Engineer hacks Trezor wallet, recovers $2M in ‘lost’ crypto

A computer engineer and hardware hacker has revealed how he managed to crack a Trezor One hardware wallet containing more than $2 million in funds.

Joe Grand — who is based in Portland also known by his hacker alias “Kingpin” — uploaded a Youtube video explaining how he pulled off the ingenious hack.

After deciding to cash out an original investment of roughly $50,000 in Theta in 2018, Dan Reich, a NYC based entrepreneur, and his friend, realized that they had lost the security PIN to the Trezor One the tokens were stored on. After unsuccessfully trying to guess the security PIN 12 times, they decided to quit before the wallet automatically wiped itself after 16 incorrect guesses.

But with their investment growing to $2 million this year, they redoubled their efforts to access the funds. Without their wallet’s seed phrase or PIN the only way to retrieve the tokens was through hacking.

They reached out to Grand who spent 12 weeks of trial and error but eventually found a way to recover the lost PIN.

The key to this hack was that during a firmware update the Trezor One wallets temporarily move the PIN and key to RAM, only to later move them back to flash once the firmware is installed. Grand found that in the version of firmware installed on Reich’s wallet this information was not moved but copied to the RAM, which means that if the hack fails and RAM is erased the information about the PIN and key would still be stored in flash.

After using a fault injection attack — a technique that alters the voltage going to the chip — Grand was able to surpass the security the microcontrollers have to prevent hackers from reading RAM, and obtained the PIN needed to access the wallet and the funds. Grand explained:

“We are basically causing misbehavior on the silicon chip inside the device in order to defeat security. And what ended up happening is that I was sitting here watching the computer screen and saw that I was able to defeat the security, the private information, the recovery seed, and the pin that I was going after popped up on the screen.”

According to a recent tweet from Trezor this vulnerability that allows it to read from the wallet’s RAM is an older one that has already been fixed for newer devices. But unless changes are made to the microcontroller fault injection attacks still can pose a risk.