Cybersecurity firm Unciphered reported that the largest cold wallet manufacturer Trezor hacked its model T. The possibility of cold wallet hacking raises security issues for crypto custodians again.
Unciphered claims to have hacked Trezor hardware wallet
On May 24, the Unciphered team released a video of extracting the wallet’s seed words or private key. Cryptocurrency recovery firm disassembled Trezor to remove its internal circuit board. It was connected to the laboratory equipment that enabled the device’s firmware to be extracted.
JUST IN: Unciphered, a cybersecurity company has successfully breached the private key of the widely used Trezor T model hardware wallet.
Trezor says this hack only works with physical possession of the device and sophisticated tools.
— WhaleWire (@WhaleWire) May 24, 2023
Vulnerability discovered in crypto custody service Trezor
Unciphered reports that Trezor uses powerful GPUs to work on debugging the T model product. Eric Michaud, co-founder of Unciphered, says:
We loaded the extracted firmware on our high-performance computing crunch clusters. We have about 10 GPUs… and it took a while but we got the PIN.
He also stated that the rollback is possible “with a hack we developed in-house.” The team also had to write custom code for the hack, explaining it was “extremely difficult”.
Michaud stated that the hack cannot be fixed with firmware updates. “To fix this, Satoshi Labs will need to recall all of its products. But they probably won’t do that,” he said.
Trezor answers
Trezor stated that his team did not have enough details about this particular attack. He added that it appears to be an “RDP [Read Protection] downgrade attack,” which was generally marked as risky in early 2020.
The RDP Downgrade attack is a definitive attack that targets the hardware vulnerability of STM32 microchips used in Trezor One and Trezor Model T hardware wallets. In addition, the attack requires physical seizure of the device, “highly advanced technological knowledge and advanced equipment.”
Should crypto investors be worried?
The news that Trezor could be hacked comes just a week after problems with rival company Ledger. The crypto Twitter community has been awash with comments calling for Ledger to be abandoned in favor of Trezor. However, this trend has now been suppressed.
Ledger came under fire last week for launching a recovery service that gave control over the storage of seed words. The former CEO admitted that the device is not reliable. Also, current CEO Pascal Gauthier apologized for the firm’s recent mistake. Although it has been proven that cold wallets can now be hacked, it should be noted that high-level equipment is required for this.
cryptocoin.com In this article, we have included the developments around Ledger last week. The company’s launch of a ‘recovery service’ on seed words has caused concerns among the community. Many anticipate that this decision will bring more security issues.
