Blockstream Jade firmware bug let a malicious host corrupt device memory
Who is affected
A Jade on firmware 1.0.24–1.0.36, unlocked and connected to a compromised computer or phone or to a malicious web page, could be crashed or made to run limited code. Blockstream states users of its own app on a clean device were not at immediate risk and no users are known to be affected.
What happened
On 5 December 2025 Blockstream announced that Jade firmware 1.0.38 enables anti-rollback because of a potential vulnerability in older firmware when paired with malicious third-party apps or platforms, found and responsibly disclosed by the research group DARKNAVY. Its full disclosure followed on 16 December 2025.
According to Blockstream, the flaw is a missing size check when processing the CBOR message passed to the register_descriptor RPC, added in firmware 1.0.24. A crafted request can overwrite the device’s stack, causing a crash or, with a sophisticated attack, limited code execution; Blockstream says a future exploit could in the worst case extract the secret key, but the device cannot be permanently altered. Exploitation requires the Jade to be initialised and unlocked over the same USB or Bluetooth interface, and must be launched by malware on the host or by a web page granted WebUSB access. QR mode is not affected.
Blockstream says DARKNAVY made contact in early August 2025 and sent a full report in early October, that it confirmed the issue within 24 hours, shipped the fix in 1.0.37 on 13 November and added anti-rollback in 1.0.38 about a week later. It names Original Jade, Jade 1.1 and Jade Plus firmware. The two Blockstream posts differ on 1.0.36: the 5 December post says analysis shows it is not vulnerable, while the 16 December disclosure lists 1.0.24 to 1.0.36 as affected; CryptoSlate reports code execution was possible on 1.0.24 to 1.0.35 and could not be ruled out on 1.0.36.
What Blockstream advises:
- Upgrade to firmware 1.0.38 or later from official sources and keep the companion app and operating system updated.
- If the host may be compromised, back up the recovery phrase and factory reset the Jade before connecting it, or upgrade from a known-clean device.
Jade is a hardware wallet from Blockstream, designed to securely store Bitcoin private keys offline, ensuring safe transactions and protection from online threats.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionA private key is the secret number that proves ownership of a crypto address and signs its transactions. Whoever has it controls the funds.
Bluetooth Connectivity enables wireless communication between devices, like hardware wallets and smartphones, using Bluetooth or Bluetooth Low Energy (BLE) for secure data transfer.
Read full definitionMalware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Read full definitionWebUSB is a browser API that lets web apps communicate directly with USB-connected hardware wallets for secure crypto transactions without plugins or native apps.
Read full definitionA companion app is a software application used to manage and interact with cryptocurrency wallets or blockchain networks, typically offering features like transactions and security controls.
Read full definitionA mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Firmware vulnerability) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideIs a Hardware Wallet Really Safe?
Hardware wallets are the safest option for most people — but you can still make mistakes. Here's what to know.
Read GuideFirmware
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Bootloader
A bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.
Firmware Update
Firmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.
Cite this entry
WalletInsights. “Blockstream Jade firmware bug let a malicious host corrupt device memory”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/blockstream-jade-register-descriptor-memory-corruption-2025/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.