Crypto hardware wallets using ESP32 chip at risk of private key theft: report

Researchers have warned of a new vulnerability affecting certain crypto hardware wallets that allows attackers to privately sign unauthorized Bitcoin transactions and steal private keys.

Cryptocurrency wallets using the Chinese-made ESP32 chip, a widely used microcontroller designed for embedded systems and connected devices, are at risk, according to cybersecurity firm Crypto Deep Tech, which flagged a major vulnerability in a recent report. 

Often deployed in security-critical environments and used in hardware wallets like Blockstream Jade and open-source projects such as Bowser and Colibri, these chips often act as gateways to sensitive networks or store cryptographic credentials, making the vulnerability especially severe.

According to researchers, attackers can exploit the chip’s Bluetooth and Wi-Fi connectivity to inject malicious module updates, gain low-level access, and extract sensitive wallet data such as private keys.

The chip suffers from multiple vulnerabilities, including a weak random number generator that makes Bitcoin private keys dangerously predictable, and broken validation checks that allow invalid or low-value keys to be used.

Electrum-based wallets are especially vulnerable, as the chip’s flawed hashing logic allows attackers to exploit non-BIP-137 message formatting and generate forged ECDSA signatures that validate as real Bitcoin transactions. 

What makes this vulnerability especially concerning for crypto users is its stealthy execution. In a real-world test case, Crypto Deep Tech researchers were able to exploit the vulnerability to bypass normal security checks, recover a private key, and gain access to a live Bitcoin wallet holding 10 BTC without alerting the user at any point.

The risks aren’t limited to just cryptocurrency wallets. The vulnerability opens the door for large-scale supply chain attacks, state-level espionage, and coordinated theft campaigns targeting any network where ESP32-powered devices are in use.

To mitigate the threat, researchers advised using trusted devices, keeping Bitcoin software up to date, and relying on secure cryptographic libraries to avoid risks like key theft and transaction forgery.

Although considered a secure alternative to software wallets, which are often exploited, hardware wallet vulnerabilities remain a serious issue for cryptocurrency enthusiasts. 

Last month, Ledger Donjon researchers found that wallet maker Trezor’s latest Safe models still rely on a general-purpose microcontroller that is vulnerable to physical attacks. 

Despite having a certified secure element for PIN and secret storage, the STM32-based chip used in Trezor devices could reportedly be exploited through voltage glitching, an attack that can be carried out purely in software and is nearly impossible to detect.