Ledger Donjon extracts Coldcard Mk3 secrets with multiple laser fault injections

On 3 June 2021, at the SSTIC conference in Rennes, Olivier Hériveaux of Ledger Donjon presented an attack on the Microchip ATECC608A secure memory, the chip that replaced the ATECC508A in the Coldcard Mk3 after Donjon’s earlier attack on the Mk2 (see ledger-donjon-coldcard-mk2-laser-pin-recovery-2020).

According to the paper, a double laser fault injection bypasses two security checks within a single command and reads out a protected data slot: on the Coldcard this is the PIN hash slot, which unlocks access to the seed slot. Because the Mk3 also encrypts the seed with a key held in its STM32L496 microcontroller, attacking the secure element alone is not enough; Donjon states it attacked that microcontroller as well, with a high success probability. The paper calls the attack easy to reproduce once the fault model is known.

At Hardwear.io 2023 Donjon reported applying the chain to three preconfigured wallets that Coinkite had shipped to it as a challenge and recovering the seed of one of the three; it describes chip preparation on the real device as the risky step. Donjon states the vulnerabilities were disclosed to Coinkite and Microchip with a very long period before publication.

Coinkite’s disclosure history describes the work as a specialist laboratory demonstration and states that there is no Mk3 retrofit; the later Mk4 splits the secret across three chips.