Thread by @krakenfx

🚨It took Kraken Security Labs just 15 minutes to hack both of @trezor’s crypto hardware wallets.

Here’s how we did it and what it means if you’re a user:

blog.kraken.com/post/3662/krak…

@Trezor 2/ This attack relies on voltage glitching to extract an encrypted seed. This initial research required some know-how and several hundred dollars of equipment, but we estimate that we (or criminals) could mass produce a glitching device that could be sold for about $75.

3/ We then crack the encrypted seed, which is protected by a 1-9 digit PIN, but is trivial to brute force.

4/ Here is what you can do to protect your #crypto:

- Do not allow anyone physical access to your @Trezor wallet

- Enable Your BIP39 Passphrase with the @Trezor Client

5/ You can watch a full video showcasing how we extracted the seeds on our @YouTube:

6/ @Trezor has also issued a response to our responsible disclosure discussing the steps its taken to boost its #Security against such attacks.

Read the team's full response: blog.trezor.io/our-response-t…