Security experts have uncovered a critical vulnerability impacting certain crypto hardware wallets, enabling attackers to covertly authorize Bitcoin transactions and potentially steal user funds.
The issue lies within the widely adopted ESP32 chip, a microcontroller produced in China and commonly found in connected devices and embedded systems. This chip is integrated into several hardware wallets, including models like Blockstream Jade and open-source initiatives such as Bowser and Colibri, raising serious security concerns.
Given that these chips often manage access to sensitive systems or store vital cryptographic data, the implications of this flaw are particularly worrying for cryptocurrency holders. Attackers can reportedly leverage the chip’s wireless capabilities (Bluetooth and Wi-Fi) to push malicious updates, achieve deep system access, and compromise sensitive information, including private keys.
Further analysis revealed multiple weaknesses within the chip. A flawed random number generator produces insufficiently random outputs, potentially allowing prediction of Bitcoin private keys. Additionally, inadequate validation processes permit the use of invalid cryptographic keys.
Wallets based on the Electrum protocol face heightened risk due to flawed hashing logic within the chip. This vulnerability allows attackers to manipulate message formatting and create counterfeit digital signatures that could be accepted as legitimate Bitcoin transactions.
The most alarming aspect for crypto users is the undetectable nature of this exploit. In a proof-of-concept demonstration, researchers successfully circumvented standard security protocols, recovered a private key, and accessed a live Bitcoin wallet containing 10 BTC, all without triggering any user alerts.
Beyond individual crypto wallets, this vulnerability presents broader security threats. It creates potential pathways for extensive supply chain compromises, state-sponsored intelligence gathering, and large-scale theft operations targeting any network utilizing ESP32-based devices.
To counter this threat, security professionals recommend using hardware from trusted manufacturers, maintaining up-to-date Bitcoin software, and utilizing robust, well-vetted cryptographic libraries to prevent key theft and transaction forgery.
While hardware wallets are often considered safer than software-based options (which frequently face exploits), securing physical devices remains a significant challenge. This incident underscores the ongoing need for vigilance in the crypto hardware space.
Recent security evaluations highlighted other concerns as well. For instance, researchers noted that some Trezor Safe models utilize a general-purpose microcontroller (STM32-based) susceptible to physical manipulation, even with a dedicated secure element for PINs and secrets. Techniques like voltage glitching, executable purely via software, could potentially compromise these devices undetected.