Kraken discloses physical seed-extraction attack against Trezor hardware wallets

On January 31, 2020, Kraken discloses physical seed-extraction attack against Trezor hardware wallets. Kraken Security Labs discovers and discloses a physical attack vector that can extract seed phrases from Trezor hardware wallets.

The attack exploited the wallet's microcontroller architecture, using voltage glitching to bypass security features and access encrypted storage. Kraken's responsible disclosure gave Trezor time to respond before going public, following industry best practices for vulnerability reporting. Trezor acknowledged the issue but noted that completely fixing it would require hardware redesigns, as the vulnerability was inherent to the microcontroller used in existing devices.

The company emphasized that the attack required physical access to the device and sophisticated technical knowledge, making it impractical for most threat scenarios. Trezor recommended users protect their hardware wallets with strong passphrases, which would remain secure even if the seed phrase was extracted. The disclosure sparked important discussions about security trade-offs in hardware wallet design.

Some manufacturers, like Ledger, used secure element chips that were more resistant to physical attacks but introduced different trust assumptions. Others, like Trezor, used fully open-source designs that allowed independent security audits but potentially exposed vulnerabilities. The incident reminded Bitcoin holders that security is never absolute and requires a layered approach combining hardware wallets, strong passphrases, secure storage, and operational security practices.