Cryptocurrencies, blockchain, NFT and new trends

Cybersecurity firm claims it hacked seed phrase from a Trezor T hardware wallet in possession

Companies • May 24, 2023, 2:13PM EDT

Quick Take

  • Unciphered, a cybersecurity firm, claims to have hacked into the popular Trezor T model hardware crypto wallet manufactured by Satoshi Labs.
  • The firm showcased in a video the extraction of the wallet’s seed phrase, exploiting a hardware vulnerability that requires physical possession of the device.

Stay updated on Pro Crypto Ecosystems news by locking ACS tokens with The Block.

Connect/Create Wallet You can unlock at any time.*
No wallet? No problem. You can set one up for free. We recommend Torus for first-time users.
*a 2% locking fee will be added at the time of locking. Learn more about Access Protocol

Cybersecurity startup Unciphered claims it was able to hack into the popular Trezor T model hardware crypto wallet manufactured by Satoshi Labs.

In a YouTube demonstration, Unciphered showcased the apparent extraction of the wallet’s mnemonic seed phrase, or private key, exploiting a hardware vulnerability that relies on physical possession of the device.

This is not the first time Unciphered has seemingly managed to retrieve seed phrases from hardware wallets. In February, the company demonstrated a similar hack on a wallet manufactured by Hong Kong-based OneKey.

Hardware wallets, which store private keys offline and are designed to protect crypto assets, are generally considered highly secure. Unciphered said, however, that the hardware security mechanisms of the Trezor T model can be theoretically bypassed if a hacker had a T wallet in possession.

The type of exploit depicted by Unciphered would only be feasible if the attacker had physical access to the hardware wallet.

In the video, the Unciphered team said it developed an “in-house exploit” that allowed them to extract the wallet’s firmware. Eric Michaud, co-founder of Unciphered, claimed that by leveraging specialized GPU chips, they were eventually able to crack the device’s pin seed phrase.

“We uploaded the firmware we extracted onto our high-performance computing cracking clusters,” Michaud explained in the video. “We have about 10 GPUs, and after some time, we extracted the keys.”

Michaud further claimed that fixing this exploit for Trezor T would require a recall of all their products.

Trezor’s Response

Trezor acknowledged that Unciphered’s demonstration had similarities with the Read Protection Downgrade (RDP) vulnerability discovered by Kraken Security Labs researchers that affected both the Trezor One and Trezor Model T. This implies that the vulnerability is not new.

“This appears to be a vulnerability called an RDP downgrade attack and as communicated on our blog in early 2020, RDP downgrade attacks require physical theft of a device and extremely sophisticated technological knowledge and advanced equipment,” Trezor’s chief technology officer Tomáš Sušánka said. “Even with the above, Trezors can be protected by a strong passphrase, which adds another layer of security that renders a RDP downgrade useless.”

Trezor added that it has taken significant steps to resolve the issue in future by developing a new secure element for hardware wallets with its sister firm, Tropic Square.

This story has been updated with a comment from Trezor.