privileges. The Rothorn update stopped calling taskkill, and Shift Crypto found no evidence of exploitation.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bitbox.swiss/blog/bitbox-06-2022-rothorn-update/", "sourceName": "BitBox blog: BitBox 06.2022 Rothorn update" }, { "id": "keepkey-2022-04-cve-2022-30330-supervisor", "date": "2022-04-26", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "CVE-2022-30330: KeepKey supervisor flaws fixed in bootloader 2.1.4", "summary": "Christian Reitter reported vulnerabilities in the KeepKey supervisor. ShapeShift fixed them in bootloader bl_v2.1.4 and firmware v7.3.2.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-CVE-2022-30330/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "keepkey-2022-04-vuln-22003-message-state", "date": "2022-04-26", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "VULN-22003: KeepKey message state handling flaw", "summary": "Christian Reitter found that KeepKey wallet functions could be triggered at times when they should not be available, which under limited conditions could trick users into accepting unwanted actions. ShapeShift patched it in firmware v7.3.2.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-VULN-22003/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "trezor-2022-04-mailchimp-newsletter-phishing", "date": "2022-04-03", "company": "Trezor", "wallets": [], "title": "Compromised MailChimp newsletter list used to send fake Trezor Suite", "summary": "Trezor owners received fake data breach notices sent through Trezor's opt-in newsletter hosted at MailChimp. The emails linked to a lookalike domain serving a modified Trezor Suite that asked for the seed phrase and sent it to the attackers.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/", "sourceName": "BleepingComputer" }, { "id": "onekey-2022-03-trojanized-app-clones", "date": "2022-03-24", "company": "OneKey", "wallets": [], "title": "Trojanized OneKey app clones stole seed phrases", "summary": "ESET found trojanized Android and iOS wallet apps, including a fake OneKey Android app, distributed through websites that mimicked the real services. The malicious apps were built to steal victims' seed phrases. OneKey's own apps and devices were not compromised.", "severity": "minor", "type": "phishing", "sourceUrl": "https://www.welivesecurity.com/2022/03/24/crypto-malware-patched-wallets-targeting-android-ios-devices/", "sourceName": "ESET (WeLiveSecurity)" }, { "id": "trezor-2022-01-joe-grand-model-one-pin-recovery", "date": "2022-01-26", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Joe Grand glitches old Trezor One firmware to recover a lost PIN", "summary": "Hardware hacker Joe Grand used a fault injection attack on a Trezor One running old firmware to read its PIN from RAM and recover the owner's funds. Trezor said the flaw was older and already fixed for newer devices.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://cointelegraph.com/news/engineer-hacks-trezor-wallet-recovers-2m-in-lost-crypto", "sourceName": "Cointelegraph" }, { "id": "bitbox-2022-01-microsd-restore-disguise", "date": "2022-01-18", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "Tampered microSD and fake app could disguise a BitBox02 restore", "summary": "Before firmware v9.9.0, a compromised microSD card combined with a malicious BitBoxApp could make a restore from an attacker's backup look like a new wallet setup. BitBox found the issue itself, rated it low risk, and now requires on-device confirmation of any restore.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://groups.google.com/a/shiftcrypto.ch/g/security-announce/c/6wb7MmwpOZA", "sourceName": "Shift Crypto security announcements" }, { "id": "safepal-2021-09-fake-firefox-extension", "date": "2021-09-30", "company": "SafePal", "wallets": [], "title": "Fake 'SafePal Wallet' Firefox add-on stole users' funds", "summary": "A malicious add-on posing as a SafePal Wallet extension was listed on the Mozilla add-ons store until community reports led Mozilla to remove it. SafePal warned users that the only legitimate SafePal Wallet download is on its own site and that fake websites, support sites and social media accounts remained active.", "severity": "minor", "type": "phishing", "sourceUrl": "https://www.safepal.com/en/blog/scam-alert-beware-of-malicious-safepal-wallet-applications", "sourceName": "SafePal" }, { "id": "blockstream-2021-08-jade-derived-key-zeroing", "date": "2021-08-30", "company": "Blockstream", "wallets": [ "jade" ], "title": "Jade 0.1.27 fixed derived keys possibly left in memory after a failure", "summary": "Jade firmware 0.1.27 fixed a potential issue where a derived key might not be wiped from memory after a failure. The changelog gives no further detail and reports no exploitation.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/Blockstream/Jade/blob/master/CHANGELOG.md", "sourceName": "Blockstream Jade GitHub: CHANGELOG.md (0.1.27)" }, { "id": "trezor-2021-07-insufficient-field-size-check-in-protobuf", "date": "2021-07-12", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Stellar transaction could be disguised as ManageData on Model One", "summary": "Without a field size check, an attacker could trick a user into signing a Stellar transaction that moved assets while appearing to be a ManageData transaction. Fixed in firmware 1.10.3.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/insufficient-field-size-check-in-protobuf-1", "sourceName": "Trezor Security Portal" }, { "id": "keepkey-2021-07-vuln-21020-glitching", "date": "2021-07-09", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "VULN-21020: glitching attack on KeepKey firmware protections", "summary": "Christian Reitter disclosed an electrical glitching attack against KeepKey firmware protections that needs physical possession and specialized tools. ShapeShift published an advisory and the first correctly patched version is firmware v7.1.7.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-glitching-vuln-21020/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "ledger-2021-06-mailed-fake-nano-x", "date": "2021-06-16", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Tampered fake Nano X devices mailed to leaked customers", "summary": "Scammers mailed fake replacement Nano X devices to customers exposed in the data leak, with a letter citing the leak. The device had a flash drive wired to its USB connector and instructions to run an app and enter the seed phrase.", "severity": "major", "type": "supply-chain", "sourceUrl": "https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency", "sourceName": "BleepingComputer" }, { "id": "coinkite-2021-06-mk3-double-laser", "date": "2021-06", "company": "Coinkite", "wallets": [], "title": "Ledger Donjon laser attack chain recovered a Coldcard Mk3 seed", "summary": "Ledger Donjon read protected ATECC608A secure-element data in the Coldcard Mk3 with two laser faults, and seed recovery also needed a separate attack on the STM32 microcontroller. In a later practical result, one of three challenge-wallet seeds was recovered in a specialist lab. Mk3 received no retrofit.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "ledger-2021-05-lsb016-scp-length-extension", "date": "2021-05-17", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Length-extension attack on device secure channel (LSB 016)", "summary": "Timothée Isnard found a length-extension attack on the secure channel between Nano devices and Ledger's HSMs that, combined with a padding oracle, could decrypt a block of app data or firmware updates. Ledger said device security was not affected; fixes shipped in Nano S 2.0.0 and Nano X 1.3.0.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/016/", "sourceName": "Ledger Donjon" }, { "id": "keepkey-2021-05-faulty-stack-canary", "date": "2021-05-07", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "Compiler bug left KeepKey stack protection bypassable (VULN-21013)", "summary": "Christian Reitter found that a bug in some GCC 9 and 10 ARM compilers produced broken stack canary checks in KeepKey firmware v6.4.0 to v7.1.1, so stack smashing attacks could get past them. Fixed firmware starts at v7.1.2.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/faulty-stack-canary-arm-systems/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "trezor-2021-05-faulty-stack-canary", "date": "2021-05-07", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Compiler bug weakened stack protection in 2020 Trezor firmware", "summary": "The same GCC compiler bug that broke KeepKey's stack canaries also affected Trezor One firmware 1.9.0 to 1.9.3 and Trezor T firmware 2.2.0 to 2.3.4. A newer compiler had already fixed the issue in Trezor's 2021 releases.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/faulty-stack-canary-arm-systems/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "bitbox-2021-04-fake-bitboxapp-site", "date": "2021-04-08", "company": "BitBox", "wallets": [], "title": "Fake BitBoxApp phishing website", "summary": "Shift Crypto warned that a new phishing website posing as the BitBoxApp had appeared and said it was working to take it down. It reminded users that sharing the microSD backup or the seed phrase hands over all their coins.", "severity": "minor", "type": "phishing", "sourceUrl": "https://groups.google.com/a/shiftcrypto.ch/g/security-announce/c/q6G6lYhdisU", "sourceName": "Shift Crypto security announcements: Beware: fake BitBoxApp phishing website" }, { "id": "trezor-2021-04-fake-trezor-mobile-apps", "date": "2021-04-06", "company": "Trezor", "wallets": [], "title": "Fake Trezor apps on App Store and Google Play stole bitcoin", "summary": "A fake Trezor app on Apple's App Store was downloaded 1,000 times before removal, and a similar fake appeared on Google Play. One victim lost 17.1 bitcoin after entering his details. Trezor had no official mobile app at the time.", "severity": "critical", "type": "phishing", "sourceUrl": "https://www.malwarebytes.com/blog/social-engineering/2021/04/fake-trezor-app-steals-more-that-1-million-worth-of-crypto-coins/", "sourceName": "Malwarebytes" }, { "id": "keepkey-2021-04-cve-2021-31616-stack-overflow", "date": "2021-04", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "CVE-2021-31616: stack overflow in firmware 7.0.3 allowed key theft", "summary": "A stack buffer overflow introduced in KeepKey firmware v7.0.3 let remote or local attackers run code on the device and steal wallet keys, for example from a malicious website. It was patched in v7.1.0 after Christian Reitter's disclosure.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-CVE-2021-31616/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "keystone-2021-03-cobo-vault-tamper-bypass", "date": "2021-03-01", "company": "Keystone", "wallets": [], "title": "Researcher bypasses Cobo Vault Pro self-destruct tamper sensor", "summary": "Nick Johnson cut the backup battery wire and bridged the tamper pads on a Cobo Vault Pro, the device later sold as Keystone, and it booted without detecting the tampering. He described how an attacker could then load modified firmware for a supply chain or evil maid attack. He also found a tamper-evident seal on the packaging came unstuck in the post without leaving void marks.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/swlh/defeating-the-cobo-vault-pros-self-destruct-mechanism-abf321e2f5b5", "sourceName": "Nick Johnson (The Startup, Medium)" }, { "id": "coinkite-2021-03-unreleased-usb-repl", "date": "2021-03", "company": "Coinkite", "wallets": [], "title": "Unreleased Coldcard 4.0.0 build left the USB Python console enabled", "summary": "Internal Coldcard firmware 4.0.0 enabled a USB serial console that let a connected host enter the MicroPython REPL after login and reach firmware secrets. Coinkite says 4.0.0 was never released publicly and 4.0.1 shipped with the console disabled.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite" }, { "id": "safepal-2021-02-kraken-tamper-downgrade", "date": "2021-02-16", "company": "SafePal", "wallets": [ "safepal-s1" ], "title": "Kraken finds weak tamper detection and firmware downgrade on SafePal S1", "summary": "Kraken Security Labs found the SafePal S1's tamper detection could be bypassed by reconnecting a single pin, and that an older firmware could be flashed back without detection. Kraken did not steal funds from the device. SafePal released firmware V1.0.24 to fix the downgrade issue.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.kraken.com/product/security/kraken-security-labs-finds-flaws-in-safepal-s1-hardware-wallet", "sourceName": "Kraken Security Labs" }, { "id": "coinkite-2021-02-multisig-xpub-substitution", "date": "2021-02-09", "company": "Coinkite", "wallets": [], "title": "Coldcard multisig registration accepted attacker-controlled xpubs", "summary": "Coldcard did not require one registered multisig xpub to belong to the device, so a compromised coordinator could substitute attacker-controlled xpubs while the wallet looked verified. Hugo Nguyen and Marko Bencun reported it privately on November 7, 2020, and it was fixed in firmware 3.2.1 before publication.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "ellipal-2021-01-towo-labs-xrp-app", "date": "2021-01-18", "company": "Ellipal", "wallets": [], "title": "Towo Labs finds XRP signing flaws in the Ellipal wallet app", "summary": "In August 2020 Towo Labs reported flaws in Ellipal's website and in the XRP support of the Ellipal wallet app. The app did not display XRP fields such as the destination tag and did not block unsupported transaction types, which could let an attacker take over an account. Ellipal fixed the XRP issues in version v2.8.1, paid a bounty, and said cold wallet users could always check transfer details before signing.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://www.ellipal.com/blogs/security-research/ellipal-vulnerability-study-by-towo-lab", "sourceName": "Ellipal: ELLIPAL Vulnerability Study by Towo Labs" }, { "id": "ledger-2021-01-phishing-phone-calls", "date": "2021-01-15", "company": "Ledger", "wallets": [], "title": "Leaked customers targeted by phishing phone calls", "summary": "Following the database leak, Ledger owners reported phishing voice calls offering to help secure their Ledger. Andreas Antonopoulos said he received reports of dozens of such calls from across Europe.", "severity": "major", "type": "phishing", "sourceUrl": "https://decrypt.co/54319/ledger-users-get-phishing-phone-calls-after-database-leak", "sourceName": "Decrypt" }, { "id": "ledger-2021-01-lsb015-eth-data-display", "date": "2021-01-13", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Ethereum app 1.6.0 hid transaction data (LSB 015)", "summary": "A regression in Ethereum app 1.6.0 stopped the Contract data debug option from showing transaction data, so a compromised third-party client could get users to sign hidden data. Ledger Live was not affected, and app 1.6.4 fixed it.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/015/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2021-01-shopify-insider-leak", "date": "2021-01-13", "company": "Ledger", "wallets": [], "title": "Shopify insiders behind leak; total affected rose to 292,000", "summary": "Ledger disclosed that rogue members of Shopify's support team obtained its customers' records between April and June 2020, and Shopify reported a further 20,000 affected customers. The total reached about 292,000, and Ledger set up a 10 bitcoin bounty.", "severity": "major", "type": "data-breach", "sourceUrl": "https://decrypt.co/53961/bitcoin-wallet-ledger-discovers-full-extent-hack", "sourceName": "Decrypt" }, { "id": "ledger-2020-12-customer-database-dump", "date": "2020-12-21", "company": "Ledger", "wallets": [], "title": "Leaked database exposed 272,000 customers' addresses and phones", "summary": "A Ledger customer database was dumped on RaidForums, showing that about 272,000 customers' names, postal addresses and phone numbers had leaked, far more than the 9,532 Ledger had identified. Ledger said the data came from its June 2020 e-commerce database.", "severity": "major", "type": "data-breach", "sourceUrl": "https://www.ledger.com/message-ledgers-ceo-data-leak", "sourceName": "Ledger" }, { "id": "ledger-2020-12-extortion-emails", "date": "2020-12-21", "company": "Ledger", "wallets": [], "title": "Leaked Ledger customers received violent ransom threats", "summary": "After the customer database dump, Ledger customers received emails demanding bitcoin under threat of physical violence. One customer was told to pay $500 or face a home invasion.", "severity": "major", "type": "phishing", "sourceUrl": "https://decrypt.co/52136/ledger-customers-now-getting-threatening-emails-for-bitcoin-ransoms", "sourceName": "Decrypt" }, { "id": "coolwallet-2020-12-bluetooth-seed-replay", "date": "2020-12-18", "company": "CoolWallet", "wallets": [], "title": "CoolWallet S Bluetooth flaw could leak seeds to a nearby attacker", "summary": "CoolBitX disclosed a flaw in the encrypted Bluetooth protocol of the CoolWallet S, reported by KK8. An attacker within 30 meters with a second prepared CoolWallet could intercept private information when a user created or recovered a wallet through an outdated app. The fix shipped in app version 2.9.1 and card firmware 106.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.coolwallet.io/blogs/blog/bluetooth-security-vulnerability-seed-replay-attack", "sourceName": "CoolWallet" }, { "id": "coinkite-2020-11-testnet-isolation-bypass", "date": "2020-11-24", "company": "Coinkite", "wallets": [], "title": "Coldcard testnet mode could be used to sign real mainnet spends", "summary": "Shift Crypto showed that a compromised computer could send a real mainnet transaction to a Coldcard in testnet mode, so the user would approve what looked like a testnet payment while spending real bitcoin. Shift reported it to Coinkite on August 4th, 2020 and published after the 90-day embargo lapsed without a released firmware update.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://benma.github.io/2020/11/24/coldcard-isolation-bypass.html", "sourceName": "Shift Crypto (Marko Bencun): Coldcard isolation bypass" }, { "id": "skycoin-2020-11-missed-trezor-patches", "date": "2020-11-19", "company": "Skycoin", "wallets": [], "title": "Skycoin firmware missed two old Trezor security patches", "summary": "Christian Reitter found that Skycoin's firmware still contained a USB receive buffer overflow and a BIP39 recovery stack overflow that had been fixed upstream in Trezor. Skycoin patched its main branch on 2020-09-07 and paid a bug bounty.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/skycoin-firmware-vuln2/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "keepkey-2020-10-segwit-fee-attack", "date": "2020-10-01", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "KeepKey 6.5.1 fixed the SegWit double-signing attack (CVE-2020-14199)", "summary": "KeepKey firmware 6.5.1 mitigated CVE-2020-14199, which could let an attacker trick a user into signing two transactions that move funds in an unintended way. The device now warns when the inputs of two similar transactions change. The same release mitigated a passphrase ransom attack and the OLED side channel, all reported through ShapeShift's Responsible Disclosure Program.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://shapeshift.com/library/keepkey-firmware-update-6-5-1", "sourceName": "ShapeShift: KeepKey firmware update 6.5.1" }, { "id": "ledger-2020-10-fake-breach-phishing", "date": "2020-10", "company": "Ledger", "wallets": [], "title": "Fake breach emails pushed a trojanized Ledger Live", "summary": "Starting in October 2020, Ledger users received fake data breach emails linking to Punycode lookalike domains. The desktop download was a fake Ledger Live that asked for the seed phrase and sent it to the attackers.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-data-breach-alerts-used-to-steal-ledger-cryptocurrency-wallets/", "sourceName": "BleepingComputer" }, { "id": "coolwallet-2020-09-on-card-address-verification", "date": "2020-09-10", "company": "CoolWallet", "wallets": [], "title": "CoolWallet S firmware 101 adds on-card checks against app address swaps", "summary": "CoolBitX said attacks on hardware wallet users could swap addresses and coins inside the companion app without the user noticing. SE firmware 101 and a matching app update let the CoolWallet S show the address and token on its e-ink screen so users can verify transactions on the card.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.coolwallet.io/blogs/blog/coolwallet-s-secure-element-firmware-app-updates", "sourceName": "CoolWallet: CoolWallet S Secure Element Firmware + App Updates" }, { "id": "keepkey-2020-09-passphrase-ransom", "date": "2020-09-02", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "KeepKey accepted host-entered passphrases without on-device confirmation", "summary": "Shift Crypto disclosed that the KeepKey, like the Trezor, used a passphrase entered on the computer without confirming it on the device. A malicious wallet could substitute its own passphrase and hold coins received in that wallet for ransom. Shift Crypto reported it to ShapeShift on May 7, 2020 and later noted that ShapeShift fixed the issue.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.bitbox.swiss/en/a-ransom-attack-on-trezors-and-keepkeys-passphrase-handling/", "sourceName": "BitBox blog: A ransom attack on Trezor's and KeepKey's passphrase handling" }, { "id": "trezor-2020-09-passphrase-ransom-attack", "date": "2020-09-02", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Remote ransom attack on Trezor passphrase entry on the computer", "summary": "Shift Crypto showed that the Trezor One before v1.9.3 and the Model T before v2.3.3 were open to a remote ransom attack when users typed their passphrase on the computer or phone. It reported the issue to SatoshiLabs on April 15th, 2020, and Trezor released the fixes on September 2nd, 2020.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.bitbox.swiss/en/a-ransom-attack-on-trezors-and-keepkeys-passphrase-handling/", "sourceName": "Shift Crypto: A ransom attack on Trezor's and KeepKey's passphrase handling" }, { "id": "skycoin-2020-08-firmware-memory-bugs", "date": "2020-08-08", "company": "Skycoin", "wallets": [], "title": "Fuzzing found 13 memory safety issues in Skycoin hardware wallet firmware", "summary": "Christian Reitter fuzzed the Skycoin hardware wallet, a fork of the Trezor One code, and reported 13 issues including out of bounds writes and information leaks. He said none appeared to be a practical threat to users, and most were patched.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/skycoin-firmware-vuln/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "ledger-2020-08-lsb014-path-derivation", "date": "2020-08-04", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Bitcoin derivative apps could sign on the Bitcoin path (LSB 014)", "summary": "Researcher monokh found that the Bitcoin app and most of its derivatives had no derivation path restriction, so an app such as Litecoin could derive keys or sign Bitcoin transactions. Ledger missed its 90-day disclosure deadline and fixed it in Bitcoin app 1.4.6.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/014/", "sourceName": "Ledger Donjon" }, { "id": "trezor-2020-08-xss-in-trezor-connect", "date": "2020-08-03", "company": "Trezor", "wallets": [], "title": "XSS in Trezor Connect", "summary": "A security researcher reported XSS issues in Trezor Connect in August 2020. Trezor fixed and deployed the issues shortly after.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/xss-in-trezor-connect", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2020-07-ecommerce-data-breach", "date": "2020-07-29", "company": "Ledger", "wallets": [], "title": "E-commerce and marketing database breached", "summary": "An unauthorized party used an API key to access Ledger's e-commerce and marketing database on June 25, 2020. About 1M email addresses were exposed, plus names, postal addresses and phone numbers for a subset of 9500 customers.", "severity": "major", "type": "data-breach", "sourceUrl": "https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach", "sourceName": "Ledger" }, { "id": "trezor-2020-07-missing-path-isolation-check", "date": "2020-07-14", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Missing path isolation check on Model One", "summary": "Without a path isolation check, an attacker could trick a user into signing a Bitcoin transaction while the user believed it was a testnet or altcoin transaction. Fixed in firmware 1.9.2.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/missing-path-isolation-check", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2020-07-lsb013-nano-x-debug-interface", "date": "2020-07-09", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Nano X MCU debug interfaces left enabled (LSB 013)", "summary": "Kraken Security Labs reported that JTAG/SWD debug interfaces were enabled on the Nano X STM32WB55 MCU, allowing a supply chain attacker to reflash it. The Secure Element was not affected, and firmware 1.2.4-2 added a full MCU integrity check at boot.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/013/", "sourceName": "Ledger Donjon" }, { "id": "coinkite-2020-07-keypad-rescramble", "date": "2020-07-03", "company": "Coinkite", "wallets": [], "title": "Coldcard scrambled keypad was not re-scrambled after login delay", "summary": "With the scrambled keypad and login delay enabled, the PIN-entry layout was not re-scrambled after the forced delay ended. An anonymous customer reported it, and firmware 3.1.4 fixed it and changed scrambling between the PIN prefix and suffix.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "ledger-2020-07-lsb012-rbf-balance", "date": "2020-07-02", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Ledger Live counted cancelled RBF payments in balance (LSB 012)", "summary": "Zengo researchers found Ledger Live added unconfirmed incoming bitcoin transactions to the balance and did not remove them when replaced via RBF, so users could believe they had been paid. Ledger Live 2.7.0 fixed it.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/012/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2020-06-lsb011-xrp-account-misuse", "date": "2020-06-09", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "XRP app hid the signing account field (LSB 011)", "summary": "Towo Labs researchers found the XRP app did not display the Account field, so compromised client software could get a user to sign from a different account, and it also allowed malleable signatures. XRP app 2.0.1 fixed both issues.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/011/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2020-06-lsb010-bip143-fees", "date": "2020-06-03", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Bitcoin app allowed hidden fee increases via BIP-143 (LSB 010)", "summary": "Saleem Rashid found a BIP-143 flaw in the Bitcoin app and its derivatives that let compromised client software raise transaction fees without confirmation on the device if the user signed twice. It was fixed in Bitcoin app 1.4.0.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/010/", "sourceName": "Ledger Donjon" }, { "id": "bitbox-2020-06-segwit-fee-attack", "date": "2020-06-03", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "BitBox02 could be tricked into signing SegWit transactions with huge fees", "summary": "Saleem Rashid reported that malicious wallet software could get a user to sign a SegWit transaction twice and combine the signatures into one paying excessive fees. The flaw affected all hardware wallets supporting SegWit, and a joint fix was released on 3 June 2020 in BitBox02 firmware 8.0. Shift found no evidence of exploitation.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shiftcrypto/bitbox-app-firmware-update-6-2020-c70f733a5330", "sourceName": "Shift Crypto: BitBox app & firmware update 6/2020" }, { "id": "coinkite-2020-06-bip143-input-amount", "date": "2020-06", "company": "Coinkite", "wallets": [], "title": "SegWit input-amount attack could push Coldcard funds into miner fees", "summary": "Public cross-wallet research showed that a malicious PSBT and signing sequence could show misleading input amounts and redirect value to miner fees. Coinkite says it received no advance notice and blocked the attack class in firmware 3.1.4. No public Coldcard loss was found.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "keepkey-2020-05-donjon-pin-side-channel", "date": "2020-05-18", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "Ledger Donjon recovers KeepKey PIN with a side-channel attack", "summary": "Ledger Donjon mounted a two-step side-channel attack on KeepKey PIN verification that exposes the PIN to an attacker with physical access. It works because KeepKey stores secrets on the general-purpose STM32F205 chip.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/blog/keepkey-side-channel-attack", "sourceName": "Ledger Donjon" }, { "id": "coinkite-2020-05-mk2-pin-laser", "date": "2020-05-18", "company": "Coinkite", "wallets": [], "title": "Ledger Donjon extracted Coldcard Mk2 PIN with laser fault injection", "summary": "Ledger Donjon used laser fault injection on the Microchip ATECC508A chip in the Coldcard Mk2 to read the stored PIN code hash, which can then be brute forced offline. With the PIN, an attacker holding the device could access the bitcoin it manages. The attack requires physical access, equipment worth over $200,000, and expert knowledge.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/improving-the-ecosystem-disclosing-coldcards-pin-vulnerability", "sourceName": "Ledger: Disclosing ColdCard Mk2 PIN Vulnerability" }, { "id": "coinkite-2020-05-factory-reset-supply-chain", "date": "2020-05-12", "company": "Coinkite", "wallets": [], "title": "Tampered Coldcard could be made to look new and unused", "summary": "Researchers sedited and TheCharlatan showed that modified firmware could clear the main PIN and restore the first-use flow while keeping the original bag number, so a tampered unit could appear unused. Coinkite pointed to firmware verification and first-use checks; there was no retrofit to the immutable bootloader.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "ledger-2020-04-lsb009-monero-funds-lockup", "date": "2020-04-30", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Monero app did not show transaction unlock time (LSB 009)", "summary": "The Monero app did not verify the unlock time field, so an attacker could get a user to sign a transaction locking funds for a very long time. It affected Nano S and Nano X and was fixed in Monero app 1.6.0 with protocol version 3.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/009/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2020-04-lsb008-monero-key-retrieval", "date": "2020-04-27", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Second Monero spend key extraction flaw (LSB 008)", "summary": "Dušan Klinec found further flaws in the Monero app protocol that let a malicious Monero client extract the private spend key (CVE-2020-6861). It affected Nano S and Nano X users and was fixed from Monero app 1.5.1.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/008/", "sourceName": "Ledger Donjon" }, { "id": "bc-vault-2020-04-button-side-channel", "date": "2020-04-04", "company": "BC Vault", "wallets": [], "title": "BC Vault One leaks button presses through electrical noise", "summary": "Christian Reitter found that the BC Vault One emits different electrical noise depending on pressure on its case, which a hardware implant on the USB line could use to capture PIN entry. He reported the side channel was still present in firmware 1.3.7 and knew of no vendor mitigation. The device was also affected by the 2019 OLED side channel, with minor impact.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/bc-vault-one-button-side-channel/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "coolwallet-2020-04-kraken-android-plaintext-seed", "date": "2020-04-03", "company": "CoolWallet", "wallets": [], "title": "Kraken finds CoolWallet S Android app stored seed and PIN in plaintext", "summary": "Kraken Security Labs found that the CoolWallet S Android app stored the wallet's PIN, pairing password and hardware seed in plaintext, so a stolen or infected phone could empty the paired wallet. Kraken disclosed the issue to CoolBitX on January 2 and the company released app fixes. Kraken noted that PIN checks still run on the phone rather than the card.", "severity": "major", "type": "app-flaw", "sourceUrl": "https://blog.kraken.com/product/security/inside-kraken-security-labs-flaws-found-in-coolwallet-s-hardware-wallets", "sourceName": "Kraken Security Labs" }, { "id": "trezor-2020-03-malicious-change-in-mixed-transactions-3", "date": "2020-03-07", "company": "Trezor", "wallets": [], "title": "Model T multisig change output could go unconfirmed (input sanitization)", "summary": "A crafted multisig transaction could exploit inconsistent input sanitization on Model T to include an attacker change output the user never confirmed. Reported by Saleem Rashid.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/malicious-change-in-mixed-transactions-3", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2020-03-fake-chrome-extension", "date": "2020-03-06", "company": "Ledger", "wallets": [], "title": "Fake Ledger Live Chrome extension phished seed phrases", "summary": "A malicious Chrome extension named Ledger Live asked users to enter their seed phrase. It was downloaded at least 120 times before removal, and Ledger warned users on March 5.", "severity": "major", "type": "phishing", "sourceUrl": "https://cointelegraph.com/news/ledger-wallet-warns-of-fake-google-chrome-extension-stealing-crypto", "sourceName": "Cointelegraph" }, { "id": "trezor-2020-03-insufficient-field-size-check-in-protobuf", "date": "2020-03-05", "company": "Trezor", "wallets": [], "title": "Model T protobuf prevhash flaw could hide an output", "summary": "A crafted transaction could hide, inside a very long prevhash, an output sending all funds to an attacker. The result would be non-standard, so an attacker would need to mine their own block.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/insufficient-field-size-check-in-protobuf", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2020-03-op-return-treated-as-change-output", "date": "2020-03-05", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "OP_RETURN output shown without confirmation when treated as change", "summary": "The confirmation dialog for an OP_RETURN output was not displayed when the address_n field was provided. It affected Model One and Model T.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/op-return-treated-as-change-output", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2020-03-possible-large-transaction-fee-via-two", "date": "2020-03-03", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Two SegWit transactions could combine into a large fee", "summary": "Due to a design flaw in BIP-143, an attacker could create two SegWit transactions that together sent coins away as a large transaction fee. Fixed in firmware 1.9.1 for Model One and 2.3.1 for Model T.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/possible-large-transaction-fee-via-two-segwit-transactions", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2020-03-malicious-change-in-mixed-transactions-2", "date": "2020-03-02", "company": "Trezor", "wallets": [], "title": "Model T multisig change output could go unconfirmed (TOCTOU, March 2020)", "summary": "A crafted multisig transaction could use a time-of-check to time-of-use bug on Model T to include an attacker change output the user never confirmed. Reported by Saleem Rashid.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/malicious-change-in-mixed-transactions-2", "sourceName": "Trezor Security Portal" }, { "id": "coinkite-2020-02-trust-psbt-ignored", "date": "2020-02-27", "company": "Coinkite", "wallets": [], "title": "Coldcard ignored the multisig Trust PSBT setting", "summary": "The Trust PSBT setting for multisig wallets was ignored by Coldcard firmware. The fix shipped in firmware 3.1.2 and was credited to CasaHODL, with no public technical report or impact analysis.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "bc-vault-2020-02-daemon-certificate-key", "date": "2020-02-04", "company": "BC Vault", "wallets": [], "title": "BC Vault daemon shipped a trusted TLS certificate's private key", "summary": "BC Vault's local web daemon shipped the private key for a CA-signed localhost.bc-vault.com certificate inside its binary. BC Vault said the key could only help a phishing or DNS spoofing attack, revoked the certificate, and moved to per-installation certificates, with versions from 1.3.4 using plain localhost.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://bc-vault.com/2020/02/localhost-certificates-in-the-bc-vault-daemon/", "sourceName": "BC Vault: Localhost Certificates in the BC Vault Daemon" }, { "id": "trezor-2020-02-monero-unlock-time-issue", "date": "2020-02-01", "company": "Trezor", "wallets": [], "title": "Monero unlock_time not confirmed on Model T", "summary": "The Monero unlock_time field was not shown on the device, so an attacker could lock a user's funds for a very long time by setting a high value. It affected Model T.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/monero-unlock-time-issue", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2020-01-kraken-read-protection-downgrade", "date": "2020-01-31", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Kraken extracts seeds from Trezor One and Model T by voltage glitching", "summary": "Kraken Security Labs showed a voltage glitching attack that extracts the encrypted seed from Trezor One and Model T with about 15 minutes of physical access, then brute forces the PIN. It relies on flaws in the microcontroller; a strong passphrase prevents it. Kraken reported it to Trezor on October 30, 2019.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.kraken.com/product/security/kraken-identifies-critical-flaw-in-trezor-hardware-wallets", "sourceName": "Kraken Blog" }, { "id": "bitbox-2020-01-bitbox01-base64-memory-bugs", "date": "2020-01-28", "company": "BitBox", "wallets": [], "title": "BitBox01 base64 decoder had memory safety bugs", "summary": "Fuzzing by Christian Reitter found memory safety issues in the base64 library the BitBox01 used to decode USB messages from the host. Shift Cryptosecurity patched the decoder in BitBox01 firmware v7.0.4.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/base64-parser-issues/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "coinkite-2019-12-multisig-change-parser", "date": "2019-12-19", "company": "Coinkite", "wallets": [], "title": "Multisig parser flaw let attacker outputs pass as Coldcard change", "summary": "Dmitry Petukhov showed that appended script operations could make an attacker-controlled multisig output pass as wallet change, hiding it from the user. Firmware 3.0.6 simplified parsing and now displays all change outputs. Coinkite reported no evidence of exploitation.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "bitbox-2019-12-unlock-attempt-side-channel", "date": "2019-12-17", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "Side-channel attack could raise BitBox02 unlock attempt limit", "summary": "LazyNinja reported that a side-channel attack on the BitBox02 microcontroller could bypass the limit of 10 unlock attempts, letting an attacker with long physical access brute-force weak passwords. The secure chip still capped total attempts. Shift Crypto fixed it in firmware 5.0.0 and found no evidence of exploitation.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shiftcrypto/bitboxapp-4-16-0-with-bitbox02-firmware-5-0-0-release-7073ade23988", "sourceName": "Shift Crypto: BitBoxApp 4.16.0 with BitBox02 Firmware 5.0.0 Release" }, { "id": "keepkey-2019-12-kraken-seed-extraction", "date": "2019-12-10", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "Kraken extracts KeepKey seed by voltage glitching", "summary": "Kraken Security Labs extracted the encrypted seed from a KeepKey with about 15 minutes of physical access using voltage glitching, then brute forced the PIN. Kraken said the microcontroller flaw is hard to fix without a hardware redesign.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://blog.kraken.com/product/security/flaw-found-in-keepkey-crypto-hardware-wallet", "sourceName": "Kraken Blog" }, { "id": "archos-2019-12-safe-t-recovery-stack-overflow", "date": "2019-12-09", "company": "Archos", "wallets": [], "title": "Archos Safe-T kept an unpatched Trezor recovery stack overflow", "summary": "Christian Reitter found that the Trezor One dry-run recovery stack overflow, fixed by Trezor in June 2018, still caused memory and stack smashing faults on Archos Safe-T firmware 1.1.3. Archos had not responded to his reports as of 2019-12-09.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/trezor-one-dry-run-recovery-stack-overflow/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "bitbox-2019-11-bitbox02-oled-side-channel", "date": "2019-11-02", "company": "BitBox", "wallets": [ "bitbox02" ], "title": "OLED power side channel on BitBox02 (CVE-2019-18673)", "summary": "The BitBox02's OLED display leaks partial screen contents through its power consumption. A hardware implant in the USB cable could use this to try to recover the PIN or seed phrase while they are on screen, though the BitBox02 does not display the seed phrase by default.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2019-18673", "sourceName": "CVE record" }, { "id": "coinkite-2019-11-change-path-ransom", "date": "2019-11-01", "company": "Coinkite", "wallets": [], "title": "Coldcard change could be sent to an unrecoverable derivation path", "summary": "A malicious coordinator could send wallet-controlled change to a deeply derived path the owner could not practically reconstruct, enabling a ransom attack. Researchers sedited and TheCharlatan reported it, and firmware 3.0.2 constrained and validated derivation paths.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "coinkite-2019-11-receive-path-display", "date": "2019-11-01", "company": "Coinkite", "wallets": [], "title": "Coldcard derivation-path display could hide the true path off-screen", "summary": "Path parsing accepted whitespace and newlines, so the real tail of a derivation path could be pushed off the Coldcard screen. The same researchers reported it in the same report as the change-path issue, and firmware 3.0.2 fixed the parsing and display.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "bitbox-2019-10-bitbox01-mobile-pairing", "date": "2019-10-29", "company": "BitBox", "wallets": [], "title": "Two BitBox01 mobile pairing flaws fixed in firmware 7.0.3", "summary": "Saleem Rashid reported two vulnerabilities in the BitBox01's mobile pairing through the bug bounty program on 17 September 2019. Users who paired the BitBox01 with the mobile verification app were affected. BitBoxApp 4.14.0 shipped BitBox01 firmware 7.0.3 with the fix, and users had to pair their phone again after updating.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shiftcrypto/bitboxapp-4-14-0-5e72575b0819", "sourceName": "Shift Crypto: BitBoxApp 4.14.0" }, { "id": "ledger-2019-10-lsb007-monero-key-retrieval", "date": "2019-10-04", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "Monero app leaked the spend key to a malicious client (LSB 007)", "summary": "The Monero app was vulnerable to a replay attack in which a malicious Monero desktop client could extract the user's private spend key. It affected Nano S and Nano X users and was fixed in Monero app 1.5.1.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/007/", "sourceName": "Ledger Donjon" }, { "id": "trezor-2019-10-malicious-change-in-mixed-transactions-1", "date": "2019-10-01", "company": "Trezor", "wallets": [], "title": "Model T multisig change output could go unconfirmed (TOCTOU, 2019)", "summary": "A crafted multisig transaction could use a time-of-check to time-of-use bug on Model T to include an attacker change output the user never confirmed. Fixed in firmware 2.1.8.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/malicious-change-in-mixed-transactions-1", "sourceName": "Trezor Security Portal" }, { "id": "keepkey-2019-09-cve-2019-18671-usb-overflow", "date": "2019-09-19", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "CVE-2019-18671: USB receive buffer overflow fixed in 6.2.2", "summary": "Christian Reitter found a buffer overflow in the KeepKey USB receive buffer by fuzzing. ShapeShift fixed it in firmware v6.2.2 in September 2019.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-CVE-2019-18671/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "keepkey-2019-09-cve-2019-18672-key-erasure", "date": "2019-09-19", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "CVE-2019-18672: key erasure could weaken KeepKey U2F protection", "summary": "A flaw let an attacker erase a cryptographic key and compromise the U2F second-factor protection of the KeepKey. It was fixed in firmware v6.2.2 in September 2019.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "ledger-2019-08-lsb006-oled-side-channel", "date": "2019-08-07", "company": "Ledger", "wallets": [ "ledger-nano-x" ], "title": "OLED screen power side channel could leak displayed secrets (LSB 006)", "summary": "Christian Reitter found that power consumption of the OLED display on the Nano S and Nano X varies with lit pixels, which could in theory let a USB cable implant recover the PIN or seed phrase. Ledger rated it non-critical and said it was not demonstrated in practice (CVE-2019-14354).", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/006/", "sourceName": "Ledger Donjon" }, { "id": "coinkite-2019-08-oled-side-channel", "date": "2019-08-07", "company": "Coinkite", "wallets": [], "title": "OLED power side channel could leak parts of the Coldcard display", "summary": "Christian Reitter found that OLED power consumption on Mk1 and Mk2 devices might reveal partial screen contents, such as the PIN or seed words, through measurements on the power supply (CVE-2019-14356). Firmware 2.1.2 masked PIN entry and added noise while seed words are shown. Coinkite found no public evidence of theft.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "archos-2019-08-oled-side-channel", "date": "2019-08-07", "company": "Archos", "wallets": [], "title": "OLED power side channel on the Archos Safe-T mini (CVE-2019-14358)", "summary": "Researcher Christian Reitter found that the OLED displays used in many hardware wallets leak screen contents through power draw on the USB line, which could let malicious equipment recover parts of a PIN or seed phrase. The Archos Safe-T received its own identifier, CVE-2019-14358. The disclosure timeline lists only a first communication attempt with Archos and no vendor reference.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/oled-side-channel-status-summary/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "bc-vault-2019-08-oled-side-channel", "date": "2019-08-07", "company": "BC Vault", "wallets": [], "title": "CVE-2019-14359: BC Vault OLED power side channel", "summary": "Christian Reitter reported that the SSD1309 OLED screen in BC Vault leaks displayed content through power consumption, measurable by an implant on the USB connection. BC Vault said its screen never shows seed words or the PIN, so only the PIN length could leak, and it planned no mitigations.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://bc-vault.com/2019/08/our-response-to-cve-2019-14359/", "sourceName": "BC Vault" }, { "id": "keepkey-2019-08-oled-side-channel", "date": "2019-08-07", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "OLED power side channel on KeepKey (CVE-2019-14355)", "summary": "Christian Reitter reported that the power drawn by KeepKey's OLED screen could reveal what it displays, including the seed phrase, to equipment measuring the USB power line. ShapeShift said an attacker would need physical access, an oscilloscope and statistical analysis, and called the risk to users insignificant.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shapeshift-stories/shapeshift-security-update-5b0dd45c93db", "sourceName": "ShapeShift (Medium)" }, { "id": "trezor-2019-07-donjon-unfixable-seed-extraction", "date": "2019-07-01", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Ledger Donjon: unpatchable seed extraction from stolen Trezor devices", "summary": "Ledger Donjon said an attacker with a stolen Trezor One, Model T or KeepKey could extract the seed in under 5 minutes with about 100$ of equipment. The flaw cannot be fixed in firmware, and a strong passphrase protects the seed.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/blog/Unfixable-Key-Extraction-Attack-on-Trezor", "sourceName": "Ledger Donjon" }, { "id": "keepkey-2019-07-donjon-unfixable-seed-extraction", "date": "2019-07-01", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "Ledger Donjon: unpatchable seed extraction also affects KeepKey", "summary": "Ledger Donjon said its seed extraction attack on stolen devices affects KeepKey as well as Trezor models, takes under 5 minutes, and needs about 100$ of equipment. It cannot be fixed by a firmware update.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/blog/Unfixable-Key-Extraction-Attack-on-Trezor", "sourceName": "Ledger Donjon" }, { "id": "ellipal-2019-06-donjon-seed-extraction", "date": "2019-06-25", "company": "Ellipal", "wallets": [], "title": "Ledger Donjon extracts the seed from the original Ellipal wallet", "summary": "Ledger Donjon reported several vulnerabilities in the original Ellipal wallet, including one that lets an attacker with physical access extract the seed. Other findings let an attacker re-activate disabled communication interfaces and backdoor the device for supply chain or evil maid attacks. Ellipal issued an upgrade after disclosure.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/blog/ellipal-security", "sourceName": "Ledger Donjon" }, { "id": "bitbox-2019-06-bitbox01-blink-patterns", "date": "2019-06-14", "company": "BitBox", "wallets": [], "title": "Saleem Rashid finds two BitBox01 blinking-pattern flaws", "summary": "Saleem Rashid reported two vulnerabilities in the BitBox01's blinking patterns through the bug bounty program on 12 April 2019. A compromised app could trick a user into confirming a different action than expected. Firmware 6.1.1 made the patterns easier to tell apart, and Shift Crypto found no evidence of exploitation.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shiftcrypto/bitbox-desktop-app-4-9-0-with-bitbox01-firmware-6-1-1-release-1b84c5f9295f", "sourceName": "Shift Crypto: BitBox Desktop App 4.9.0 with BitBox01 Firmware 6.1.1 Release" }, { "id": "satochip-2019-06-2fa-replay-bypass", "date": "2019-06-03", "company": "Satochip", "wallets": [], "title": "Satochip applet patched a replay attack that bypassed 2FA", "summary": "Satochip applet v0.7-0.2 fixed a replay attack that could bypass two-factor authentication when importing a new seed. The applet was in beta at the time and users were told to stay on testnet.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/Toporin/SatochipApplet/releases/tag/v0.7-0.2", "sourceName": "Satochip (GitHub release)" }, { "id": "keepkey-2019-04-rdp1-glitch-downgrade", "date": "2019-04-30", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "KeepKey 6.1.0 fixed an RDP1 glitched downgrade attack", "summary": "KeepKey firmware v6.1.0 included a fix for an RDP1 glitched downgrade attack. The release notes give no further detail.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/keepkey/keepkey-firmware/releases/tag/v6.1.0", "sourceName": "KeepKey firmware release notes (GitHub)" }, { "id": "ledger-2019-04-monero-change-bug", "date": "2019-04-08", "company": "Ledger", "wallets": [], "title": "Ledger Monero code bug made Nano S users' balances appear lost", "summary": "A bug in the Ledger Monero code built some transactions incorrectly so the wallet did not credit the change, making Nano S users believe funds were lost. Monero developers issued a patch and balances were restored.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://cointelegraph.com/news/monero-developers-confirm-fix-of-bug-that-lost-balances-for-ledger-wallet-users/", "sourceName": "Cointelegraph" }, { "id": "trezor-2019-04-information-leak-via-oled-display", "date": "2019-04-08", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Information leak via OLED display power analysis", "summary": "Christian Reitter showed that power analysis could read the information shown on the Model One OLED display. Trezor fixed the issue in a firmware update.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/information-leak-via-oled-display", "sourceName": "Trezor Security Portal" }, { "id": "bitbox-2019-03-bitbox01-change-address-ransom", "date": "2019-03-28", "company": "BitBox", "wallets": [], "title": "BitBox01 change addresses could be locked for ransom, fixed in firmware 6.0.3", "summary": "Firmware 6.0.3 fixed a BitBox01 issue with non-standard keypaths for change addresses. An attacker who compromised the computer could send the change of a transaction to a key the user could not easily find and demand a ransom to unlock it. Shift Crypto had no reports of the flaw being exploited.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shiftcrypto/bitbox-desktop-app-4-6-0-with-firmware-6-0-3-release-ec46937afe7c", "sourceName": "Shift Crypto: BitBox Desktop App 4.6.0 with Firmware 6.0.3 Release" }, { "id": "bitbox-2019-03-bitbox01-receive-address-ransom", "date": "2019-03-08", "company": "BitBox", "wallets": [], "title": "BitBox01 mobile app could be fed out-of-range receive addresses for ransom", "summary": "Shift Crypto's internal security team found that the desktop app could relay any requested receive address to the BitBox01 mobile verification app. An attacker who compromised the computer could trick a user into locking new coins and demand a ransom to unlock them. Firmware 6.0.2 limited the range of receive addresses that can be sent for verification.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shiftcrypto/bitbox-desktop-app-4-5-0-with-firmware-6-0-2-release-fd77f8186a29", "sourceName": "Shift Crypto: BitBox Desktop App 4.5.0 with Firmware 6.0.2 Release" }, { "id": "coinkite-2019-01-short-pin-interposer", "date": "2019-01-28", "company": "Coinkite", "wallets": [], "title": "Interposer attack could bypass Coldcard Mk1 PIN-attempt delays", "summary": "An invasive interposer could falsify selected secure-element responses and bypass the normal PIN-attempt delays, making short PINs brute-forceable. Coinkite hardened the design in bootrom 1.1.0 and the Mk2 circuit board. Researcher Lazy Ninja reported the issue.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://coinkite.com/historical-disclosures", "sourceName": "Coinkite: COLDCARD Security Disclosure History" }, { "id": "bitbox-2019-01-u2f-info-leak", "date": "2019-01-18", "company": "BitBox", "wallets": [], "title": "BitBox01 U2F handshake leaked 3 bytes of device memory", "summary": "Christian Reitter and Jochen Hoenicke disclosed a U2F information leak in which 3 bytes of device RAM were leaked during the initial handshake. Shift Crypto found no obvious way to exploit it, released a patch with desktop app v4.4.0 and firmware v6.0.0, and had no reports of lost funds.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://medium.com/shiftcrypto/important-security-news-about-version-4-4-0-upgrade-2449b745be9", "sourceName": "Shift Crypto: Important security news about version 4.4.0 upgrade" }, { "id": "keepkey-2019-01-usb-integer-overflow", "date": "2019-01-03", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "Integer overflow in KeepKey USB packet handling fixed in 6.0.0", "summary": "KeepKey firmware v6.0.0 fixed an integer overflow vulnerability in USB packet handling. The same release enabled the Memory Protection Unit.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/keepkey/keepkey-firmware/releases/tag/v6.0.0", "sourceName": "KeepKey firmware release notes (GitHub)" }, { "id": "trezor-2019-01-secret-information-leak-via-usb-descriptors", "date": "2019-01-02", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Secret leak via USB descriptors using fault injection", "summary": "Using specialized hardware to inject a fault into the USB stack comparison, an attacker could make the device return sensitive data in a USB descriptor. Fixed in firmware 1.8.0 for Model One and 2.1.0 for Model T.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/secret-information-leak-via-usb-descriptors", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2018-12-wallet-fail-35c3", "date": "2018-12-28", "company": "Ledger", "wallets": [], "title": "wallet.fail showed a Nano S implant and Ledger Blue PIN side channel", "summary": "At 35C3, researchers Dmitry Nedospasov, Thomas Roth and Josh Datko presented attacks including a hardware implant that pressed the Nano S confirmation button by radio and a side channel that guessed Ledger Blue PIN digits from radio emanations. Ledger said no seed or PIN was extracted from a stolen device and called the attacks impractical.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://www.ledger.com/chaos-communication-congress-in-response-to-wallet-fails-presentation.", "sourceName": "Ledger" }, { "id": "ledger-2018-12-lsb005-mcu-bootloader-bypass", "date": "2018-12-27", "company": "Ledger", "wallets": [], "title": "Nano S MCU bootloader signature check bypassed (LSB 005)", "summary": "The signature check on the Nano S microcontroller could be bypassed to install arbitrary MCU firmware, as shown at 35C3. Ledger said the flaw allowed nothing beyond what the JTAG interface already allowed and that the seed and PIN stay on the Secure Element.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/005/", "sourceName": "Ledger Donjon" }, { "id": "trezor-2018-12-sram-dump-via-glitching-the-firmware", "date": "2018-12-27", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "wallet.fail SRAM dump via glitching the firmware update", "summary": "The wallet.fail team showed that glitching hardware could push the processor into Read Protection level 1 during a firmware update, allowing RAM readout. Trezor stopped keeping sensitive data in RAM during updates in firmware 1.8.0.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/sram-dump-via-glitching-the-firmware-update", "sourceName": "Trezor Security Portal" }, { "id": "keepkey-2018-12-u2f-init-leak", "date": "2018-12-18", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "U2F init packets leaked bytes of KeepKey memory (VULN-1861)", "summary": "Christian Reitter found that U2F init response packets carried three extra bytes of device memory, a flaw inherited from shared U2F code. KeepKey fixed it in firmware 5.10.3 and the issue was disclosed publicly on 2018-12-18.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/u2fhid_init_resp-information-leak/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "bitbox-2018-12-hidden-wallet-key-leak", "date": "2018-12-06", "company": "BitBox", "wallets": [], "title": "BitBox01 hidden wallet bug let attackers rebuild master private keys", "summary": "A firmware mistake let an attacker on a compromised computer query the master xpubs of the standard and hidden wallets and recombine them into both master private keys. Shift Crypto patched it on 12 March 2018 in firmware v3.0.0 and delayed publishing details. Shift found no evidence of exploitation but advised moving funds to a new wallet.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://bitbox.swiss/bitbox01/disclosure/", "sourceName": "Shift Crypto: BitBox01 technical vulnerabilities documentation" }, { "id": "bitbox-2018-12-pairing-mitm", "date": "2018-12-06", "company": "BitBox", "wallets": [], "title": "BitBox01 mobile pairing could be intercepted by a compromised computer", "summary": "During initial pairing with the mobile verification app, malware on the computer could insert itself as a man-in-the-middle and later change what the phone displayed. Saleem Rashid reported it, and Shift Crypto patched it on 31 July 2018 in firmware v4.0.0.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://bitbox.swiss/bitbox01/disclosure/", "sourceName": "Shift Crypto: BitBox01 technical vulnerabilities documentation" }, { "id": "bitbox-2018-12-secure-chip-simulation", "date": "2018-12-06", "company": "BitBox", "wallets": [], "title": "BitBox01 could be reset without erasing secrets using invasive probes", "summary": "With the casing opened and probes attached between the secure chip and microcontroller, an attacker could reset a BitBox01 without erasing the wallet secrets and then access the old wallet. Shift Crypto patched it on 31 July 2018.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://bitbox.swiss/bitbox01/disclosure/", "sourceName": "Shift Crypto: BitBox01 technical vulnerabilities documentation" }, { "id": "bitbox-2018-12-unauthenticated-usb", "date": "2018-12-04", "company": "BitBox", "wallets": [], "title": "BitBox01 USB messages were encrypted but not authenticated", "summary": "BitBox01 USB communication was encrypted but not authenticated, so a man-in-the-middle could modify parts of it. Shift Crypto added a message authentication code in firmware v5.0.0 on 4 December 2018 and said no exploit method had been reported.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://bitbox.swiss/bitbox01/disclosure/", "sourceName": "Shift Crypto: BitBox01 technical vulnerabilities documentation" }, { "id": "archos-2018-12-safe-t-trezor-crypto-overflows", "date": "2018-12", "company": "Archos", "wallets": [], "title": "Safe-T mini firmware 1.1.3 patched buffer overflows from trezor-crypto", "summary": "Archos Safe-T mini firmware 1.1.3 switched to a recent version of the trezor-crypto library, which the changelog says fixed recent buffer overflow vulnerabilities. The flaws sat in the upstream library the Safe-T firmware is built on.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://github.com/archos-safe-t/safe-t-mcu/blob/master/firmware/ChangeLog", "sourceName": "Archos (GitHub): safe-t-mcu firmware ChangeLog" }, { "id": "trezor-2018-11-information-leak-via-u2-f", "date": "2018-11-26", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "RAM bytes leaked via U2F struct definition", "summary": "A broken struct definition in Yubico's U2F reference implementation could leak bytes from RAM over USB. Trezor fixed it in firmware 1.7.2.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/information-leak-via-u2-f", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2018-11-lsb004-change-address-injection", "date": "2018-11-11", "company": "Ledger", "wallets": [], "title": "Bitcoin app accepted an unverified change address (LSB 004)", "summary": "Sergey Lappo of Mycelium found the Bitcoin app let an attacker add an unverified change output to a legitimate transaction, sending funds to an arbitrary address without extra confirmation. Nano S firmware 1.5.5 and Bitcoin app 1.3.3 fixed it.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/004/", "sourceName": "Ledger Donjon" }, { "id": "trezor-2018-10-side-channel-analysis-sca-of-pin", "date": "2018-10-31", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Ledger Donjon side-channel attack on PIN comparison", "summary": "Charles Guillemet of Ledger Donjon showed that power and electromagnetic traces could be used to unlock a locked device. Trezor rewrote device storage in firmware 1.8.0 so PINs are no longer compared directly.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/side-channel-analysis-sca-of-pin-comparison", "sourceName": "Trezor Security Portal" }, { "id": "keepkey-2018-10-bech32-cashaddr-overflow", "date": "2018-10-30", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "Bech32 and cash_decode buffer overflows also affected KeepKey (VULN-1845)", "summary": "An integer underflow in the Bech32 reference decoder led to a buffer overflow on malformed addresses, and a similar cash_decode() flaw sat in the trezor-crypto library used by KeepKey. ShapeShift patched KeepKey and paid a bounty; the issues were disclosed on 2018-10-30.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/bech32_decode-summary/", "sourceName": "Christian Reitter (inhq.net)" }, { "id": "trezor-2018-09-buffer-overflow-in-bech32-decode-cash", "date": "2018-09-26", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Buffer overflow in bech32_decode and cash_decode", "summary": "An unsigned integer overflow in the C reference bech32 implementation could lead to a buffer overflow; the same issue was found in cash_decode. Fixed in firmware 1.7.1.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/buffer-overflow-in-bech32-decode-cash-decode", "sourceName": "Trezor Security Portal" }, { "id": "bitfi-2018-08-cold-boot-attack", "date": "2018-08-30", "company": "Bitfi", "wallets": [], "title": "Cold boot attack pulls keys from an unmodified Bitfi wallet", "summary": "Researchers Saleem Rashid and Ryan Castellucci showed that the secret phrase and salt stay in Bitfi's memory long enough to be extracted, letting an attacker generate the private keys. Rashid said the exploit takes less than two minutes to run. Bitfi had declined to pay its $250,000 bounty for the earlier attack.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://techcrunch.com/2018/08/30/john-mcafees-unhackable-bitfi-wallet-got-hacked-again/", "sourceName": "TechCrunch" }, { "id": "bitfi-2018-08-rooted-unhackable-wallet", "date": "2018-08-14", "company": "Bitfi", "wallets": [], "title": "Researchers root the 'unhackable' Bitfi wallet", "summary": "Security researchers including Andrew Tierney, Alan Woodward and Saleem Rashid gained control of the Android-based Bitfi wallet, which John McAfee had promoted as unhackable, and later said they extracted the seed and passphrase. Bitfi argued the attacks did not meet its $250,000 bounty terms. The company received a Pwnie award for worst vendor response.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://techcrunch.com/2018/08/14/unhackable-bitfi-crypto-wallet-has-been-hacked/", "sourceName": "TechCrunch" }, { "id": "trezor-2018-08-csrf-issues-in-dropbox-integration", "date": "2018-08-01", "company": "Trezor", "wallets": [], "title": "CSRF issues in Trezor Dropbox integration", "summary": "A researcher reported cross-site request forgery issues in Trezor's Dropbox integration in August 2018. They were fixed and deployed shortly after.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://trezor.io/vulnerability/csrf-issues-in-dropbox-integration", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2018-07-mpu-circumvention-via-syscfg-registers", "date": "2018-07-08", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "MPU protection circumvented via SYSCFG registers", "summary": "The bootloader protection added in firmware 1.6.1 could be circumvented through the SYSCFG registers. Trezor fixed this by disabling those registers via the memory protection unit.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/mpu-circumvention-via-syscfg-registers", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2018-07-wallet-dns-hijack-phishing", "date": "2018-07-01", "company": "Trezor", "wallets": [], "title": "DNS or BGP hijack sent web wallet users to a fake seed-phishing site", "summary": "Traffic meant for wallet.trezor.io was redirected to a fake site that asked users to enter their seed phrase. Users noticed an invalid HTTPS certificate, and Trezor had the site taken down through its host.", "severity": "major", "type": "phishing", "sourceUrl": "https://www.bleepingcomputer.com/news/security/dns-poisoning-or-bgp-hijacking-suspected-behind-trezor-wallet-phishing-incident/", "sourceName": "BleepingComputer" }, { "id": "keepkey-2018-06-usb-rx-buffer-overflow", "date": "2018-06-25", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "USB receive buffer overflow fixed in bootloader 1.1.0 and firmware 5.5.0", "summary": "Christian Reitter reported a buffer overflow in the KeepKey USB receive buffer. The fix shipped in bootloader v1.1.0 and firmware v5.5.0 in June 2018.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://blog.inhq.net/posts/keepkey-rx-buffer-overflow/", "sourceName": "Christian Reitter (invd blog)" }, { "id": "trezor-2018-05-buffer-overflow-in-message-processing", "date": "2018-05-25", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "USB message buffer overflow could allow code execution", "summary": "A crafted USB packet could trigger a buffer overflow that could lead to code execution on older Model One firmware. Fixed in firmware 1.6.2.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/buffer-overflow-in-message-processing", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2018-05-race-condition-in-recovery", "date": "2018-05-25", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Race condition in recovery could allow code execution", "summary": "Crafted USB communication could trigger a stack overflow during recovery that could lead to code execution. Fixed in firmware 1.6.2.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/race-condition-in-recovery", "sourceName": "Trezor Security Portal" }, { "id": "keepkey-2018-03-stm32f2-bootloader-hotpatch", "date": "2018-03-21", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "STM32F2 write-protection flaw forced KeepKey bootloader hotpatch", "summary": "A flaw in the write-protection of the STM32F2 chip could allow unsigned code to run on KeepKey. Firmware v5.1.0 hotpatched all bootloaders to block execution of unsigned binaries.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://github.com/keepkey/keepkey-firmware/releases/tag/v5.1.0", "sourceName": "KeepKey firmware release notes (GitHub)" }, { "id": "ledger-2018-03-lsb001-scp-padding-oracle", "date": "2018-03-20", "company": "Ledger", "wallets": [], "title": "Padding oracle on the firmware update secure channel (LSB 001)", "summary": "Researcher Timothée Isnard found a padding oracle attack on the secure channel between Ledger devices and Ledger's HSM that allowed decryption of firmware updates. Ledger said device security did not depend on firmware confidentiality and added the missing MAC.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/001/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2018-03-lsb002-saleem-rashid-supply-chain", "date": "2018-03-20", "company": "Ledger", "wallets": [], "title": "Saleem Rashid bypassed Nano S MCU verification (LSB 002)", "summary": "Researcher Saleem Rashid showed the Secure Element's check of the Nano S microcontroller firmware could be bypassed with physical access before seed generation. He demonstrated a modified firmware that displays a seed phrase chosen by the attacker, a scam a malicious seller could use. Firmware 1.4 mitigated it.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/002/", "sourceName": "Ledger Donjon" }, { "id": "ledger-2018-03-lsb003-app-isolation", "date": "2018-03-20", "company": "Ledger", "wallets": [], "title": "Malicious app could break app isolation on Nano S (LSB 003)", "summary": "Researcher Sergei Volokitin found that a malicious app could break the isolation between apps and read data held by apps such as GPG, U2F or Neo. Exploitation required installing an unsigned app, and firmware 1.4 fixed it.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://donjon.ledger.com/lsb/003/", "sourceName": "Ledger Donjon" }, { "id": "keepkey-2018-03-cve-2018-6875-format-string", "date": "2018-03-14", "company": "KeepKey", "wallets": [ "keepkey" ], "title": "CVE-2018-6875: format string flaw in KeepKey 4.0.0 could display hidden data", "summary": "A format string vulnerability in KeepKey firmware 4.0.0 let attackers display information that should not be accessible, using text with characters missing from the device's font.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2018-6875", "sourceName": "NVD: CVE-2018-6875" }, { "id": "trezor-2018-02-stm-32-f205-write-protection-issue", "date": "2018-02-12", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "STM32F205 bootloader write-protection did not work", "summary": "Saleem Rashid found that the bootloader write-protection in the STM32F205 chip used in the Trezor One did not work as intended. Trezor fixed it by enabling the memory protection unit.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/stm-32-f205-write-protection-issue", "sourceName": "Trezor Security Portal" }, { "id": "ledger-2018-02-receive-address-mitm", "date": "2018-02-05", "company": "Ledger", "wallets": [], "title": "Malware proof of concept swapped receive addresses in Ledger's Chrome app", "summary": "Researchers published a proof of concept in which malware modified the Ledger Chrome application to change the receive address shown on the computer screen. Ledger said users were not at risk if they verified the receive address on the device screen and that it knew of no losses.", "severity": "minor", "type": "app-flaw", "sourceUrl": "https://www.ledger.com/man-middle-attack-risk", "sourceName": "Ledger" }, { "id": "ledger-2018-01-ebay-preseeded-nano-s", "date": "2018-01-08", "company": "Ledger", "wallets": [], "title": "Pre-seeded Nano S sold on eBay drained a buyer's funds", "summary": "A Reddit user lost over $34,000 in coins after buying a second-hand Ledger Nano from an eBay seller. The seller had initialized the device and supplied its own seed phrase instead of letting the device generate one.", "severity": "major", "type": "supply-chain", "sourceUrl": "https://cointelegraph.com/news/life-savings-stolen-from-second-hand-ledger-hardware-wallet", "sourceName": "Cointelegraph" }, { "id": "trezor-2017-09-note-on-fixing-sram-memory-access", "date": "2017-09-01", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Claim that Trezor had been hacked covered an already-fixed flaw", "summary": "After firmware 1.5.2 fixed SRAM memory access, a Medium article claimed Trezor had been hacked. Trezor found the described attack vector was already closed by that update.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/note-on-fixing-sram-memory-access", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2017-08-secret-leak-via-sram-residue", "date": "2017-08-01", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Secrets left in SRAM after soft reset", "summary": "SRAM was not cleared on soft reset, so secrets could be extracted using special firmware and direct access to the device board. Trezor fixed it in a firmware update.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/secret-leak-via-sram-residue", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2017-06-note-on-theoretical-fault-attack-vector", "date": "2017-06-01", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Theoretical clock and voltage glitch vector (DEF CON 2017)", "summary": "Researchers Josh Datko and Chris Quartier reported a theoretical fault attack by glitching the clock or voltage and presented it at DEF CON. Trezor added their recommendations to firmware 1.5.1 and does not classify it as an issue.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/note-on-theoretical-fault-attack-vector-2017-defcon-talk", "sourceName": "Trezor Security Portal" }, { "id": "keepkey-2017-01-founder-account-hijack", "date": "2017-01-02", "company": "KeepKey", "wallets": [], "title": "Hijacked founder email exposed KeepKey customer contact data", "summary": "An attacker took over KeepKey founder Darin Stanchfield's phone account and email, then reset passwords on linked company accounts and demanded 30 bitcoin. The attacker reached a sales channel, a shipping vendor and an email marketing account and may have taken customer addresses, emails and phone numbers. KeepKey said funds on its hardware wallets were never at risk.", "severity": "major", "type": "data-breach", "sourceUrl": "https://www.securityweek.com/hardware-bitcoin-wallet-keepkey-informs-users-breach", "sourceName": "SecurityWeek: Hardware Bitcoin Wallet KeepKey Informs Users of Breach" }, { "id": "trezor-2015-03-possible-key-extraction-with-oscilloscope", "date": "2015-03-26", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Jochen Hoenicke power analysis could extract a private key", "summary": "With physical access and an oscilloscope, an attacker could use power analysis to extract an individual private key. Trezor fixed this in firmware 1.3.3.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/possible-key-extraction-with-oscilloscope", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2015-02-malicious-change-in-mixed-transactions", "date": "2015-02-23", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Multisig change output could go unconfirmed (TOCTOU, 2015)", "summary": "A crafted multisig transaction could use a time-of-check to time-of-use bug to include an attacker change output the user never confirmed. Fixed in firmware 1.3.1.", "severity": "major", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/malicious-change-in-mixed-transactions", "sourceName": "Trezor Security Portal" }, { "id": "trezor-2014-07-malicious-script-sig-in-signed-transaction", "date": "2014-07-30", "company": "Trezor", "wallets": [ "trezor-model-one" ], "title": "Malicious ScriptSig could trigger overflow and extract a private key", "summary": "A crafted transaction could trigger a buffer overflow and extract the private key, but required local interaction with knowledge of the PIN and passphrase. Fixed in firmware 1.3.1.", "severity": "minor", "type": "device-flaw", "sourceUrl": "https://trezor.io/vulnerability/malicious-script-sig-in-signed-transaction", "sourceName": "Trezor Security Portal" } ] }