Vulnerability in ESP32 Chip-Based Crypto Wallets Poses Key Theft Risks

Researchers have identified vulnerabilities in ESP32 chip-based cryptocurrency wallets, potentially allowing attackers to sign unauthorised Bitcoin transactions and steal private keys. The flaws include a weak random number generator and broken validation checks. Exploitable via Bluetooth and Wi-Fi, these vulnerabilities open pathways for widespread attacks, leading to potential theft and fraud. Users are urged to secure their devices and software to mitigate these risks.

Recent research highlights a significant vulnerability in certain cryptocurrency hardware wallets utilising the ESP32 chip, which could allow attackers to sign unauthorised Bitcoin transactions and steal private keys. This microcontroller, prevalent in embedded systems, is employed in various secure wallets such as Blockstream Jade and open-source projects including Bowser and Colibri, making the risk particularly critical as it handles sensitive cryptographic data.

Attackers could leverage the chip’s Bluetooth and Wi-Fi features to introduce malicious updates, thus gaining low-level access to extract sensitive wallet information. Key vulnerabilities include a weak random number generator, leading to predictable Bitcoin private keys, and insufficient validation checks that permit invalid keys to be processed.

Electrum-based wallets are notably at risk due to defective hashing logic within the ESP32 chip, enabling exploiters to manipulate non-BIP-137 message formatting and craft fraudulent ECDSA signatures, presenting them as legitimate Bitcoin transactions.

One alarming aspect of this vulnerability is the subtlety of its execution. In practical tests, researchers successfully exploited the flaw to evade standard security protocols, recover a private key, and access a Bitcoin wallet with 10 BTC without the user being notified.

The implications extend beyond cryptocurrency wallets; this vulnerability potentially facilitates extensive supply chain attacks, state-sponsored espionage, and organised theft efforts against any network utilising ESP32-powered devices.

To counteract these risks, experts recommend using reliable devices, ensuring Bitcoin software is current, and implementing secure cryptographic libraries to prevent key theft and transaction counterfeiting. While hardware wallets are deemed safer compared to software wallets, they are not exempt from serious vulnerabilities, emphasizing the need for constant vigilance by cryptocurrency users.

Last month, Ledger Donjon researchers identified that the Trezor Safe models still depend on a general-purpose microcontroller vulnerable to physical assault. Although a secure element is used for storing PINs and secrets, the STM32-based chip may be susceptible to voltage glitching attacks conducted solely via software, rendering detection nearly impossible.