Hacks News

Engineer hacks Trezor wallet, recovers $2M in ‘lost’ crypto

single-image

Hacker helps Trezor One owner who forgot his wallet passcode and seed phrase to recover cryptocurrency funds valued over $2 million.

A computer engineer and hardware hacker has revealed how he managed to crack a Trezor One hardware wallet containing more than $2 million in funds.

Joe Grand — who is based in Portland also known by his hacker alias “Kingpin” — uploaded a Youtube video explaining how he pulled off the ingenious hack.

After deciding to cash out an original investment of roughly $50,000 in Theta in 2018, Dan Reich, a NYC based entrepreneur, and his friend, realized that they had lost the security PIN to the Trezor One the tokens were stored on. After unsuccessfully trying to guess the security PIN 12 times, they decided to quit before the wallet automatically wiped itself after 16 incorrect guesses.

But with their investment growing to $2 million this year, they redoubled their efforts to access the funds. Without their wallet’s seed phrase or PIN the only way to retrieve the tokens was through hacking.

They reached out to Grand who spent 12 weeks of trial and error but eventually found a way to recover the lost PIN.

The key to this hack was that during a firmware update the Trezor One wallets temporarily move the PIN and key to RAM, only to later move them back to flash once the firmware is installed. Grand found that in the version of firmware installed on Reich’s wallet this information was not moved but copied to the RAM, which means that if the hack fails and RAM is erased the information about the PIN and key would still be stored in flash.

After using a fault injection attack — a technique that alters the voltage going to the chip — Grand was able to surpass the security the microcontrollers have to prevent hackers from reading RAM, and obtained the PIN needed to access the wallet and the funds.


© 2022 Crypto Caster provides information. CryptoCaster.world does not provide investment advice. Do your research before taking a market position on the purchase of cryptocurrency and other asset classes. Past performance of any asset is not indicative of future results. All rights reserved.

QR-CRYPTO-W-TEXT-updated-A1-1
QR-CRYPTO-W-TEXT-updated-A1-1

Leave a Comment

Your email address will not be published.

You may also like