Trezor passphrase entered on a computer could be swapped to hold funds for ransom

On 2 September 2020 Marko Bencun of Shift Crypto, the company behind the BitBox hardware wallet, disclosed that the Trezor One before firmware 1.9.3 and the Trezor Model T before 2.3.3 were open to a remote ransom attack when the optional passphrase was typed on the computer or phone rather than on the device. The same issue affected KeepKey, whose firmware derives from Trezor’s.

According to the researcher, the devices did not show a passphrase entered on the host for confirmation before using it. Malware or a man-in-the-middle on the USB connection could therefore substitute a passphrase known only to the attacker: the wallet would load normally and receive addresses would match on screen, but coins received there could only be spent with the attacker’s passphrase, which could then be withheld for ransom. CoinDesk notes that the attacker cannot spend the coins either, since they still derive from the user’s seed. The researcher points out that only users who enabled the passphrase feature were exposed, and that all coins on the device could be affected at once.

Shift Crypto reported the issue to SatoshiLabs on 15 April 2020 and to ShapeShift (KeepKey) on 7 May 2020. Trezor released Trezor One 1.9.3 and Model T 2.3.3 on 2 September 2020; the firmware changelogs list the security change as showing a non-empty passphrase on the device when it was entered on the host. SatoshiLabs paid a bounty, according to the researcher, and a Trezor representative told CoinDesk the attack was only theoretical. The researcher later added that ShapeShift fixed the KeepKey in November 2021.