{ "_README": "Data behind the hardware wallet risk checker. EVERY entry is verified against the vendor's own advisory, the researcher's disclosure, or a CVE record - the source is on each entry. A single invented or half-remembered advisory destroys the trust this tool exists to earn. If it cannot be verified, it does not go in.", "_what_makes_this_useful": "Two fields no vendor publishes for other vendors' devices, and which people consistently get wrong: `seed_compromised` (a firmware update does NOT save you - the key material itself is burned) and `patchable` (some hardware flaws will NEVER have a fix, so telling users to update is actively misleading).", "_excluded_deliberately": [ "CVE-2025-69893 and its '1.13.0-1.14.0' range for Trezor - attributed by a vulnerability database but absent from Trezor's own advisory. Unverified.", "Keystone 1.2.6 buffer overflow - referenced in a third-party repo only, no vendor or researcher advisory.", "Affected-version numbers for Ledger LSB 005 and LSB 006, and the 2019 BitBox02 side-channel - vendors did not publish them.", "The year of the Tangem log advisory, and the exact Ledger 2020 breach headcount." ], "last_reviewed": "2026-08-10", "schema_version": 2, "vendors": [ { "vendor": "Coinkite", "product_line": "Coldcard", "models": ["Mk2", "Mk3", "Mk4", "Mk5", "Q"], "advisories": [{ "id": "coldcard-prng-2021", "title": "Seed entropy silently broken by a build error (March 2021 onward)", "severity": "critical", "class": "remote", "patchable": true, "seed_compromised": true, "summary": "A build-configuration mismatch routed seed generation to a deterministic software PRNG instead of the STM32 hardware TRNG, for over four years. Resulting seeds carry roughly 72 bits of entropy on Mk4/Mk5/Q and an estimated 40 bits on Mk2/Mk3, against the 128 bits a 12-word seed should have. Wallets were drained in coordinated sweeps in late July 2026.", "affected": {"Mk2":"4.0.1 through 4.1.9","Mk3":"4.0.1 through 4.1.9","Mk4":"below 5.6.0","Mk5":"below 5.6.0","Q":"below 1.5.0Q"}, "not_affected": ["Seeds created with at least 50 fair, privately-entered dice rolls via Add Dice Rolls","Seeds protected by a strong, unique BIP-39 passphrase","Seeds imported from elsewhere rather than generated on the device","Mk1, and Mk2/Mk3 through v3.2.2 (these used the hardware RNG directly)","TAPSIGNER, OPENDIME and SATSCARD"], "critical_note": "Updating firmware does NOT change or repair an existing seed. The seed itself is the compromised artifact. Generate a NEW seed on patched firmware and move the funds.", "action": ["Update firmware (Mk2/Mk3 4.2.0+, Mk4/Mk5 5.6.0+, Q 1.5.0Q+)","Generate a completely NEW seed on the patched device","Move all funds to addresses from the new seed","Treat the old seed as permanently compromised - never reuse it"], "scale": "Galaxy Research confirmed 1,719 BTC (~$111M) stolen as of 2026-08-08, total exposure expected past $130M against a ceiling near 2,055 BTC. 250+ victims self-reported, predominantly ordinary holders rather than large ones.", "note": "Coinkite's advisory states 4.0.1; Block's engineering writeup dates the defect to v4.0.0, released 17 March 2021. Treat the range as 4.0.0/4.0.1 onward.", "sources": [{"label":"Coinkite advisory","url":"https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/"},{"label":"Block Engineering technical writeup","url":"https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware"}], "first_reported": "2026-07-30", "last_updated": "2026-08-10" }] }, { "vendor": "Ledger", "product_line": "Ledger", "models": ["Nano S", "Nano S Plus", "Nano X", "Stax", "Flex"], "advisories": [ {"id":"ledger-lsb022-monero","title":"Monero secret key recovery via Keccak state exposure (LSB 022)","severity":"high","class":"remote","patchable":true,"seed_compromised":false, "summary":"The Monero app returned the full 200-byte internal Keccak permutation state instead of a derived prekey. Keccak is publicly invertible, so an attacker could recover the Monero secret view and spend keys with no on-screen confirmation.", "affected":{"Nano S":"Monero app below 2.1.4","Nano S Plus":"Monero app below 2.1.4","Nano X":"Monero app below 2.1.4","Stax":"Monero app below 2.1.4","Flex":"Monero app below 2.1.4"}, "not_affected":["Anyone not using the Monero app","Device firmware itself is unaffected","Requires device unlocked, Monero app open, AND a compromised host simultaneously"], "critical_note":"Affects the Monero app only, not your Bitcoin keys. Ledger did not issue a rotation instruction - but any wallet actually exploited has exposed keys and the funds should be moved.", "action":["Update the Monero app to 2.1.4 or later"], "sources":[{"label":"Ledger LSB 022","url":"https://donjon.ledger.com/lsb/022/"}],"first_reported":"2026-06-04"}, {"id":"ledger-lsb021-mcu","title":"Missing parameter validation during MCU firmware update (LSB 021)","severity":"medium","class":"physical","patchable":true,"seed_compromised":false, "summary":"The bootloader did not validate the reset_handler address during flashing, allowing an arbitrary address to be set - resulting in bricking or code execution at boot.", "affected":{"Nano X":"below 2.4.2","Stax":"below 1.6.2","Flex":"below 1.2.2"}, "not_affected":["Nano S and Nano S Plus are not listed as affected"], "critical_note":"Ledger states client funds were never at risk. Firmware update is sufficient - no seed regeneration needed.", "action":["Update firmware (Nano X 2.4.2+, Stax 1.6.2+, Flex 1.2.2+)"], "sources":[{"label":"Ledger LSB 021","url":"https://donjon.ledger.com/lsb/021/"}],"first_reported":"2025-01-10"}, {"id":"ledger-lsb013-jtag","title":"JTAG/SWD debug interfaces left enabled (LSB 013)","severity":"medium","class":"physical","patchable":true,"seed_compromised":false, "summary":"Debug interfaces were left enabled on the Nano X's non-secure MCU on factory devices, enabling HID emulation and screen-based social engineering with physical access.", "affected":{"Nano X":"below 1.2.4-2"}, "not_affected":["The Secure Element is not affected, nor code running on it, nor user secrets"], "action":["Update firmware to 1.2.4-2 or later"], "sources":[{"label":"Ledger LSB 013","url":"https://donjon.ledger.com/lsb/013/"}],"first_reported":"2020-07-09"}, {"id":"ledger-lsb002-supplychain","title":"Supply chain attack - pre-seeded devices (LSB 002)","severity":"critical","class":"physical","patchable":true,"seed_compromised":"conditional", "summary":"MCU signature verification could be bypassed via code caving, letting a modified device still appear genuine. Enables selling pre-seeded devices with an attacker-known seed.", "affected":{"Nano S":"below 1.4"}, "not_affected":["Devices bought directly from Ledger or an authorised reseller","A successful update to 1.4+ confirms the device was never compromised"], "critical_note":"This attack cannot extract keys from your device. BUT if you were sold a pre-seeded device and used the supplied seed, that seed belongs to the attacker and a firmware update does not undo it - move funds to a freshly generated wallet.", "action":["Update to firmware 1.4 or later","If the device arrived already seeded, or came from a non-official channel, generate a new seed and move funds"], "sources":[{"label":"Ledger LSB 002","url":"https://donjon.ledger.com/lsb/002/"}],"first_reported":"2018-03-20"} ] }, { "vendor": "Trezor", "product_line": "Trezor", "models": ["One", "Model T", "Safe 3", "Safe 5"], "advisories": [ {"id":"trezor-safe3-trz32f429","title":"Safe 3 microcontroller vulnerable to voltage glitching - supply chain risk","severity":"high","class":"physical","patchable":false,"seed_compromised":false, "summary":"The Safe 3's custom-packaged STM32F429 (branded TRZ32F429) is susceptible to voltage glitching giving flash read/write. Ledger Donjon extracted the pre-shared attestation secret and reprogrammed a device so a tampered unit still presents as genuine.", "affected":{"Safe 3":"all versions - this is a hardware property, not a firmware bug"}, "not_affected":["Safe 5 - Trezor states it uses a newer, more resilient microcontroller and is not affected","Devices bought directly from Trezor or an authorised reseller","Users with a BIP-39 passphrase held off-device"], "critical_note":"NO FIRMWARE FIX EXISTS OR WILL EXIST. Asked directly whether it could be patched, Trezor answered 'Unfortunately not.' Donjon did NOT extract private keys or PINs - the realistic risk is a pre-tampered device from a non-official channel, not your existing device being attacked remotely.", "action":["Only buy from Trezor directly or authorised resellers","Enable a BIP-39 passphrase stored off-device","If the device came from an unknown source, treat it as untrusted"], "sources":[{"label":"Trezor advisory","url":"https://trezor.io/vulnerability/donjon-s-trezor-safe-3-evaluation"}],"first_reported":"2025-03-12"}, {"id":"trezor-readprotection-downgrade","title":"Read-protection downgrade via voltage glitching (Kraken Security Labs)","severity":"high","class":"physical","patchable":false,"seed_compromised":false, "summary":"Fault injection re-enables the MCU's integrated bootloader, allowing the encrypted seed to be read out without the PIN in roughly 15 minutes of physical access. The encryption is then brute-forced offline.", "affected":{"One":"all versions - MCU-level flaw","Model T":"all versions - MCU-level flaw"}, "not_affected":["Users with a BIP-39 passphrase enabled (stored off-device, defeats the attack)","Devices that have never left your possession"], "critical_note":"NOT FIXABLE BY FIRMWARE - it requires hardware redesign. Do not expect an update to resolve this. The mitigation is a passphrase plus physical custody.", "action":["Enable a BIP-39 passphrase","Maintain physical custody","If the device was ever out of your control, move funds to a new seed"], "sources":[{"label":"Kraken Security Labs","url":"https://blog.kraken.com/product/security/kraken-identifies-critical-flaw-in-trezor-hardware-wallets"},{"label":"Trezor response","url":"https://blog.trezor.io/our-response-to-the-read-protection-downgrade-attack-28d23f8949c6"}],"first_reported":"2020-01-31"}, {"id":"trezor-bip143-doublesign","title":"BIP-143 double-signing / excessive fee (CVE-2020-14199)","severity":"medium","class":"remote","patchable":true,"seed_compromised":false, "summary":"A malicious host wallet fakes an error after the first SegWit signature and asks the user to sign again; combining both signatures lets a colluding miner claim an enormous fee. This was an industry-wide flaw, not Trezor-specific.", "affected":{"One":"below 1.9.1","Model T":"below 2.3.1"}, "not_affected":["Users of trusted host software"], "action":["Update firmware (One 1.9.1+, Model T 2.3.1+)"], "sources":[{"label":"CVE-2020-14199","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14199"}],"first_reported":"2020-06-01"}, {"id":"trezor-bip39-sidechannel","title":"Side-channel in BIP-39 mnemonic processing when unlocked","severity":"medium","class":"physical","patchable":true,"seed_compromised":false, "summary":"A non-constant-time integrity re-check after unlock could leak the mnemonic to power or EM analysis. Requires physical possession of an UNLOCKED device, so exploitation is not silent.", "affected":{"One":"see vendor advisory - Trezor did not publish version numbers","Model T":"see vendor advisory - version numbers not published","Safe 3":"see vendor advisory - version numbers not published","Safe 5":"see vendor advisory - version numbers not published"}, "not_affected":["Devices kept locked and in your possession"], "critical_note":"Trezor's advisory references the fixing commit but does NOT publish affected or patched version numbers, so this tool cannot tell you definitively. Update to current firmware and check the advisory.", "action":["Update to the latest firmware","Never leave the device unlocked and unattended"], "sources":[{"label":"Trezor advisory","url":"https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked"}],"first_reported":"2025-09-24"} ] }, { "vendor": "Blockstream", "product_line": "Blockstream Jade", "models": ["Jade", "Jade 1.1", "Jade Plus"], "advisories": [ {"id":"jade-register-descriptor","title":"Stack overflow in register_descriptor RPC","severity":"high","class":"remote","patchable":true,"seed_compromised":false, "summary":"The register_descriptor function missed a size check on a caller-supplied parameter, letting an attacker overwrite the stack. Consequences ranged from a crash to limited code execution able to read internal storage and potentially extract secret keys before the next reboot.", "affected":{"Jade":"1.0.24 through 1.0.36","Jade 1.1":"1.0.24 through 1.0.36","Jade Plus":"1.0.24 through 1.0.36"}, "not_affected":["Firmware 1.0.23 or earlier - the function did not exist yet","QR-mode-only users - the RPC path is not reachable","Users pairing only with the official Blockstream app on a clean host"], "critical_note":"Install 1.0.38, not merely 1.0.37 - 1.0.38 adds anti-rollback preventing downgrade to a vulnerable build. Blockstream reports no evidence of exploitation and no confirmed loss of funds.", "action":["Update to firmware 1.0.38 or later"], "sources":[{"label":"Blockstream disclosure","url":"https://blog.blockstream.com/jade-security-disclosure/"}],"first_reported":"2025-12-05"}, {"id":"jade-esp32-key-extraction","title":"ESP32-V3 firmware encryption key extraction (evil maid)","severity":"medium","class":"physical","patchable":false,"seed_compromised":false, "summary":"The ESP32-V3 used in Jade is vulnerable to side-channel extraction of the AES-256 firmware encryption key (~500,000 power traces, ~2 hours) after desoldering the chip. That decrypts stored firmware including PIN-server keys, enabling an evil-maid device with substituted addresses.", "affected":{"Jade":"hardware revisions using ESP32-V3 - Blockstream did not enumerate them","Jade 1.1":"see above","Jade Plus":"see above"}, "not_affected":["Devices that have never left your possession"], "critical_note":"SILICON-LEVEL - no firmware fix exists for affected hardware. Espressif states future products carry countermeasures. Requires physical possession and chip desoldering.", "action":["Maintain physical custody","Verify receive addresses on a second device where practical"], "sources":[{"label":"Ledger Donjon","url":"https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet"}],"first_reported":"2023-02-15"} ] }, { "vendor": "Tangem", "product_line": "Tangem", "models": ["Tangem Wallet card"], "advisories": [ {"id":"tangem-app-log-privatekey","title":"Private keys written to mobile app logs","severity":"critical","class":"remote","patchable":true,"seed_compromised":true, "summary":"When a wallet was activated using a seed phrase, the private key was written to the mobile app's logs. Those logs were attached to in-app support requests, so they reached Tangem support inboxes.", "affected":{"Tangem Wallet card":"iOS app 5.19.1 and earlier; Android app 5.19.2 and earlier"}, "not_affected":["Wallets activated WITHOUT a seed phrase (the default card-generated key)","Users who never contacted in-app support within 7 days of activation"], "critical_note":"BOTH conditions are required to be affected: activated with a seed phrase AND contacted in-app support within 7 days. Updating the app is NOT sufficient - Tangem's own remediation is to move funds out, factory reset, reactivate, and move funds back. Tangem states fewer than 0.1% of users could be affected, no keys were compromised and all logs were erased.", "action":["Update the app","Transfer funds out","Factory reset the wallet","Reactivate without a seed phrase, or with a NEW seed phrase","Transfer funds back"], "sources":[{"label":"Tangem advisory","url":"https://tangem.com/en/blog/post/tangem-resolves-log-issue/"}],"first_reported":"unverified - Tangem's page does not state a year"}, {"id":"tangem-laser-fault-injection","title":"Laser fault injection resets the access code - full fund theft","severity":"high","class":"physical","patchable":false,"seed_compromised":"conditional", "summary":"A laser fault injection attack resets the card's access code without knowing it, giving full control of the wallet - sign arbitrary transactions, drain all funds.", "affected":{"Tangem Wallet card":"ALL cards in circulation - cards have no firmware update mechanism at all"}, "not_affected":["No configuration exempts you - explicitly including users who disabled password recovery. The barrier is cost and skill: roughly $250,000 of lab equipment, expert knowledge, physical possession, and ~2 hours per card."], "critical_note":"CANNOT BE PATCHED. Tangem cards have no update path. The only mitigation is physical custody. If a card has genuinely been out of your control, treat the keys as at risk and move the funds.", "action":["Maintain strict physical custody of the card","If a card was ever out of your control, move funds to a new wallet"], "sources":[{"label":"Ledger Donjon","url":"https://donjon.ledger.com/blog/bypassing-tangem-card-security-with-laser-attack/"},{"label":"Tangem response","url":"https://tangem.com/en/blog/post/lfi-response/"}],"first_reported":"2026-07-09"} ] }, { "vendor": "BitBox", "product_line": "BitBox", "models": ["BitBox02"], "advisories": [ {"id":"bitbox-segwit-doublesign","title":"SegWit double-signing / excessive fee","severity":"medium","class":"remote","patchable":true,"seed_compromised":false, "summary":"Same class as CVE-2020-14199 - a malicious software wallet fakes an error after the first SegWit signature and requests a second, letting a colluding miner harvest an inflated fee.", "affected":{"BitBox02":"below 8.0.0"}, "not_affected":["BitBox01 is not affected","Users of trusted host software"], "critical_note":"Seed was never at risk. No reports of lost funds and no evidence of exploitation.", "action":["Update to firmware 8.0.0 or later"], "sources":[{"label":"Shift Crypto disclosure","url":"https://medium.com/shiftcrypto/bitbox-app-firmware-update-6-2020-c70f733a5330"}],"first_reported":"2020-06-03"} ] }, { "vendor": "Keystone", "product_line": "Keystone", "models": ["Keystone 3 Pro"], "advisories": [ {"id":"keystone-offside-128","title":"Unspecified firmware vulnerability fixed in 1.2.8","severity":"unknown","class":"unknown","patchable":true,"seed_compromised":"unknown", "summary":"Keystone announced that a firmware vulnerability found by Offside Labs was fixed in 1.2.8. No technical description, affected version range, severity or CVE was published, and no researcher writeup could be located.", "affected":{"Keystone 3 Pro":"below 1.2.8"}, "not_affected":[], "critical_note":"There is NOT enough public information to tell you whether you were affected or whether key material was at risk. Keystone published no detail. Update to 1.2.8+ and treat the risk as unassessable rather than as a clean record.", "action":["Update to firmware 1.2.8 or later"], "sources":[{"label":"Keystone blog","url":"https://blog.keyst.one/keystone-x-offside-labs-redefining-the-hardware-wallet-security-92fcb73dbf6c"}],"first_reported":"2024 - Keystone's own dates are inconsistent between their blog and their X announcement"} ] }, { "vendor": "Foundation Devices", "product_line": "Passport", "models": ["Passport", "Passport Core", "Passport Prime"], "advisories": [], "no_advisory_note": "No publicly documented advisory affecting user funds or key security was found for any Passport model. Foundation operates a responsible-disclosure process and publishes third-party audits, but maintains no public advisory index. IMPORTANT: 'none verified' is not the same as 'no vulnerabilities exist' - it means nothing is published to check against." } ] }