Hardware Wallet Security Incidents

October 30, 2026

Trezor's security team received a responsible disclosure report on October 28, 2026 of a single hardware implant in a Trezor Safe 5 bought from the reseller CryptoBilis in August 2026. Trezor has not yet examined the device but is treating the report as credible, and no CryptoBilis buyer has reported a loss of funds. Buyers who purchased from CryptoBilis since March 2026 are told to move funds to a new wallet with a new seed.

October 28, 2026

Envoy 2.3.7 fixed screenshot protection so it stays on when the user switches from the seed words back to the seed QR code. The release also moved the Passport Prime security check to a new onion address as a precaution.

October 27, 2026

Satochip-Utils, the desktop app for Satochip, SeedKeeper, Satodime and Satocash cards, wrote SeedKeeper secret values and Satocash token proofs to its logs. Version 0.4.1 stopped logging them and now clears copied clipboard data after 30 seconds.

October 25, 2026

Attackers used compromised Cloudflare API keys to send more than 23,000 phishing attempts that appeared to come from Foundation. Customer details from old order tables and recent Shopify orders sat in systems the attackers could reach. Foundation found no evidence that Passport devices or their keys were compromised.

October 24, 2026

A malicious server could hide a user's broadcast transaction and show a forged one paying the attacker; if the user fee-bumped it, Electrum signed a real payment to the attacker. Electrum said some servers ran the attack in the wild and one user lost money. Version 4.8.3 fixed it (CVE-2026-117601); people using their own server were not affected.

October 20, 2026

An attacker got into Keystone's website through a third-party data monitoring tool and took 25,964 buyer records, 12,873 unpaid checkout records, and the key Keystone uses to prove a device is genuine. That key is set at the factory and can't be changed on existing devices. Keystone is destroying 18,835 unsold devices and says seed phrases and private keys were not exposed.

October 20, 2026

SeedSigner displayed the transaction fee without checking the input amounts in the PSBT, so a malicious coordinator could inflate an input and hide a large fee paid to miners. The merged fix verifies each input against its previous transaction and discards PSBTs whose amounts cannot be proven.

October 19, 2026

SecuX said attackers modified the banner inside the SecuX App to point users to fake SecuX websites. The sites claimed wallets were affected by critical security vulnerabilities and asked for the seed phrase. SecuX told users never to enter their seed phrase anywhere.

October 17, 2026

Attackers took over the push-notification provider for NGRAVE's LIQUID app and sent a fake alert linking to a page that asked for the seed phrase. NGRAVE traced at least $2.56 million stolen from about 70 addresses, including about $1.77 million in bitcoin. NGRAVE says no ZERO device was breached.

October 16, 2026

KeepKey firmware 7.14.2 was released as a security release so that what the device asks the user to approve matches what it signs. It fixes display of messages, amounts, fees and chain IDs, and puts blind-signing paths behind Advanced Mode.

October 16, 2026

A security code review of the Satochip applet led to fixes for a 2FA bypass in MuSig2 signing, a non-compliant taproot tweak that did not bind to the internal key, and missing checks against invalid-curve attacks. The fixes shipped in applet v0.16-0.1 with breaking changes for client software.

October 15, 2026

pysatochip, the Python library that desktop wallets use to talk to Satochip and SeedKeeper cards, printed a raw private key on import and logged SeedKeeper master seeds and mnemonics. Version 0.18.5 removed 12 print() calls, masked sensitive APDU logging, and fixed checks that let a card skip signature verification or set up a secure channel after an error status.

October 12, 2026

After Ledger confirmed implanted hardware in devices sold by the reseller CryptoBilis, OneKey ended CryptoBilis's authorization and stopped adding new resellers. OneKey says it has no reports of its users losing assets. Anyone who bought a OneKey device from CryptoBilis between March 1, 2026 and the statement date can request a free replacement by December 31, 2026, and OneKey advises moving assets to a new recovery phrase.

October 11, 2026

A fake security warning appeared on Coldcard's official X account around 02:00 UTC on October 11, 2026, claiming a seed-generation problem and linking to migrate.coldcardwallet.io. Coldcard's internal review found no unauthorized access or logins, and it asked X to investigate how the post was made.

October 3, 2026

An anonymous researcher reported a 12-byte buffer overflow during AES-GCM encryption and decryption for Krux's KEF format. The maintainer judged it not practically exploitable, fixed it in 26.09.0, and said existing KEF envelopes need no change.

October 3, 2026

A race in Mobile Pay could cache a signed transaction before its daily-spend record was saved, so retries might broadcast without counting against the daily allowance. Block fixed it on the server and reported no customer impact.

October 2, 2026

Before onboarding, an attacker with an NFC radio close to a Bitkey could enable an unreleased PIN feature and set a PIN that might later unlock the device. This alone could not access funds. Production builds no longer allow unlocking by PIN.

October 2026

Ledger confirmed a hardware implant attack on genuine devices sold through a third-party distribution channel and says it found no flaw in its own chip, operating system, or servers. CoinDesk reported the reseller and on-chain estimates of up to $93.2 million lost, a figure Ledger has not verified.

September 30, 2026

Coldcard Q firmware 1.5.3Q fixed a bug where scanning seed words or an extended private key from the Ready To Sign or Key Teleport retry screen could replace the master seed. The release also hardened PSBTv2 parsing.

September 29, 2026

A researcher found that during a firmware update the bootloader could be made to install firmware other than the one it had checked. Trezor says the flaw affected only unreleased code and was fixed before release.

September 19, 2026

SeedSigner relied on the coordinator's derivation claims when deciding which outputs were change, so a malicious coordinator could dress up an attacker's output as change. In one multisig test case the v0.8.7 release showed 10,000 sats coming back to the user while the money went elsewhere. The fix rebuilds each claimed change script from the seed and rejects PSBTs whose claims contradict it.

September 16, 2026

Attackers drained wallets in the D'CENT App Wallet, the software wallet in the same phone app used with the Biometric device. D'CENT says a hardware wallet is exposed too if its seed phrase was ever entered into the App Wallet, and told affected users to move funds to a new seed phrase.

September 11, 2026

pysatochip depended on the pure-Python ecdsa package, which is affected by CVE-2024-23342: its private-key operations, including ECDSA signing and ECDH key exchange, leak information through timing. Version 0.18.0 removed the dependency and moved private-key operations to a side-channel-hardened backend.

September 10, 2026

Attackers used a login flaw at Brevo, BitBox's newsletter provider, to send two phishing emails from the BitBox account and download the subscriber list. Only email addresses were exposed. BitBox says its shop, app, and devices were not affected.

September 10, 2026

An attacker got into Brevo, Trezor's newsletter provider, and sent a fake security alert from Trezor's account that pushed an app asking for the wallet backup. Brevo confirmed 347,149 newsletter email addresses were exported. Trezor took the phishing domain down within 20 minutes.

September 9, 2026

After the September 2026 Liquid Network incident, impersonators posed as Liquid, Blockstream, and support staff through emails, lookalike sites, and DMs. Lures included fake security update portals, emails claiming to contain firmware, and requests to move coins to a recovery address. Blockstream said Jade firmware is only installed through its official app or firmware pages.

September 9, 2026

Alby disclosed what it called a critical vulnerability in Alby Hub v1.7.0 to v1.18.5: an attacker who could reach a publicly exposed Hub's management API could gain access and send funds. Alby said one user was affected. Versions 1.19.0 and later are not affected.

September 6, 2026

Specter-DIY firmware v1.10.5 rejects dead hardware RNG output instead of using it, and now treats an output as change only after verifying it derives from the wallet descriptor.

September 4, 2026

KeyOS 1.4.0 fixed bugs where Passport Prime could label attacker-controlled multisig scripts or outputs as change, and where repeated cosigner keys could silently lower the signing threshold. Foundation called the release an important security update for all Passport Prime users.

September 3, 2026

Coldcard Q firmware 1.5.2Q fixed an integer underflow in virtual-disk file handling that allowed out-of-bounds PSRAM writes, reads, and mappings from a compromised USB host. The same release made the device abort signing if a Virtual Disk firmware import overwrote the reviewed PSBT.

August 27, 2026

A regression in the Ledger Secure SDK introduced in August 2025 let a host send a new command while a review was pending, so an app could display one set of parameters and sign different ones. Ledger hardened apps and fixed the SDK in v26.6.1, and said it had no evidence of exploitation.

August 27, 2026

The Ethereum app stored a 16-bit array count in an 8-bit field, so for an array of 257 elements the device reviewed only one entry while the signature authorized all of them. Bitfinding reported it, and Ethereum app 1.22.3 fixed it.

August 27, 2026

In swaps, the Ethereum app checked the address and quantity but not the operation type, so a token approval could be signed without being displayed. The permission could only go to the swap provider's deposit address for the accepted amount, and Ethereum app 1.22.3 fixed it.

August 25, 2026

Jade firmware 1.0.41 fixed a number of reported issues, many surfaced by AI-assisted code scanning, and raised stack protection and memory clearing. Blockstream said the release did not warrant an urgent upgrade notice and that less serious reports would be handled in 1.0.42, while the 1.0.41 changelog says all users should upgrade as soon as possible.

August 20, 2026

A public Karma-X review raised a callgate-bounds concern in Mk4 and Q firmware. Coinkite changed the range checks to validate the full caller-provided span and avoid address-plus-length wraparound, shipping the change in 5.6.1 and 1.5.1Q.

August 20, 2026

After the July seed-generation hotfix, a public report showed a transient STM32 seed error could leave the RNG unavailable for the rest of the boot session. Firmware 5.6.1 and 1.5.1Q added bounded retry and fail-closed handling. No field occurrence was established.

August 20, 2026

Coldcard firmware 5.6.1 and 1.5.1Q block SIGHASH_SINGLE signing by default because later outputs may remain modifiable, and separate the SE1 check nonce from the PIN digest. Both changes were credited to @instagibbs.

August 20, 2026

Coldcard's BIP-322 message signing did not apply its existing text-safety checks before approval. Firmware 5.6.1 and 1.5.1Q now apply them and reject unsupported message content.

August 20, 2026

Researcher @drk1wi privately reported four issues: USB access to staged PSRAM data, duplicate or device-owned keys in multisig enrollment, held keys counted as multiple dice rolls, and malformed BBQr scans on the Q returning stale memory bytes. Fixes shipped in firmware 5.6.1 and 1.5.1Q.

August 20, 2026

A compromised USB host could rewrite a PSBT in staged memory after the user reviewed it but before Coldcard signed it. Firmware 5.6.1 and 1.5.1Q re-verify the staged bytes and abort if they changed. FreeZ Agent reported the issue with a proof of concept.

August 20, 2026

Malformed, overlong Base58Check input could cause an out-of-bounds read in the libngu decoder before checksum validation. The reporter rated it low severity and claimed no write or code execution. The bound check shipped in firmware 5.6.1 and 1.5.1Q.

August 16, 2026

A flaw in an order-tracking plug-in exposed order data for 39,798 customers who ordered between March 2, 2025 and April 11, 2026. SafePal emailed affected customers on August 16, 2026.

August 16, 2026

A researcher found that the Safe 7's authenticity checks weren't tied to each secure element separately. Trezor fixed it and paid a bug bounty.

August 13, 2026

In some Monero transactions the device could sign a payment ID without displaying it. Trezor fixed this in firmware 2.13.0.

August 13, 2026

ShipMonk, a Trezor fulfillment partner, told Trezor on August 10, 2026 that its systems had been breached. Trezor first reported 11,742 customers with full exposure of name, email, phone number and shipping address, then said on September 4, 2026 that about 67,000 more US customers from 2019 to 2021 orders were exposed, for 80,689 affected in total.

August 12, 2026

A crafted JPEG image could make the device image decoder attempt to write past its buffer. The write failed and the device crashed, so no memory was corrupted. Fixed in firmware 2.13.0.

August 11, 2026

A test-account-only endpoint could be used to shorten the review period of another account's Delay & Notify window. Block reviewed every privileged action in production and found all still carried the full seven-day window.

August 11, 2026

Short-lived mobile app bearer tokens could be recorded in Bitkey's observability tools. The tokens could not change security settings or reach spending keys, and Block found no reuse of any logged token.

August 11, 2026

Bitkey release automation workflows could have been altered by someone with write access to the repository. Block found no evidence the automation secret was exposed and removed the affected GitHub App integration.

August 11, 2026

An internal service used to review and apply infrastructure changes had broader sign-in exceptions than intended, so unauthenticated requests could reach it and possibly expose status and version information. Block found no evidence of exploitation.

August 11, 2026

Envoy 2.3.1 fixed a privacy bug where transactions from passphrase-protected accounts could appear in the global Activity feed while the passphrase was not active. The feed now hides them until the passphrase is entered.

August 9, 2026

A community security audit flagged a high-priority issue with Specter Desktop's HWI bridge configuration. The fix requires an admin login and CSRF protection before the HWI bridge whitelist settings can be viewed or changed.

August 8, 2026

When adding a signer to a Stellar account, the device did not show the signer weight, so a malicious host could grant more authority than intended. Fixed in firmware 2.12.5.

August 5, 2026

Proofpoint found phishing emails impersonating COLDCARD that claimed a hardware security audit was underway after the seed-generation theft. The emails came from compliance@coldcardteamnews.com and linked to coldcardcompliance.com, where a fake diagnostic tool installed ScreenConnect remote access software.

August 5, 2026

An attacker used a BTCPay Server vulnerability to take the admin credential for a connected LND node, stole funds from Zeus's own operational wallets, and force-closed most of its public and many private LSP channels. Zeus said no customer funds were lost, replaced affected channels at no cost, and switched off Zaplocker during its security review.

August 4, 2026

In some Solana token transfers the device could show an incorrect token address on the confirmation screen. Fixed in firmware 2.12.5.

August 4, 2026

When staking SOL, some stake account settings were not shown on the device, which could cause the user to lose access to staked SOL. Fixed in firmware 2.12.5.

August 4, 2026

Krux 26.08.0 fixed a heap buffer overflow in the camera entropy module that only the discontinued Maix Bit could trigger, and tightened PSBT fee checks so the fee shown on screen is verified.

August 2, 2026

A host could get around the Model One requirement to use advanced recovery for 12- and 18-word backups, undoing an earlier recovery mitigation. Fixed in firmware 1.14.2.

August 1, 2026

For some 1inch swaps the device did not show the minimum amount the user would receive, so a malicious host could weaken slippage protection. Fixed in firmware 2.12.5.

August 1, 2026

Bitkey's internal team fixed a bug where a beneficiary using a modified app and a separate test-account relationship could shorten an inheritance claim's delay period. Block verified that no claim ever advanced before its intended delay window.

August 1, 2026

A researcher reported that the Bitkey app generated recovery contact and inheritance enrollment secrets with a general-purpose random number generator. Exploiting it required extensive access to Block's infrastructure during a live enrollment, and the affected value was not a private key. Block found no evidence any customer was exploited.

August 2026

Firmware 9.26.5 fixed a flaw that could lock silent payment funds to an unintended address and a memory corruption bug in the Multi edition only. No funds were stolen.

July 30, 2026

An attacker drained funds from wallets whose seeds came from a seed-generation flaw in Coldcard firmware. Galaxy Research counts at least 1,778 BTC taken from more than 8,600 addresses. Coinkite has patched the flaw.

July 30, 2026

imKey confirmed user reports of counterfeit hardware wallets sold with manuals whose QR codes led to a fake app. Victims created or recovered a wallet inside the attackers' setup, which let the attackers steal the seed phrase and move the funds. imKey said none of the stores selling imKey devices on JD.com are authorized.

July 21, 2026

For Ethereum contract interactions, Trezor Safe 3, Safe 5 and Safe 7 firmware showed only the first chunk of calldata while the signature covered all of it. An attacker could show a victim one calldata and then swap in a different tail, changing the signed transaction.

July 17, 2026

KeyOS 1.3.0 for Passport Prime shipped a hardening pass driven by a third-party security audit. It fixed a bug where launching an app could override the lock screen, fixed counter-material reuse in AES-GCM streaming, stopped encrypted eMMC from proceeding with all-zero keys, and fixed U2F signing that skipped validation of the application parameter.

July 16, 2026

Anyone who knew a cart identifier on the Trezor e-shop could view and change that cart, including the shipping address, without logging in. Trezor paid a 500 USD reward for the report.

July 9, 2026

Ledger Donjon used a single laser pulse on the card's EAL6+ chip to skip a firmware check and set the card's password to an attacker-chosen value, giving access to its funds. The flaw affects all Tangem cards in circulation and cannot be patched, but requires physical access and a lab setup costing around $250,000. It was disclosed to Tangem on February 10th, 2026.

July 8, 2026

Foundation fixed a flaw in its Magic Backup server that allowed unauthenticated listing, downloading, and deletion of backup data. Foundation said it was certain the flaw was not exploited and paid a bounty to the researcher who reported it.

July 8, 2026

Envoy 2.3.0 fixed a flaw in the Passport Prime security check where a device error response could be reported as a successful verification. The same release addressed three medium-severity findings from an ngwallet security audit.

July 8, 2026

Besides the USB out-of-bounds write, the Oeschinen release fixed bug bounty reports that let a malicious app or DApp show manipulated text on the BitBox screen during self transfers and EIP-712 signing, and bypass the confirmed Ethereum chain ID. It also fixed a BitBoxApp issue where a compromised partner widget could read account data. BitBox said none of the issues directly affected user funds.

July 1, 2026

Witness-UTXO-only PSBT data could be used where Coldcard signed a non-SegWit input, allowing the input amount to be spoofed. The fix shipped in Mk4/Mk5 firmware 5.5.1 and Q firmware 1.4.1Q. No public proof of concept or loss report was found.

July 2026

Firmware 9.26.3 fixed an out-of-bounds write in USB handling. Combined with phishing and older bootloader versions, it could have led to malicious firmware. The BitBox02 Nova was not affected.

July 2026

A bootloader flaw on the BitBox02 could let an attacker who phished a user into installing a fake BitBoxApp load malicious firmware onto a genuine device and steal funds. It was fixed in firmware 9.26.2; in August BitBox said it was more severe than first reported. The BitBox02 Nova was not affected, and there were no reports of exploitation.

June 29, 2026

A host could complete Trezor Safe 7 pairing without the code shown on the device by supplying a degenerate value in the key exchange. Such values are now rejected.

June 16, 2026

A downloaded Trezor Suite update could be installed on quit before signature verification had finished. Installation is now blocked until verification completes.

June 14, 2026

Some fields signed as part of Solana account-creation instructions were not displayed on the device confirmation screens. The screens now show the complete set of relevant fields.

June 12, 2026

Certain Solana account-creation instructions did not show all signed fields on the confirmation screen, weakening what-you-see-is-what-you-sign for those flows. The screens now display the complete set of fields.

June 4, 2026

An APDU handler in the Monero app returned the full internal Keccak state, letting a compromised host recover the secret view and spend keys without on-screen confirmation. Ledger found it internally and fixed it in Monero app 2.1.4.

June 3, 2026

Ledger Donjon extracted secrets from the Safe 7's TROPIC01 chip with a lab laser attack that needs physical possession and decapsulation. Trezor says it doesn't expose the PIN, funds, or wallet backup, and that a firmware update can't fix it.

June 3, 2026

The CoinJoin authorization screen did not display the maximum coordination fee rate being authorized. That limit is now shown before confirmation.

June 1, 2026

Token transfers whose destination was referenced through a Solana lookup table showed the lookup table address as the recipient. These transfers now use the detailed confirmation screen.

June 2026

An AI-assisted firmware review produced 85 candidate findings, which Coinkite reviewed by hand. Most high-severity items were false positives, but one real Delta Mode path could expose a Seed Vault value through Seed XOR, and guards were added.

May 29, 2026

A redirect rule on trezor.io accepted unvalidated input, so a link that appeared to point at Trezor could send visitors elsewhere. The rule now uses a fixed destination.

May 25, 2026

When clear signing an ERC-20 approval or transfer, the device did not display native ETH sent in the same transaction. A malicious host could attach an ETH transfer the user would not see; the device now shows any non-zero ETH amount.

May 19, 2026

An unbounded change-index list in Blockbook xpub descriptor handling let a single unauthenticated request trigger large amounts of work and exhaust server memory. The fix bounds per-request work and limits the cache.

May 19, 2026

Blockbook fiat-rate endpoints accepted an unbounded list of timestamps, so one unauthenticated connection could force an out-of-memory crash. The fix bounds timestamps per request and limits concurrent work.

May 16, 2026

A safeguard meant to stop extra calldata being attached to a SLIP-24 verified-swap transaction was not active in production firmware. A malicious host could inject attacker calldata while the device showed a normal verified-swap confirmation.

May 16, 2026

Solana stake claims covering several withdrawals showed only a combined total, so a claim could be redirected without the diverted amount being visible. Mixed-recipient claims are now confirmed one withdrawal at a time.

May 7, 2026

A check meant to reject unverifiable external inputs in CoinJoin signing only caught them when fields were entirely absent, so a malicious host could slip one past verification. The classification has been corrected.

May 7, 2026

When signing a replace-by-fee transaction, the device skipped the recipient confirmation for outputs not in the original transaction, so a malicious host could add an external recipient. Replacements can no longer add new recipients.

May 3, 2026

The Trezor Connect v9 popup processed cross-window messages without verifying they came from a trusted source. A malicious page could read non-sensitive device information and request read-only operations; signing still required device confirmation.

April 30, 2026

Jade firmware 1.0.40 changed Green recovery signing so the user always confirms all outputs, and cleared secrets from memory more diligently after they are shown on screen. Green 2of3 recovery signing had been added in 1.0.39.

April 28, 2026

A program already running on the computer with write access to Electrum's data folder could install and enable a plugin without the plugin password, running its code inside Electrum. Version 4.7.2 fixed it.

April 28, 2026

A malicious or compromised client with a valid Nostr Wallet Connect connection could spend more than the configured daily limit through concurrent requests and rounding in the budget check. The plugin is off by default. Version 4.7.2 fixed it.

April 27, 2026

Krux 26.04.0 addressed issues raised by AI audits, including PSBT sighash checks, multisig quorum validation, memory exhaustion from crafted QR or SD card data, and directory traversal via crafted FAT entries.

April 17, 2026

A researcher bought a Nano S Plus from a Chinese marketplace that failed Ledger's Genuine Check and contained modified hardware and firmware with WiFi and Bluetooth antennas. The box QR code pointed to a malicious Ledger Live app built to obtain the seed phrase.

April 14, 2026

A malicious Ledger Live app for macOS on Apple's App Store tricked users into entering their seed phrase, draining about $9.5 million from 50 victims. Apple removed the app and terminated the developer account.

April 14, 2026

On devices with SD-card protection enabled and no PIN, manual lock or auto-lock did not fully re-engage, so the device could keep authorizing protected operations. The fix requires the SD-card secret again after locking.

April 9, 2026

A user reported that Specter Desktop's login redirect check could be bypassed with an encoded tab character, letting an attacker redirect users to any malicious site. The fix shipped in Specter Desktop v2.1.7.

April 6, 2026

Solana predefined transfer confirmations could display an address lookup table reference instead of the real destination, creating a mismatch with the account credited on-chain. Handling of these references was improved.

April 6, 2026

A flaw in Solana account classification could mislabel account permissions in unsupported-instruction detail views. The classification was corrected.

April 1, 2026

OneKey's security team found a USB memory bug that could let an attacker run code on a Keystone 3 Pro with physical possession, the PIN, and an approved USB connection. Firmware 2.4.0 fixed it. Keystone reported no known exploitation.

April 2026

A Hardwear.io talk by Michael Mouchous and Karim Abdellatif describes fault injection attacks on OneKey's STM32F405 and ATECC608 chips that recover the pairing key protecting the seed. They report that a misconfigured random number generator gave every OneKey wallet the same pairing key and that the flaws cannot be fixed.

March 25, 2026

A URL parameter on the Trezor Connect documentation endpoint could load and run arbitrary JavaScript on the trusted connect.trezor.io domain. The reflected XSS has been resolved.

March 21, 2026

A compromised host could show a trusted EIP-712 domain on the Trezor screen while the device signed data for a different, attacker-controlled domain. Trezor says this could enable malicious permit approvals and fund theft.

March 20, 2026

An affiliate marketing tool on the Trezor site allowed redirects to any website. An attacker could use a legitimate-looking Trezor URL in a phishing campaign.

March 9, 2026

Biometric authentication in Trezor Suite could be bypassed when the host could not offer it, such as a laptop with its lid closed on an external monitor. This let other users of the computer open the app.

February 14, 2026

Trezor owners received printed letters claiming an "Authentication Check" would become mandatory by February 15, 2026, with a QR code leading to a phishing site. The final page asked for a 12-, 20- or 24-word seed phrase. BleepingComputer said the targeting criteria were unclear.

February 6, 2026

On Model One, standard recovery pads 12- and 18-word backups with random extra words; repeating recovery or a backup check let a malicious host spot the fake words, cutting security to 28 or 52 bits. Trezor now forces advanced recovery for those lengths.

January 26, 2026

Trezor's Andrew Kozlik reported two flaws in the BitBox02 Nova's OPTIGA secure chip configuration, one of which let an attacker with advanced physical access brute-force the device password past the limit of 10 attempts. The seed key is erased in the process, so only users who reuse the same password on another device were at risk. Firmware 9.25.0 fixed both.

January 10, 2026

Incorrect on-device display could mislead users into approving a seemingly minor fee bump that was actually malicious in a Bitcoin multisig wallet. The attacker would need to control one signer and the other signers would need a compromised Trezor Suite.

January 2026

Global-e, the company that runs checkout on Ledger.com, disclosed that attackers had accessed order records with Ledger customers' names, contact details, and order details. Ledger says seed phrases and funds were not affected.

December 2025

DARKNAVY reported a buffer overflow in Jade's descriptor registration command on firmware 1.0.24 to 1.0.36. QR mode was never exposed. Blockstream fixed it in 1.0.37, added downgrade protection in 1.0.38, and reported no known exploitation.

November 21, 2025

DARKNAVY chained firmware bugs in the Cypherock X1 Vault to replace its firmware, bypass secure boot and pass the vendor's device authenticity check, gaining control over newly generated seed phrases. The attack was shown at GEEKCON 2025 as a simulated supply chain attack. DARKNAVY said Cypherock silently patched two earlier reported vulnerabilities without acknowledging them.

October 31, 2025

In pre-production Safe 7 firmware given to a small group after launch, pressing Cancel did not cancel some non-critical flows such as staking delegation. The fix shipped in the public release.

October 19, 2025

An investor reported that about 1,209,990 XRP, worth more than $3 million, was drained on Oct. 12 from a wallet he viewed in Ellipal's mobile app. Ellipal said its review indicated the hardware wallet's seed phrase had been imported into the app, which stores keys on the phone and makes it a hot wallet. CoinDesk did not independently verify the investor's account.

October 2025

In October 2025 Ledger added a new fake email to its phishing warnings page. The email, headed 'Important: Ledger Data Security Incident', claimed a breach of a Ledger database and pushed a 'Secure My Account Now' button that led to a site asking for the seed phrase. Ledger did not report an actual breach.

September 29, 2025

Nathan Landon of Karma-X reported that the Delta PIN duress feature repeatedly signed a fixed digest, which allowed full private-key recovery from two transaction signatures. Coinkite patched it the same day, and the fix shipped in firmware 5.4.4 and 1.3.4Q.

September 24, 2025

A non-constant-time function used after unlock could let an attacker holding an unlocked device extract the seed. It affected all Model One devices and Model T, Safe 3 and Safe 5 on universal firmware with a BIP-39 backup.

September 17, 2025

Ledger Donjon used a tearing technique against Tangem's secure channel to skip the security delay after failed attempts, allowing about 2.5 password guesses per second. Existing cards cannot be patched, so users are advised to set strong passwords. Tangem concluded the finding would not be classified as a vulnerability.

September 12, 2025

Blockstream warned of phishing emails telling Jade owners to download new firmware through a malicious link. Blockstream said it never sends firmware files by email and that no data had been compromised.

June 23, 2025

Attackers abused Trezor's support contact form to send phishing emails asking for wallet backups. Trezor said the issue was contained.

June 14, 2025

SlowMist reported that a user who bought a tampered cold wallet on Douyin lost about 50 million yuan in crypto, with the private key stolen at the moment it was generated. SlowMist co-founder Yu Xian put the theft at about $6.5 million and said the scam revolved around the Ledger hardware wallet. The device came from a third-party seller, not Ledger.

May 30, 2025

Moonlock Lab reported 4 active campaigns in which macOS stealers such as AMOS delete Ledger Live and install a fake version that asks for the seed phrase. The technique had been active since at least August 2024.

May 15, 2025

Ledger Donjon found a flaw in the Tangem Android app that could let a counterfeit, backdoored card pass the genuine check. Tangem fixed it in Android app version 5.18.3 and paid a $15,000 bounty. Donjon reported that 30% of users had not yet updated by February 26, 2025.

May 11, 2025

An attacker took over a contracted moderator's account on Ledger's Discord server and used a bot to post links asking users to verify their seed phrase on a fake site. Ledger removed the account and bot, and some members said the attacker banned or muted them as they tried to warn others.

April 7, 2025

ZKNOX published tools that exploit a buffer overflow in Keystone 3 Pro firmware 1.2.2 and 1.2.4 to install a custom firmware update key, letting the owner sign and load their own firmware. The bug was reported on 19.08.24 and fixed in firmware 1.2.6. The exploit works because no memory protection was set and all memory areas were executable.

April 2025

Ledger owners received physical letters posing as Ledger and asking them to enter their seed phrase. Ledger confirmed the letters were a scam.

March 30, 2025

DARKNAVY found that a Tangem card answers the read command without checking the PIN, so anyone tapping the card can read its card and wallet information. It also noted that the delay against PIN guessing arrived only in card firmware 1.21, and cards cannot be updated.

March 2025

Ledger Donjon showed it could bypass the Safe 3's authenticity and firmware checks with a fault-injection attack on the microcontroller, a supply-chain attack that needs access to the device before it reaches the buyer. Trezor says the Safe 5 is not affected.

January 10, 2025

Guanxing Wen found the bootloader did not validate the reset_handler address during firmware updates, letting an attacker permanently brick a device. Ledger said funds were never at risk and fixed it in Nano X 2.4.2, Flex 1.2.2 and Stax 1.6.2.

January 2025

Ledger co-founder David Balland was kidnapped in France and held for a bitcoin ransom.

December 31, 2024

Tangem disclosed that when users activated a wallet with a seed phrase, the mobile app wrote the private key to its logs, which could reach the support team if the user contacted support through the app within 7 days. Tangem said fewer than 0.1% of users could be affected and no funds were lost. The bug was fixed in app versions 5.19.1 on iOS and 5.19.2 on Android, and support logs were erased.

December 18, 2024

On Edge firmware, a miniscript policy whose key placeholders were not strictly ascending could be saved in a form that later failed to load, blocking use of that wallet. The Liana team reported it, and it was fixed in 6.3.4X and 6.3.4QX. Coinkite said backups remained correct.

December 17, 2024

Phishing emails appearing to come from Ledger's support address, sent through SendGrid, claimed a data breach had exposed seed phrases. They linked to a fake verification page that collected the seed phrase.

November 19, 2024

An implementation error meant camera-captured entropy was not used as intended in Krux's AES-CBC encryption mode, weakening encrypted backups for users who had switched from the default AES-ECB. Krux 24.11.1 fixed it and advised affected users to recreate their encrypted backups.

November 11, 2024

MicroPython on Krux would import .mpy modules from an SD card before checking internal flash, which could be used to run unintended code. Krux 24.11.0 blocked running any code from the SD card.

November 2024

A SlowMist audit of OneKey Pro firmware v4.10.0 found that the device allowed Bluetooth pairing while the wallet was locked, so a malicious device could pair without the owner's approval and then send signature requests. SlowMist rated the issue medium and marked it fixed in firmware v4.11.0.

August 9, 2024

Jade firmware 1.0.31 added protection against a stack overflow crash triggered when an Elements or Liquid PSET was presented in place of a PSBT. The same release fixed a bug in identifying change outputs when a signer placeholder was reused in a registered descriptor policy.

May 30, 2024

Offside Labs found that a typo in OneKey Mini firmware left factory-only flash read and write commands enabled, and a missing length check allowed a buffer overflow that gave code execution. The researchers used it to access the mnemonic before the device was unlocked. OneKey merged a patch on 2023-12-20, paid a $5,000 bounty and pushed mandatory updates in January 2024.

March 19, 2024

Attackers took over Trezor's official X account on March 19, 2024 and posted fraudulent presale token offers with harmful links. SatoshiLabs said the cause was a phishing attack planned over several weeks, using a fake interview request and a malicious Calendly link, and that its products were unaffected.

January 17, 2024

An unauthorized party accessed the third-party support ticketing portal Trezor used on January 17, 2024, exposing names and email addresses of up to 66,000 people who had contacted support since December 2021. The intruder emailed 41 users asking for seed phrase information; Trezor said no seed phrases were disclosed.

January 2024

Offside Labs reviewed the Keystone 3 Pro and found a firmware vulnerability that Keystone fixed in firmware V1.2.8. Keystone paid a bounty and did not publish technical details of the flaw.

December 14, 2023

An attacker phished a former Ledger employee whose NPM access had not been revoked and published malicious Ledger Connect Kit versions 1.1.5 to 1.1.7. The code tricked users of DApps that load the kit into signing draining transactions; Ledger deployed a fix within 40 minutes of learning of it.

November 26, 2023

The Trezor Safe 3 returned the ECDHSessionKey without user interaction, skipping address confirmation screens. It concerned only the SSH feature and was fixed in firmware 2.6.4.

November 20, 2023

A library used by Ledger Live decoded odd-length hexadecimal integers in EIP-712 messages incorrectly, so the signed message could differ from the intended one. Ian Fisher reported it, and Ledger Live 2.70.0 fixed it.

November 5, 2023

A fake app called Ledger Live Web3 passed Microsoft Store checks and asked users for their seed phrase. The scammer took at least 16.8 BTC before Microsoft removed the app.

November 2023

A Keylabs audit of the Keystone 3 found one high-severity firmware weakness: tamper events were written only to external secure elements without checking the write succeeded, so an attacker could disrupt I2C traffic to avoid detection. Keylabs also reported low-severity entropy and memory-clearing issues. Keylabs verified the high-severity and two low-severity firmware issues were fixed.

October 27, 2023

Blockstream said its investigation into the October 2023 Jade phishing campaign found that customer data may have leaked from a third-party shipping provider. The leak included emails, and Blockstream could not rule out that phone numbers and shipping addresses were also taken. Blockstream took possession of the secure-blockstream.com phishing domain.

October 21, 2023

Jade users received emails claiming the Jade had been exploited and Blockstream had issued an emergency firmware release. Blockstream said it did not send them, and the emails came from an unrelated third-party domain rather than Blockstream's mail server.

September 21, 2023

Specter Desktop v2.0.2 fixed a login open redirect caused by manipulating the next parameter and patched an Electron flaw allowing out-of-package code execution when launched with an attacker-controlled working directory.

September 11, 2023

SeedSigner's dice-to-seed tool printed the dice rolls and the resulting seed phrase to the debug console. A pull request removed both prints before the next release.

September 2023

Ledger Donjon researchers used double laser faults to bypass read protection on part of the DS28C36 chip used as the Mk4's second secure element. No full seed recovery was shown because the Mk4 needs material from SE1, SE2, and the microcontroller.

August 23, 2023

BitBox engineers found during internal testing that the BitBox02 firmware 8.0.0 fix for the excessive-fee attack could be circumvented, and the Motterascio update patched it. The bug was found internally, and BitBox had no reason to believe anyone else knew of it.

August 2023

NGRAVE ZERO firmware v1.3.2 fixed two bugs. With 2FA enabled for unlocking, the device now asks for a fingerprint scan when the PIN code is changed in settings. The optional memo set in the LIQUID app is now shown on the ZERO confirmation screen so it can be checked before signing.

May 24, 2023

Recovery firm Unciphered said it could extract the seed from a Trezor Model T in its physical possession using a hardware flaw in the STM32 chip. Trezor said the attack resembled the read protection downgrade attack it had acknowledged years earlier.

May 16, 2023

Ledger confirmed an optional $9.99-per-month Ledger Recover service for Nano X that encrypts and splits a version of the private key among Coincover, Ledger and an independent backup provider. Critics said sending key fragments off the device undermined Ledger's security and privacy commitments.

May 11, 2023

Bitcoin app versions 2.1.0 and 2.1.1 mishandled the miniscript a: fragment and produced wrong addresses. Ledger said impact was limited because no deployed wallet fully integrated such policies, and version 2.1.2 fixed it.

May 10, 2023

Kaspersky examined a Trezor Model T bought through a classifieds site that had a swapped microcontroller and modified firmware. The firmware replaced the random seed with one of 20 pre-generated seed phrases, so the attackers knew the keys and later took the funds. Trezor said the supply chain attack happened over a year earlier.

May 3, 2023

Some BitBox users received a well-formatted phishing email urging them to download a new BitBox version. BitBox said it was not sent from a BitBox address and was most likely tied to the ActiveCampaign leak from July 2022.

March 7, 2023

Christian Reitter found that Ethereum processing code added in firmware v7.5.2 could be used to show confidential device memory on the KeepKey screen, revealing the seed of an unlocked device. KeepKey fixed it in firmware v7.7.0.

February 27, 2023

Starting February 27, 2023, Trezor customers received SMS and email messages claiming Trezor had suffered a data breach and linking to a fake site that asked for the seed phrase. Trezor warned users and said it found no evidence of a recent database breach.

February 15, 2023

Ledger Donjon showed that an attacker with a stolen original Jade could recover the ESP32 flash encryption key through power analysis, decrypt the firmware, and inject malicious code in an evil maid attack. On a Jade, the team collected around 500K traces in 2 hours to attack the key.

February 10, 2023

Unciphered showed that the OneKey Mini's processor and secure element communicated without encryption, so a tool placed between them could put the device in factory mode and read out the seed phrase. The attack required disassembling the device. OneKey said it had already patched the firmware without any users being affected.

February 7, 2023

Deprecated Trezor Connect versions still served for legacy integrations contained XSS flaws similar to those reported in August 2020. Trezor fixed it by removing those versions.

January 19, 2023

Ledger Donjon said the newer screen used in the Nano X and Nano S Plus needed stronger defenses against the OLED power side channel that can leak PIN digits. Ledger shipped a new PIN entry screen whose power pattern does not depend on the PIN typed.

December 7, 2022

Trellix researchers found an unsanitized tarfile extractall() call in Specter Desktop, which a crafted .tar file could use for a directory path traversal attack. Their patch checks that every archive member extracts safely before extracting.

October 17, 2022

Specter Desktop added spellcheck="false" to all its input fields after a report that browser spellcheck features could send typed data to a third-party spell checker. The project noted that all data in Specter is sensitive.

August 5, 2022

A pentest firm commissioned by Ledger found a flaw that would let an attacker with high privileges perform business operations on the Vault HSMs. Ledger deployed hotfixes for it and a variant and said it was not exploited.

July 29, 2022

An off-by-four boundary in the Mk4 Virtual Disk exposed four extra 512-byte blocks that wrapped to the area of PSRAM where a PSBT could be stored. Coinkite found it internally, found no exploit, and fixed it in firmware 5.0.6; Virtual Disk is disabled by default.

July 21, 2022

An unauthorized party downloaded BitBox's email lists from its marketing provider ActiveCampaign, exposing names or aliases, email addresses, and IP addresses of subscribers and recent buyers. Phishing emails followed. Shipping data, wallets, and the BitBoxApp were not affected.

July 6, 2022

Niv Yehezkel of Hexagate found the keycard replacement on the HW.1 and original Ledger Nano lacked brute-force protection, so an attacker with the PIN and physical access could replace the keycard and sign transactions. The products were discontinued and no fix was provided.

June 21, 2022

Dmitry Zemlyakov reported through the bug bounty program on 21 May 2022 that the BitBoxApp installer for Windows called the taskkill command in a way that could run a file named taskkill placed in the same folder. The installer could then run malware with admin privileges. The Rothorn update stopped calling taskkill, and Shift Crypto found no evidence of exploitation.

April 26, 2022

Christian Reitter reported vulnerabilities in the KeepKey supervisor. ShapeShift fixed them in bootloader bl_v2.1.4 and firmware v7.3.2.

April 26, 2022

Christian Reitter found that KeepKey wallet functions could be triggered at times when they should not be available, which under limited conditions could trick users into accepting unwanted actions. ShapeShift patched it in firmware v7.3.2.

April 3, 2022

Trezor owners received fake data breach notices sent through Trezor's opt-in newsletter hosted at MailChimp. The emails linked to a lookalike domain serving a modified Trezor Suite that asked for the seed phrase and sent it to the attackers.

March 24, 2022

ESET found trojanized Android and iOS wallet apps, including a fake OneKey Android app, distributed through websites that mimicked the real services. The malicious apps were built to steal victims' seed phrases. OneKey's own apps and devices were not compromised.

January 26, 2022

Hardware hacker Joe Grand used a fault injection attack on a Trezor One running old firmware to read its PIN from RAM and recover the owner's funds. Trezor said the flaw was older and already fixed for newer devices.

January 18, 2022

Before firmware v9.9.0, a compromised microSD card combined with a malicious BitBoxApp could make a restore from an attacker's backup look like a new wallet setup. BitBox found the issue itself, rated it low risk, and now requires on-device confirmation of any restore.

September 30, 2021

A malicious add-on posing as a SafePal Wallet extension was listed on the Mozilla add-ons store until community reports led Mozilla to remove it. SafePal warned users that the only legitimate SafePal Wallet download is on its own site and that fake websites, support sites and social media accounts remained active.

August 30, 2021

Jade firmware 0.1.27 fixed a potential issue where a derived key might not be wiped from memory after a failure. The changelog gives no further detail and reports no exploitation.

July 12, 2021

Without a field size check, an attacker could trick a user into signing a Stellar transaction that moved assets while appearing to be a ManageData transaction. Fixed in firmware 1.10.3.

July 9, 2021

Christian Reitter disclosed an electrical glitching attack against KeepKey firmware protections that needs physical possession and specialized tools. ShapeShift published an advisory and the first correctly patched version is firmware v7.1.7.

June 16, 2021

Scammers mailed fake replacement Nano X devices to customers exposed in the data leak, with a letter citing the leak. The device had a flash drive wired to its USB connector and instructions to run an app and enter the seed phrase.

June 2021

Ledger Donjon read protected ATECC608A secure-element data in the Coldcard Mk3 with two laser faults, and seed recovery also needed a separate attack on the STM32 microcontroller. In a later practical result, one of three challenge-wallet seeds was recovered in a specialist lab. Mk3 received no retrofit.

May 17, 2021

Timothée Isnard found a length-extension attack on the secure channel between Nano devices and Ledger's HSMs that, combined with a padding oracle, could decrypt a block of app data or firmware updates. Ledger said device security was not affected; fixes shipped in Nano S 2.0.0 and Nano X 1.3.0.

May 7, 2021

Christian Reitter found that a bug in some GCC 9 and 10 ARM compilers produced broken stack canary checks in KeepKey firmware v6.4.0 to v7.1.1, so stack smashing attacks could get past them. Fixed firmware starts at v7.1.2.

May 7, 2021

The same GCC compiler bug that broke KeepKey's stack canaries also affected Trezor One firmware 1.9.0 to 1.9.3 and Trezor T firmware 2.2.0 to 2.3.4. A newer compiler had already fixed the issue in Trezor's 2021 releases.

April 8, 2021

Shift Crypto warned that a new phishing website posing as the BitBoxApp had appeared and said it was working to take it down. It reminded users that sharing the microSD backup or the seed phrase hands over all their coins.

April 6, 2021

A fake Trezor app on Apple's App Store was downloaded 1,000 times before removal, and a similar fake appeared on Google Play. One victim lost 17.1 bitcoin after entering his details. Trezor had no official mobile app at the time.

April 2021

A stack buffer overflow introduced in KeepKey firmware v7.0.3 let remote or local attackers run code on the device and steal wallet keys, for example from a malicious website. It was patched in v7.1.0 after Christian Reitter's disclosure.

March 1, 2021

Nick Johnson cut the backup battery wire and bridged the tamper pads on a Cobo Vault Pro, the device later sold as Keystone, and it booted without detecting the tampering. He described how an attacker could then load modified firmware for a supply chain or evil maid attack. He also found a tamper-evident seal on the packaging came unstuck in the post without leaving void marks.

March 2021

Internal Coldcard firmware 4.0.0 enabled a USB serial console that let a connected host enter the MicroPython REPL after login and reach firmware secrets. Coinkite says 4.0.0 was never released publicly and 4.0.1 shipped with the console disabled.

February 16, 2021

Kraken Security Labs found the SafePal S1's tamper detection could be bypassed by reconnecting a single pin, and that an older firmware could be flashed back without detection. Kraken did not steal funds from the device. SafePal released firmware V1.0.24 to fix the downgrade issue.

February 9, 2021

Coldcard did not require one registered multisig xpub to belong to the device, so a compromised coordinator could substitute attacker-controlled xpubs while the wallet looked verified. Hugo Nguyen and Marko Bencun reported it privately on November 7, 2020, and it was fixed in firmware 3.2.1 before publication.

January 18, 2021

In August 2020 Towo Labs reported flaws in Ellipal's website and in the XRP support of the Ellipal wallet app. The app did not display XRP fields such as the destination tag and did not block unsupported transaction types, which could let an attacker take over an account. Ellipal fixed the XRP issues in version v2.8.1, paid a bounty, and said cold wallet users could always check transfer details before signing.

January 15, 2021

Following the database leak, Ledger owners reported phishing voice calls offering to help secure their Ledger. Andreas Antonopoulos said he received reports of dozens of such calls from across Europe.

January 13, 2021

A regression in Ethereum app 1.6.0 stopped the Contract data debug option from showing transaction data, so a compromised third-party client could get users to sign hidden data. Ledger Live was not affected, and app 1.6.4 fixed it.

January 13, 2021

Ledger disclosed that rogue members of Shopify's support team obtained its customers' records between April and June 2020, and Shopify reported a further 20,000 affected customers. The total reached about 292,000, and Ledger set up a 10 bitcoin bounty.

December 21, 2020

A Ledger customer database was dumped on RaidForums, showing that about 272,000 customers' names, postal addresses and phone numbers had leaked, far more than the 9,532 Ledger had identified. Ledger said the data came from its June 2020 e-commerce database.

December 21, 2020

After the customer database dump, Ledger customers received emails demanding bitcoin under threat of physical violence. One customer was told to pay $500 or face a home invasion.

December 18, 2020

CoolBitX disclosed a flaw in the encrypted Bluetooth protocol of the CoolWallet S, reported by KK8. An attacker within 30 meters with a second prepared CoolWallet could intercept private information when a user created or recovered a wallet through an outdated app. The fix shipped in app version 2.9.1 and card firmware 106.

November 24, 2020

Shift Crypto showed that a compromised computer could send a real mainnet transaction to a Coldcard in testnet mode, so the user would approve what looked like a testnet payment while spending real bitcoin. Shift reported it to Coinkite on August 4th, 2020 and published after the 90-day embargo lapsed without a released firmware update.

November 19, 2020

Christian Reitter found that Skycoin's firmware still contained a USB receive buffer overflow and a BIP39 recovery stack overflow that had been fixed upstream in Trezor. Skycoin patched its main branch on 2020-09-07 and paid a bug bounty.

October 1, 2020

KeepKey firmware 6.5.1 mitigated CVE-2020-14199, which could let an attacker trick a user into signing two transactions that move funds in an unintended way. The device now warns when the inputs of two similar transactions change. The same release mitigated a passphrase ransom attack and the OLED side channel, all reported through ShapeShift's Responsible Disclosure Program.

October 2020

Starting in October 2020, Ledger users received fake data breach emails linking to Punycode lookalike domains. The desktop download was a fake Ledger Live that asked for the seed phrase and sent it to the attackers.

September 10, 2020

CoolBitX said attacks on hardware wallet users could swap addresses and coins inside the companion app without the user noticing. SE firmware 101 and a matching app update let the CoolWallet S show the address and token on its e-ink screen so users can verify transactions on the card.

September 2, 2020

Shift Crypto disclosed that the KeepKey, like the Trezor, used a passphrase entered on the computer without confirming it on the device. A malicious wallet could substitute its own passphrase and hold coins received in that wallet for ransom. Shift Crypto reported it to ShapeShift on May 7, 2020 and later noted that ShapeShift fixed the issue.

September 2, 2020

Shift Crypto showed that the Trezor One before v1.9.3 and the Model T before v2.3.3 were open to a remote ransom attack when users typed their passphrase on the computer or phone. It reported the issue to SatoshiLabs on April 15th, 2020, and Trezor released the fixes on September 2nd, 2020.

August 8, 2020

Christian Reitter fuzzed the Skycoin hardware wallet, a fork of the Trezor One code, and reported 13 issues including out of bounds writes and information leaks. He said none appeared to be a practical threat to users, and most were patched.

August 4, 2020

Researcher monokh found that the Bitcoin app and most of its derivatives had no derivation path restriction, so an app such as Litecoin could derive keys or sign Bitcoin transactions. Ledger missed its 90-day disclosure deadline and fixed it in Bitcoin app 1.4.6.

August 3, 2020

A security researcher reported XSS issues in Trezor Connect in August 2020. Trezor fixed and deployed the issues shortly after.

July 29, 2020

An unauthorized party used an API key to access Ledger's e-commerce and marketing database on June 25, 2020. About 1M email addresses were exposed, plus names, postal addresses and phone numbers for a subset of 9500 customers.

July 14, 2020

Without a path isolation check, an attacker could trick a user into signing a Bitcoin transaction while the user believed it was a testnet or altcoin transaction. Fixed in firmware 1.9.2.

July 9, 2020

Kraken Security Labs reported that JTAG/SWD debug interfaces were enabled on the Nano X STM32WB55 MCU, allowing a supply chain attacker to reflash it. The Secure Element was not affected, and firmware 1.2.4-2 added a full MCU integrity check at boot.

July 3, 2020

With the scrambled keypad and login delay enabled, the PIN-entry layout was not re-scrambled after the forced delay ended. An anonymous customer reported it, and firmware 3.1.4 fixed it and changed scrambling between the PIN prefix and suffix.

July 2, 2020

Zengo researchers found Ledger Live added unconfirmed incoming bitcoin transactions to the balance and did not remove them when replaced via RBF, so users could believe they had been paid. Ledger Live 2.7.0 fixed it.

June 9, 2020

Towo Labs researchers found the XRP app did not display the Account field, so compromised client software could get a user to sign from a different account, and it also allowed malleable signatures. XRP app 2.0.1 fixed both issues.

June 3, 2020

Saleem Rashid found a BIP-143 flaw in the Bitcoin app and its derivatives that let compromised client software raise transaction fees without confirmation on the device if the user signed twice. It was fixed in Bitcoin app 1.4.0.

June 3, 2020

Saleem Rashid reported that malicious wallet software could get a user to sign a SegWit transaction twice and combine the signatures into one paying excessive fees. The flaw affected all hardware wallets supporting SegWit, and a joint fix was released on 3 June 2020 in BitBox02 firmware 8.0. Shift found no evidence of exploitation.

June 2020

Public cross-wallet research showed that a malicious PSBT and signing sequence could show misleading input amounts and redirect value to miner fees. Coinkite says it received no advance notice and blocked the attack class in firmware 3.1.4. No public Coldcard loss was found.

May 18, 2020

Ledger Donjon mounted a two-step side-channel attack on KeepKey PIN verification that exposes the PIN to an attacker with physical access. It works because KeepKey stores secrets on the general-purpose STM32F205 chip.

May 18, 2020

Ledger Donjon used laser fault injection on the Microchip ATECC508A chip in the Coldcard Mk2 to read the stored PIN code hash, which can then be brute forced offline. With the PIN, an attacker holding the device could access the bitcoin it manages. The attack requires physical access, equipment worth over $200,000, and expert knowledge.

May 12, 2020

Researchers sedited and TheCharlatan showed that modified firmware could clear the main PIN and restore the first-use flow while keeping the original bag number, so a tampered unit could appear unused. Coinkite pointed to firmware verification and first-use checks; there was no retrofit to the immutable bootloader.

April 30, 2020

The Monero app did not verify the unlock time field, so an attacker could get a user to sign a transaction locking funds for a very long time. It affected Nano S and Nano X and was fixed in Monero app 1.6.0 with protocol version 3.

April 27, 2020

Dušan Klinec found further flaws in the Monero app protocol that let a malicious Monero client extract the private spend key (CVE-2020-6861). It affected Nano S and Nano X users and was fixed from Monero app 1.5.1.

April 4, 2020

Christian Reitter found that the BC Vault One emits different electrical noise depending on pressure on its case, which a hardware implant on the USB line could use to capture PIN entry. He reported the side channel was still present in firmware 1.3.7 and knew of no vendor mitigation. The device was also affected by the 2019 OLED side channel, with minor impact.

April 3, 2020

Kraken Security Labs found that the CoolWallet S Android app stored the wallet's PIN, pairing password and hardware seed in plaintext, so a stolen or infected phone could empty the paired wallet. Kraken disclosed the issue to CoolBitX on January 2 and the company released app fixes. Kraken noted that PIN checks still run on the phone rather than the card.

March 7, 2020

A crafted multisig transaction could exploit inconsistent input sanitization on Model T to include an attacker change output the user never confirmed. Reported by Saleem Rashid.

March 6, 2020

A malicious Chrome extension named Ledger Live asked users to enter their seed phrase. It was downloaded at least 120 times before removal, and Ledger warned users on March 5.

March 5, 2020

A crafted transaction could hide, inside a very long prevhash, an output sending all funds to an attacker. The result would be non-standard, so an attacker would need to mine their own block.

March 5, 2020

The confirmation dialog for an OP_RETURN output was not displayed when the address_n field was provided. It affected Model One and Model T.

March 3, 2020

Due to a design flaw in BIP-143, an attacker could create two SegWit transactions that together sent coins away as a large transaction fee. Fixed in firmware 1.9.1 for Model One and 2.3.1 for Model T.

March 2, 2020

A crafted multisig transaction could use a time-of-check to time-of-use bug on Model T to include an attacker change output the user never confirmed. Reported by Saleem Rashid.

February 27, 2020

The Trust PSBT setting for multisig wallets was ignored by Coldcard firmware. The fix shipped in firmware 3.1.2 and was credited to CasaHODL, with no public technical report or impact analysis.

February 4, 2020

BC Vault's local web daemon shipped the private key for a CA-signed localhost.bc-vault.com certificate inside its binary. BC Vault said the key could only help a phishing or DNS spoofing attack, revoked the certificate, and moved to per-installation certificates, with versions from 1.3.4 using plain localhost.

February 1, 2020

The Monero unlock_time field was not shown on the device, so an attacker could lock a user's funds for a very long time by setting a high value. It affected Model T.

January 31, 2020

Kraken Security Labs showed a voltage glitching attack that extracts the encrypted seed from Trezor One and Model T with about 15 minutes of physical access, then brute forces the PIN. It relies on flaws in the microcontroller; a strong passphrase prevents it. Kraken reported it to Trezor on October 30, 2019.

January 28, 2020

Fuzzing by Christian Reitter found memory safety issues in the base64 library the BitBox01 used to decode USB messages from the host. Shift Cryptosecurity patched the decoder in BitBox01 firmware v7.0.4.

December 19, 2019

Dmitry Petukhov showed that appended script operations could make an attacker-controlled multisig output pass as wallet change, hiding it from the user. Firmware 3.0.6 simplified parsing and now displays all change outputs. Coinkite reported no evidence of exploitation.

December 17, 2019

LazyNinja reported that a side-channel attack on the BitBox02 microcontroller could bypass the limit of 10 unlock attempts, letting an attacker with long physical access brute-force weak passwords. The secure chip still capped total attempts. Shift Crypto fixed it in firmware 5.0.0 and found no evidence of exploitation.

December 10, 2019

Kraken Security Labs extracted the encrypted seed from a KeepKey with about 15 minutes of physical access using voltage glitching, then brute forced the PIN. Kraken said the microcontroller flaw is hard to fix without a hardware redesign.

December 9, 2019

Christian Reitter found that the Trezor One dry-run recovery stack overflow, fixed by Trezor in June 2018, still caused memory and stack smashing faults on Archos Safe-T firmware 1.1.3. Archos had not responded to his reports as of 2019-12-09.

November 2, 2019

The BitBox02's OLED display leaks partial screen contents through its power consumption. A hardware implant in the USB cable could use this to try to recover the PIN or seed phrase while they are on screen, though the BitBox02 does not display the seed phrase by default.

November 1, 2019

A malicious coordinator could send wallet-controlled change to a deeply derived path the owner could not practically reconstruct, enabling a ransom attack. Researchers sedited and TheCharlatan reported it, and firmware 3.0.2 constrained and validated derivation paths.

November 1, 2019

Path parsing accepted whitespace and newlines, so the real tail of a derivation path could be pushed off the Coldcard screen. The same researchers reported it in the same report as the change-path issue, and firmware 3.0.2 fixed the parsing and display.

October 29, 2019

Saleem Rashid reported two vulnerabilities in the BitBox01's mobile pairing through the bug bounty program on 17 September 2019. Users who paired the BitBox01 with the mobile verification app were affected. BitBoxApp 4.14.0 shipped BitBox01 firmware 7.0.3 with the fix, and users had to pair their phone again after updating.

October 4, 2019

The Monero app was vulnerable to a replay attack in which a malicious Monero desktop client could extract the user's private spend key. It affected Nano S and Nano X users and was fixed in Monero app 1.5.1.

October 1, 2019

A crafted multisig transaction could use a time-of-check to time-of-use bug on Model T to include an attacker change output the user never confirmed. Fixed in firmware 2.1.8.

September 19, 2019

Christian Reitter found a buffer overflow in the KeepKey USB receive buffer by fuzzing. ShapeShift fixed it in firmware v6.2.2 in September 2019.

September 19, 2019

A flaw let an attacker erase a cryptographic key and compromise the U2F second-factor protection of the KeepKey. It was fixed in firmware v6.2.2 in September 2019.

August 7, 2019

Christian Reitter found that power consumption of the OLED display on the Nano S and Nano X varies with lit pixels, which could in theory let a USB cable implant recover the PIN or seed phrase. Ledger rated it non-critical and said it was not demonstrated in practice (CVE-2019-14354).

August 7, 2019

Christian Reitter found that OLED power consumption on Mk1 and Mk2 devices might reveal partial screen contents, such as the PIN or seed words, through measurements on the power supply (CVE-2019-14356). Firmware 2.1.2 masked PIN entry and added noise while seed words are shown. Coinkite found no public evidence of theft.

August 7, 2019

Researcher Christian Reitter found that the OLED displays used in many hardware wallets leak screen contents through power draw on the USB line, which could let malicious equipment recover parts of a PIN or seed phrase. The Archos Safe-T received its own identifier, CVE-2019-14358. The disclosure timeline lists only a first communication attempt with Archos and no vendor reference.

August 7, 2019

Christian Reitter reported that the SSD1309 OLED screen in BC Vault leaks displayed content through power consumption, measurable by an implant on the USB connection. BC Vault said its screen never shows seed words or the PIN, so only the PIN length could leak, and it planned no mitigations.

August 7, 2019

Christian Reitter reported that the power drawn by KeepKey's OLED screen could reveal what it displays, including the seed phrase, to equipment measuring the USB power line. ShapeShift said an attacker would need physical access, an oscilloscope and statistical analysis, and called the risk to users insignificant.

July 1, 2019

Ledger Donjon said an attacker with a stolen Trezor One, Model T or KeepKey could extract the seed in under 5 minutes with about 100$ of equipment. The flaw cannot be fixed in firmware, and a strong passphrase protects the seed.

July 1, 2019

Ledger Donjon said its seed extraction attack on stolen devices affects KeepKey as well as Trezor models, takes under 5 minutes, and needs about 100$ of equipment. It cannot be fixed by a firmware update.

June 25, 2019

Ledger Donjon reported several vulnerabilities in the original Ellipal wallet, including one that lets an attacker with physical access extract the seed. Other findings let an attacker re-activate disabled communication interfaces and backdoor the device for supply chain or evil maid attacks. Ellipal issued an upgrade after disclosure.

June 14, 2019

Saleem Rashid reported two vulnerabilities in the BitBox01's blinking patterns through the bug bounty program on 12 April 2019. A compromised app could trick a user into confirming a different action than expected. Firmware 6.1.1 made the patterns easier to tell apart, and Shift Crypto found no evidence of exploitation.

June 3, 2019

Satochip applet v0.7-0.2 fixed a replay attack that could bypass two-factor authentication when importing a new seed. The applet was in beta at the time and users were told to stay on testnet.

April 30, 2019

KeepKey firmware v6.1.0 included a fix for an RDP1 glitched downgrade attack. The release notes give no further detail.

April 8, 2019

A bug in the Ledger Monero code built some transactions incorrectly so the wallet did not credit the change, making Nano S users believe funds were lost. Monero developers issued a patch and balances were restored.

April 8, 2019

Christian Reitter showed that power analysis could read the information shown on the Model One OLED display. Trezor fixed the issue in a firmware update.

March 28, 2019

Firmware 6.0.3 fixed a BitBox01 issue with non-standard keypaths for change addresses. An attacker who compromised the computer could send the change of a transaction to a key the user could not easily find and demand a ransom to unlock it. Shift Crypto had no reports of the flaw being exploited.

March 8, 2019

Shift Crypto's internal security team found that the desktop app could relay any requested receive address to the BitBox01 mobile verification app. An attacker who compromised the computer could trick a user into locking new coins and demand a ransom to unlock them. Firmware 6.0.2 limited the range of receive addresses that can be sent for verification.

January 28, 2019

An invasive interposer could falsify selected secure-element responses and bypass the normal PIN-attempt delays, making short PINs brute-forceable. Coinkite hardened the design in bootrom 1.1.0 and the Mk2 circuit board. Researcher Lazy Ninja reported the issue.

January 18, 2019

Christian Reitter and Jochen Hoenicke disclosed a U2F information leak in which 3 bytes of device RAM were leaked during the initial handshake. Shift Crypto found no obvious way to exploit it, released a patch with desktop app v4.4.0 and firmware v6.0.0, and had no reports of lost funds.

January 3, 2019

KeepKey firmware v6.0.0 fixed an integer overflow vulnerability in USB packet handling. The same release enabled the Memory Protection Unit.

January 2, 2019

Using specialized hardware to inject a fault into the USB stack comparison, an attacker could make the device return sensitive data in a USB descriptor. Fixed in firmware 1.8.0 for Model One and 2.1.0 for Model T.

December 28, 2018

At 35C3, researchers Dmitry Nedospasov, Thomas Roth and Josh Datko presented attacks including a hardware implant that pressed the Nano S confirmation button by radio and a side channel that guessed Ledger Blue PIN digits from radio emanations. Ledger said no seed or PIN was extracted from a stolen device and called the attacks impractical.

December 27, 2018

The signature check on the Nano S microcontroller could be bypassed to install arbitrary MCU firmware, as shown at 35C3. Ledger said the flaw allowed nothing beyond what the JTAG interface already allowed and that the seed and PIN stay on the Secure Element.

December 27, 2018

The wallet.fail team showed that glitching hardware could push the processor into Read Protection level 1 during a firmware update, allowing RAM readout. Trezor stopped keeping sensitive data in RAM during updates in firmware 1.8.0.

December 18, 2018

Christian Reitter found that U2F init response packets carried three extra bytes of device memory, a flaw inherited from shared U2F code. KeepKey fixed it in firmware 5.10.3 and the issue was disclosed publicly on 2018-12-18.

December 6, 2018

A firmware mistake let an attacker on a compromised computer query the master xpubs of the standard and hidden wallets and recombine them into both master private keys. Shift Crypto patched it on 12 March 2018 in firmware v3.0.0 and delayed publishing details. Shift found no evidence of exploitation but advised moving funds to a new wallet.

December 6, 2018

During initial pairing with the mobile verification app, malware on the computer could insert itself as a man-in-the-middle and later change what the phone displayed. Saleem Rashid reported it, and Shift Crypto patched it on 31 July 2018 in firmware v4.0.0.

December 6, 2018

With the casing opened and probes attached between the secure chip and microcontroller, an attacker could reset a BitBox01 without erasing the wallet secrets and then access the old wallet. Shift Crypto patched it on 31 July 2018.

December 4, 2018

BitBox01 USB communication was encrypted but not authenticated, so a man-in-the-middle could modify parts of it. Shift Crypto added a message authentication code in firmware v5.0.0 on 4 December 2018 and said no exploit method had been reported.

December 2018

Archos Safe-T mini firmware 1.1.3 switched to a recent version of the trezor-crypto library, which the changelog says fixed recent buffer overflow vulnerabilities. The flaws sat in the upstream library the Safe-T firmware is built on.

November 26, 2018

A broken struct definition in Yubico's U2F reference implementation could leak bytes from RAM over USB. Trezor fixed it in firmware 1.7.2.

November 11, 2018

Sergey Lappo of Mycelium found the Bitcoin app let an attacker add an unverified change output to a legitimate transaction, sending funds to an arbitrary address without extra confirmation. Nano S firmware 1.5.5 and Bitcoin app 1.3.3 fixed it.

October 31, 2018

Charles Guillemet of Ledger Donjon showed that power and electromagnetic traces could be used to unlock a locked device. Trezor rewrote device storage in firmware 1.8.0 so PINs are no longer compared directly.

October 30, 2018

An integer underflow in the Bech32 reference decoder led to a buffer overflow on malformed addresses, and a similar cash_decode() flaw sat in the trezor-crypto library used by KeepKey. ShapeShift patched KeepKey and paid a bounty; the issues were disclosed on 2018-10-30.

September 26, 2018

An unsigned integer overflow in the C reference bech32 implementation could lead to a buffer overflow; the same issue was found in cash_decode. Fixed in firmware 1.7.1.

August 30, 2018

Researchers Saleem Rashid and Ryan Castellucci showed that the secret phrase and salt stay in Bitfi's memory long enough to be extracted, letting an attacker generate the private keys. Rashid said the exploit takes less than two minutes to run. Bitfi had declined to pay its $250,000 bounty for the earlier attack.

August 14, 2018

Security researchers including Andrew Tierney, Alan Woodward and Saleem Rashid gained control of the Android-based Bitfi wallet, which John McAfee had promoted as unhackable, and later said they extracted the seed and passphrase. Bitfi argued the attacks did not meet its $250,000 bounty terms. The company received a Pwnie award for worst vendor response.

August 1, 2018

A researcher reported cross-site request forgery issues in Trezor's Dropbox integration in August 2018. They were fixed and deployed shortly after.

July 8, 2018

The bootloader protection added in firmware 1.6.1 could be circumvented through the SYSCFG registers. Trezor fixed this by disabling those registers via the memory protection unit.

July 1, 2018

Traffic meant for wallet.trezor.io was redirected to a fake site that asked users to enter their seed phrase. Users noticed an invalid HTTPS certificate, and Trezor had the site taken down through its host.

June 25, 2018

Christian Reitter reported a buffer overflow in the KeepKey USB receive buffer. The fix shipped in bootloader v1.1.0 and firmware v5.5.0 in June 2018.

May 25, 2018

A crafted USB packet could trigger a buffer overflow that could lead to code execution on older Model One firmware. Fixed in firmware 1.6.2.

May 25, 2018

Crafted USB communication could trigger a stack overflow during recovery that could lead to code execution. Fixed in firmware 1.6.2.

March 21, 2018

A flaw in the write-protection of the STM32F2 chip could allow unsigned code to run on KeepKey. Firmware v5.1.0 hotpatched all bootloaders to block execution of unsigned binaries.

March 20, 2018

Researcher Timothée Isnard found a padding oracle attack on the secure channel between Ledger devices and Ledger's HSM that allowed decryption of firmware updates. Ledger said device security did not depend on firmware confidentiality and added the missing MAC.

March 20, 2018

Researcher Saleem Rashid showed the Secure Element's check of the Nano S microcontroller firmware could be bypassed with physical access before seed generation. He demonstrated a modified firmware that displays a seed phrase chosen by the attacker, a scam a malicious seller could use. Firmware 1.4 mitigated it.

March 20, 2018

Researcher Sergei Volokitin found that a malicious app could break the isolation between apps and read data held by apps such as GPG, U2F or Neo. Exploitation required installing an unsigned app, and firmware 1.4 fixed it.

March 14, 2018

A format string vulnerability in KeepKey firmware 4.0.0 let attackers display information that should not be accessible, using text with characters missing from the device's font.

February 12, 2018

Saleem Rashid found that the bootloader write-protection in the STM32F205 chip used in the Trezor One did not work as intended. Trezor fixed it by enabling the memory protection unit.

February 5, 2018

Researchers published a proof of concept in which malware modified the Ledger Chrome application to change the receive address shown on the computer screen. Ledger said users were not at risk if they verified the receive address on the device screen and that it knew of no losses.

January 8, 2018

A Reddit user lost over $34,000 in coins after buying a second-hand Ledger Nano from an eBay seller. The seller had initialized the device and supplied its own seed phrase instead of letting the device generate one.

September 1, 2017

After firmware 1.5.2 fixed SRAM memory access, a Medium article claimed Trezor had been hacked. Trezor found the described attack vector was already closed by that update.

August 1, 2017

SRAM was not cleared on soft reset, so secrets could be extracted using special firmware and direct access to the device board. Trezor fixed it in a firmware update.

June 1, 2017

Researchers Josh Datko and Chris Quartier reported a theoretical fault attack by glitching the clock or voltage and presented it at DEF CON. Trezor added their recommendations to firmware 1.5.1 and does not classify it as an issue.

January 2, 2017

An attacker took over KeepKey founder Darin Stanchfield's phone account and email, then reset passwords on linked company accounts and demanded 30 bitcoin. The attacker reached a sales channel, a shipping vendor and an email marketing account and may have taken customer addresses, emails and phone numbers. KeepKey said funds on its hardware wallets were never at risk.

March 26, 2015

With physical access and an oscilloscope, an attacker could use power analysis to extract an individual private key. Trezor fixed this in firmware 1.3.3.

February 23, 2015

A crafted multisig transaction could use a time-of-check to time-of-use bug to include an attacker change output the user never confirmed. Fixed in firmware 1.3.1.

July 30, 2014

A crafted transaction could trigger a buffer overflow and extract the private key, but required local interaction with knowledge of the PIN and passphrase. Fixed in firmware 1.3.1.