Kraken finds CoolWallet S app leaked seed, PIN and pairing password

On 3 April 2020 Kraken Security Labs published findings on the CoolWallet S, CoolBitX’s card-sized Bluetooth wallet (not in our catalog), and its Android companion app. Kraken says it disclosed full details to CoolBitX on 2 January 2020.

Kraken reports that the PIN check runs in the phone app rather than on the card, and that the Android app stored the App Lock PIN in cleartext, wrote the PIN, the pairing password and phone-generated seeds to the system log, did not block screen recording on the seed, PIN and pairing screens, and allowed the lock screen to be skipped via adb. According to Kraken, an attacker who controls the phone (through theft or malware) can obtain enough to empty the paired wallet, and an attacker with the card and the pairing password can pair it to another phone and reach the funds without the PIN. Kraken also notes that transactions are confirmed with a button press, without a PIN, and that the destination address is not shown on the card by default.

CoolWallet’s response of the same day states that the risk was limited and required access to both the phone and the card. It says it disabled the logging of sensitive data, blocked screenshots and screen recording during seed generation and PIN entry, changed how sensitive data is cleared from memory, closed the adb bypass and added a 10-second App Lock timeout. CoolWallet disagrees with Kraken on carrying the card with the paired phone and says transaction approval relies on the phone’s biometric check. Neither post names the app version containing the fixes; Kraken notes that the seed-on-phone issues were fixed and lists 1.11.592 as the current Android app version at publication.

What CoolWallet advises:

• Update to the latest official CoolBitX Crypto app and generate the seed on the card, not in the app.
• Enable App Lock and the display of full destination addresses on the card.
• Do not carry the card together with the paired phone.