Unciphered claims seed extraction from a Trezor Model T in its possession

On 24 May 2023 the crypto-recovery firm Unciphered published a YouTube video in which it said it had extracted the recovery phrase and PIN from a Trezor Model T in its possession. CoinDesk reports that it bought a new Model T, set it up with its own seed phrase and mailed it to Unciphered’s lab, so that the demonstration could not rely on a device prepared in advance.

Unciphered did not publish how its exploit chain works, citing current engagements and non-disclosure agreements. According to CoinDesk, it attributes the attack to an unpatchable hardware vulnerability in the device’s STM32 chip that lets it dump the embedded flash and OTP data. BeInCrypto reports that the team removed the circuit board, connected it to lab equipment and extracted the firmware; according to The Block, it used an in-house exploit and then about 10 GPUs to recover the keys. Co-founder Eric Michaud said the flaw cannot be fixed by a firmware update and would require a product recall.

Trezor said it did not have enough detail to respond fully, but that the attack appeared to be a Read Protection (RDP) downgrade, a risk it had publicly flagged in early 2020 after Kraken Security Labs’ research (see kraken-trezor-voltage-glitch-seed-extraction-2020). Unciphered would neither confirm nor deny that it was an RDP downgrade. Trezor CTO Tomáš Sušánka told The Block that such attacks require physical theft of the device and advanced equipment, and that a strong passphrase makes them useless; Trezor also pointed to the secure element being developed by its sister company Tropic Square.

CoinDesk reports that Unciphered did not contact Trezor, through its responsible disclosure programme or otherwise, before going public, and that Trezor was unaware of any outreach. None of the sources state whether a passphrase was set or bypassed in the demonstration.