Kraken bypasses SafePal S1 tamper detection and downgrades its firmware
Who is affected
Someone with physical access could open an S1 without triggering its tamper response and roll back its firmware, but Kraken did not reach keys or funds. SafePal states the findings are not exploitable and patched the downgrade in firmware 1.0.24.
What happened
On 16 February 2021 Kraken Security Labs published an audit of the SafePal S1 (hardware revision S1P_Ver03). Kraken says it disclosed full details to SafePal on 18 November 2020, and states that it was not able to steal cryptocurrency from the wallet, but found weaknesses that could make a future compromise possible.
According to Kraken, opening the case did not trigger the advertised tamper response; removing the RF shield stopped the device from booting, but grounding one clip silenced the alarm without wiping data, and the old PIN stayed valid. Kraken also restored older firmware 1.0.17 over 1.0.18 with a flash programmer without the device detecting the downgrade, found that configuration and database files could be modified, and could not confirm whether the S1 has a validated secure-boot chain. It said code execution was likely possible by replacing the flash chip but did not complete that work. Kraken further reported that SafePal declined to release the source of the GPL-licensed U-Boot and Linux components it uses.
SafePal’s response, published the same day, states that the seed could not be extracted, that the tamper bypass is not exploitable and does not touch its core security logic, and that its secure boot chain and encrypted channel between processor and secure element caused Kraken’s firmware and database modifications to fail. SafePal says firmware 1.0.24 patches the downgrade issue and removes the configuration file. On open source, SafePal says the S1 is not open-sourced yet and it may open part of its code in future.
Cryptocurrency is a digital or virtual currency secured by cryptography, operating on decentralized blockchain networks to enable secure, peer-to-peer transactions.
PIN Protection is a security feature that requires a personal identification number (PIN) to access a cryptocurrency wallet or device, preventing unauthorized access.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionSecure Boot is a security feature that ensures only trusted software runs on a device by verifying its integrity during startup, preventing unauthorized code execution in crypto systems.
Read full definitionA secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Hardware attack) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideEvil Maid Attack: Protecting Unattended Hardware Wallets
Someone accesses your wallet while you are away. Hotel rooms, offices, shared spaces — how to detect and prevent physical tampering.
Read GuideProtecting Your Hardware Wallet from Physical Theft
What happens if someone steals your hardware wallet? How to set up layers of protection so theft alone cannot compromise your crypto.
Read GuideFault Injection
Fault injection disturbs a chip's voltage, clock or electromagnetic environment so that it skips a security check or leaks data.
Side-Channel Attack
A side-channel attack in cryptocurrency and blockchain targets indirect information, like power usage or timing, to extract sensitive data from a system or device.
Secure Element
A secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Evil Maid Attack
An evil maid attack is a physical security threat where an attacker gains temporary unsupervised access to a hardware wallet to tamper with it, install malicious firmware, or extract private keys.
Cite this entry
WalletInsights. “Kraken bypasses SafePal S1 tamper detection and downgrades its firmware”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/kraken-safepal-s1-tamper-detection-bypass-2021/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.