Every vector has a mitigation. None is free. Stacking SE, air-gap, passphrase and multisig also stacks cognitive load — the first vector remains operator error.
Fault injection / voltage glitching
PhysicalYou disturb a chip’s power or clock at the exact moment it makes a security decision, to make it skip a check (PIN, protected read, boot).
Voltage glitching injects a micro-cutoff or a spike on Vcc for a few nanoseconds. On a general-purpose MCU (the STM32 of Trezor One / Model T), that was enough to dump flash and extract the encrypted seed without the PIN. Secure Elements add voltage detectors, integrity meshes, internal clocks. They make the attack more expensive, not impossible — the Donjon showed it with a laser on TROPIC01. The attacker needs physical access, a setup, and often to open the case.
Mitigations
- — Certified SE, better: several independent layers
- — Passphrase not stored: even an extracted seed ≠ funds in the hidden vault
- — Multisig: one extracted key does not spend
Side channels
PhysicalYou observe power consumption, electromagnetic emissions, or execution time during a signature to reconstruct key bits.
A serious SE hardens cryptographic operations (masking, time randomization, dual-rail). An MCU that signs with a naive software library leaks. These are lab attacks, not pickpocket attacks. They count if your adversary is a state, a private lab, or a thief who has time to set up a bench.
Mitigations
- — SE with DPA/SPA countermeasures
- — Do not leave the device with a third party “for diagnosis”
- — Passphrase + multisig so that the extracted key is not enough
Evil maid
PhysicalSomeone touches the device in your absence: implant, malicious firmware, camera, replacement with a clone.
The evil maid attack does not need to break the SE. It is enough to replace the device with a lookalike that displays fake addresses, or to plant a camera that films the seed at the next unboxing. Authenticity attestation and firmware verification at boot are the answers — if you actually do them. A physical seal on the packaging is only theater if the supply chain upstream is already compromised.
Mitigations
- — Buy direct from the manufacturer, verify attestation on first connection
- — Never reuse a device that stayed out of sight in a hostile context
- — Reproducible firmware + compared hash
Blind signing and host malware
RemoteThe PC or phone is infested. The device signs what it is sent, and the screen is too small to really show the contract call.
The hardware wallet does not see “intent”. It sees bytes. If the screen displays “Ethereum, 0 ETH” while the payload authorizes an infinite transferFrom, you just signed the drain. This is the most profitable class of attacks day to day, because it requires neither a lab nor physical access. USB and Bluetooth only carry the poison; QR air-gap at least forces a visual round-trip, which only helps if the screen actually parses the contract.
Mitigations
- — Clear signing (large screen, contract parsers)
- — Air-gap to eliminate USB/HID
- — Address whitelist, spending policies, small daily limits
Supply chain and clones
Supply chainThe device is intercepted, reconditioned, or sold “new” on a marketplace with a seed already known to the attacker.
Fake Ledgers on Amazon or eBay were a classic: the device arrives pre-initialized, or the attacker implanted firmware that exfiltrates. Less spectacular, an intermediary can replace an SE with a chip of the same appearance. Factory cryptographic attestation is the countermeasure — it assumes attestation keys have not leaked and that you actually compare the response to the manufacturer’s server.
Mitigations
- — Buy only from the manufacturer or an official reseller
- — Verify attestation before putting anything on it
- — Generate the seed yourself, never a device “already configured”
Social engineering and seed phishing
SocialFake support, fake site, “Ledger Live sync”, Giveaway, airdrop. The seed is the real vault; the dongle can do nothing if you type it elsewhere.
After the Ledger customer database leak in 2020, thousands of people received emails and physical packages of chilling credibility. No hardware wallet protects against a seed photographed, dictated to a “technician”, or entered on a site that imitates Ledger Live. Tangem seedless reduces this class. The passphrase reduces the impact of a stolen seed. Nothing replaces the rule: those 12 or 24 words are typed nowhere except on the device, off camera.
Mitigations
- — Never a seed on a computer, a phone, a cloud, a photo
- — Passphrase memorized separately
- — Ignore any support that asks for the seed — always
Weak entropy at generation
EntropyThe seed is born too small. After that, no SE, air-gap, or PIN can stop a computation from recovering the key.
A 24-word BIP39 seed draws 256 bits of entropy. If the generator itself only provides 40, the space becomes enumerable. This happened to Coldcard: a software fallback replaced the hardware RNG for years, and wallets were emptied remotely, without touching the device. Open source had not prevented the bug from lasting. Dice, coins, user entropy are not folklore: they are the insurance that even defective firmware is not the only source of randomness.
Mitigations
- — Add dice (50+ rolls) or human entropy at generation
- — Prefer 24 words to 12 when the UX allows
- — After a security advisory on the RNG: migrate, do not “update and stay”
Firmware capable of exporting
FirmwareIf an update can add a seed-export function (even fragmented), the model “the SE cannot output the key” becomes a model “the SE does not do it today”.
This is the heart of the Ledger Recover controversy. Technically, fragmenting encrypted entropy 2-of-3 and sending it to custodians is not “sending the seed in the clear to Ledger”. Politically and in the trust model, it proves that closed silicon can be instructed to export. Optionality (you have to enroll, KYC, a payment) reassures some users and not others: a firmware capability does not need to be clicked to exist.
Mitigations
- — Reproducible builds, release review, delay before update
- — Bitcoin-only and minimal firmware surface
- — Multi-vendor multisig: a traitor firmware does not spend alone
“Successful” does not always mean “millions stolen”. A public proof of concept that forces a whole market to change architecture is a successful attack. A controversy that breaks a slogan is one too.
2020
Kraken Security Labs vs Trezor One / Model T
- Target
- Trezor One, Model T (STM32 MCU, no SE)
- Method
- Voltage glitching, ~15 minutes of physical access
- Impact
- Extraction of the encrypted seed without the PIN. Public proof of concept, not a wave of mass thefts.
In January 2020, Kraken Security Labs describes a setup of a few hundred dollars that they say could be industrialized around $75. By glitching the STM32’s power, they skip protections and dump flash. The seed is encrypted there, but the encryption mechanism no longer holds once memory is read and the PIN bypassed.
The attack requires holding the device. It does not travel over the Internet. It is enough, however, for a targeted theft, a seizure, a border check, a malicious roommate. SatoshiLabs later responded by adding an SE on the Safe line — while keeping the firmware open.
Discontinued One and Model T still exist in drawers. They remain usable if your threat does not include a competent physical adversary. They are the wrong tool if that is precisely what you fear.
Lesson. An off-the-shelf MCU, even PIN-encrypted, is not a vault against an equipped attacker. That is the reason for SEs on Trezor Safe.
2020
Ledger customer database leak
- Target
- Ledger customers (emails, postal addresses)
- Method
- Breach at an e-commerce contractor, then industrial phishing
- Impact
- Not a seed extraction. A hunting map: emails, booby-trapped packages, support impersonation for years.
Ledger did not “leak the seeds”. A subcontractor let customer data escape. From there, attackers wrote, called, and sometimes sent fake devices or fake letters. Victims type their seed on a fake Ledger Live, or “for verification”.
This is a successful attack on humans, not on the ST33. In volume, it remains more lethal than glitching. It explains why we repeat until hoarse: nobody, ever, asks you for your 24 words.
Lesson. The hardware wallet does not protect your buyer identity. A marketing file is worth a lifetime social-engineering campaign.
2023
Ledger Recover — controversy, not a hack
- Target
- Trust model of the Ledger SE
- Method
- New firmware capability: fragment entropy and export it
- Impact
- No documented forced drain. Trust rupture for part of the community. The service is optional and paid.
Recover uses a Shamir variant (Pedersen Verifiable Secret Sharing). Entropy is encrypted in the SE, split into three shares, entrusted to Ledger, Coincover and EscrowTech. Two shares reconstitute. Without enrollment, nothing leaves.
The scandal was not “Ledger has your seeds”. It was: if an update can add export, then the vault was not architected as an unopenable capsule. It was architected as a secure computer whose manufacturer controls the program. That is not the same promise.
The Recover dossier, in the Ledger sheet, untangles the protocol, KYC, what Recover is not, and the alternatives (your own Shamir, steel, multisig).
Lesson. “The SE cannot extract the seed” was a slogan. “The SE only extracts it if a function authorizes it” is the reality of a chip you cannot audit.
2026
Donjon: laser on TROPIC01
- Target
- TROPIC01 chip of the Trezor Safe 7
- Method
- Laser fault injection in the laboratory, early 2026, Trezor disclosure in June
- Impact
- Extraction of a subset of the chip’s secrets. User funds: not impacted, according to Trezor, thanks to the other layers.
Ledger’s Donjon lab — ecosystem irony — faulted TROPIC01 with a laser. The useful result is not only “some secrets extracted”: the fault made it possible to bypass signature verification and consider unsigned firmware on an SE designed to be programmable. This is a lab attack. Not a script kiddie.
Trezor emphasized that OPTIGA and the hardened MCU remain in the path, and that one fallen layer does not deliver the funds. Tropic Square has worked on revisions; a silicon defect is not patched by a remote update. The useful question is not “is TROPIC01 dead”: it is “an open, programmable SE has a different threat model than a frozen authenticator, and how many independent layers do you have left?”
Lesson. An “auditable” SE remains an attackable SE. Defense in depth is not a slogan if the second and third layers actually hold.
2026
Coldcard entropy bug
- Target
- Seeds generated on certain Coldcard firmwares since 2021
- Method
- Software RNG fallback (Yasmarang) instead of the hardware RNG; remote brute-force
- Impact
- Waves of thefts in July–August 2026, reported amounts on the order of 80 to more than 100 million dollars. No physical access required.
Firmware 4.0.1 (March 2021) introduced, via the libngu library, a path where seed generation fell back on a predictable software PRNG instead of hardware randomness. On some Mk3s, and depending on versions on other lines, seeds generated without enough independent dice had an effective strength well below 128 bits — sometimes around 40, enough for a brute-force.
On 30 July 2026, Coinkite publishes the advisory. Attackers, for their part, had already started emptying UTXOs. Updating the firmware does not change an already-weak seed: you must migrate funds to a new seed, generated on corrected firmware, with human entropy.
This is, to date, the costliest incident in the history of hardware wallets. It does not “kill” Coldcard any more than Heartbleed killed OpenSSL. It kills an illusion: that air-gap and dual SE exempt you from looking at how the secret is born.
Lesson. Two SEs do not fix a seed born too short. Open source is not an audit. User entropy (dice) is not optional.
2018–
Clones and marketplaces
- Target
- Ledger and others, sold outside the official channel
- Method
- Pre-initialized devices, traitor firmware, reconditioning
- Impact
- Repeated individual thefts. Support classic: “I bought it on Amazon, it already asked for a seed”.
A used hardware wallet, “new in blister” from a marketplace, or given by a stranger, is a poisoned gift until proven otherwise. The seed must be born under your eyes, on a device whose factory attestation verifies.
Lesson. The first security ritual is commercial: who sold you the object, and what does attestation say on first plug-in?