{"id":79290,"date":"2023-05-25T10:39:53","date_gmt":"2023-05-25T07:39:53","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=79290"},"modified":"2025-09-11T10:12:55","modified_gmt":"2025-09-11T07:12:55","slug":"video-on-youtube-demonstrates-seed-phrase-hack-of-trezor-t-wallet","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/video-on-youtube-demonstrates-seed-phrase-hack-of-trezor-t-wallet\/","title":{"rendered":"Video on YouTube Demonstrates Seed-phrase Hack of Trezor T Wallet"},"content":{"rendered":"<p>The cybersecurity startup Unciphered published on YouTube a video demonstrating a successful breach of the popular hardware crypto wallet Trezor T from Satoshi Labs.<\/p>\n<p><iframe loading=\"lazy\" width=\"560\" height=\"315\" src=\"https:\/\/www.youtube.com\/embed\/50eiA-75NMY\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" allowfullscreen><\/iframe><\/p>\n<p>The company&#8217;s experts developed an \u201cinternal exploit\u201d that allowed them to extract the wallet&#8217;s firmware, and using specialized GPUs cracked the seed phrase of the device.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;We have about ten GPUs, and after a while we retrieved the keys,&#8221; said Unciphered co-founder Eric Misho in the video.<\/p>\n<\/blockquote>\n<p>The company noted that the hardware security mechanisms of the Trezor T model can theoretically be bypassed if a hacker has physical access to the wallet. In Misho&#8217;s view, to fix this exploit in the Trezor T would require recalling all released devices.<\/p>\n<p>Earlier, Unciphered demonstrated a similar hack of a wallet produced by the Hong Kong company OneKey.<\/p>\n<p>Trezor said that the vulnerability found by the experts appears to be a Read Protection Downgrade (RDP) attack. It enables, by impacting the STM32 microchip, to obtain the seed phrase for recovery, and then decrypt its PIN using a brute-force password attack.<\/p>\n<p>This vulnerability was discovered in October 2019 by Kraken Security Labs researchers. It affected the Trezor T and Trezor One models.<\/p>\n<p>Chief Technology Officer Tom\u00e1\u0161 Sushanka noted that such attacks require physical theft of the device, extremely deep technical knowledge, and sophisticated equipment.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;Even with the above, Trezor can be protected by a robust passphrase, which adds another layer of security, making downgrading to an earlier version of RDP useless,&#8221; he added.<\/p>\n<\/blockquote>\n<p>To address this problem, Trezor, in collaboration with its subsidiary Tropic Square, developed a secure microchip for hardware wallets. The component is currently undergoing testing.<\/p>\n<p>Earlier ForkLog reported that attackers stole $30,000 in bitcoins through <a href=\"https:\/\/forklog.com\/en\/news\/hackers-stole-about-30000-in-bitcoin-via-counterfeit-hardware-wallet\">a counterfeit hardware wallet<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The cybersecurity startup Unciphered published on YouTube a video demonstrating a successful breach of the popular hardware crypto wallet Trezor T from Satoshi Labs.<\/p>\n","protected":false},"author":1,"featured_media":79291,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1301,961,115],"class_list":["post-79290","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-blockchain-vulnerabilities","tag-hardware-wallets","tag-trezor"],"aioseo_notices":[],"amp_enabled":true,"views":"59","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/79290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=79290"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/79290\/revisions"}],"predecessor-version":[{"id":79292,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/79290\/revisions\/79292"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/79291"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=79290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=79290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=79290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}