Trezor Addresses Security Flaw in Latest Models

According to Cointelegraph, hardware wallet provider Trezor has resolved a security vulnerability in its Safe 3 and 5 models after competitor Ledger's open-source research team identified a flaw in their microcontrollers. Ledger Donjon, the research arm, acknowledged Trezor's recent security improvements but noted that cryptographic operations could still be executed on the microcontroller, potentially exposing the devices to advanced attacks. Trezor has since addressed these vulnerabilities, as confirmed by Ledger's chief technology officer, Charles Guillemet, in a March 12 post on X. Guillemet emphasized the importance of enhancing security across the ecosystem to support the broader adoption of cryptocurrencies and digital assets. Trezor had previously integrated "Secure Elements"—chips designed to safeguard users' PIN codes and cryptographic secrets—into its devices to prevent tampering and potential theft of user funds. This feature effectively counters inexpensive hardware attacks, such as voltage glitching, providing users with confidence in the safety of their funds even if their device is lost or stolen. Despite these measures, Ledger identified another potential vulnerability related to the microcontroller, a key component of Trezor's two-chip design for the Safe 3 and 5 models. Although Trezor implemented a firmware integrity check to detect software modifications, Ledger demonstrated that an attacker could bypass this security measure. Trezor has since resolved this issue, though details on the resolution have not been disclosed by either company. Cointelegraph reached out to Trezor for further information but did not receive an immediate response. Trezor confirmed on X that user funds remain secure and no action is required from users. However, when questioned about the possibility of patching the issue via firmware, Trezor stated that it was not feasible. The company emphasized the importance of a multi-layer defense strategy against supply chain attacks and advised users to purchase devices from official sources to ensure security. Ledger, too, has faced security challenges. In December 2023, a hacker breached Ledger's connector library, resulting in the theft of $484,000 worth of crypto assets. Additionally, in June 2020, another breach led to the publication of mailing addresses for approximately 270,000 Ledger customers. These incidents highlight the ongoing security challenges within the cryptocurrency hardware wallet industry.