Donjon

We mounted a 2-steps side-channel attack on the PIN verification function storage_isPinCorrect_impl of the KeepKey hardware wallet. If an attacker has a physical access to the device, the attack exposes the user PIN

Coldcard is a Bitcoin hardware wallet from Coinkite manufacturer. The platform runs on a standard STM32 microcontroller paired with a secure memory which provides secure storage of the seed behind authentication protection. Relying

In this article we will showcase one use of our tool named Rainbow: breaking a ‘whiteboxed’ AES encryption using Differential Computation Analysis.

The Ledger Donjon spends significant time and effort to assess the security of every piece of Ledger technology — along with our industry’s. During a recent security audit we uncovered vulnerabilities in a

On May 7, security researcher Christian Reitter contacted us through our Bounty program to inform us of a side-channel vulnerability which could potentially allow an attacker to spy on users of hardware wallets,

HTC EXODUS 1 phones come with an integrated hardware wallet. This wallet allows to backup its [master seed](https://bitcoin.org/en/glossary/hd-wallet-seed) by splitting it and sending it to "trusted contacts". Three trusted contacts are normally required

An attacker with a stolen device can extract the seed from the device. It takes less than 5 minutes and the necessary materials cost around 100$. This vulnerability affects Trezor One, Trezor T,

The Donjon, Ledger’s security research team, recently spent some time and resources to analyse the security of hardware wallets. Our goal is to raise the bar for security in the ecosystem.

A Side Channel Attack on PIN verification allows an attacker with a stolen Trezor One to retrieve the correct value of the PIN within a few minutes.

During Breaking Bitcoin conference last weekend, I presented the research we conducted in the past months at the Donjon. We spent significant time and efforts in order to raise the bar of security

🌈Rainbow is a Python module designed for two purposes. The first one is to help embedded developers test their implementations against basic side-channel attacks (together with our side-channel analysis tool Lascar and at

At Ledger, we believe in true security. Security is not a term that we take lightly. To build secure systems, it is necessary to use secure hardware bricks and implement a secure Operating