MINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection
summary
A practical attack uses EMFI through the enclosure to induce a skip of the wLength USB descriptor check, causing the device to return up to 65K of memory and exposing the 24‑word recovery seed and PIN stored nearby in flash without opening the case. The setup uses ChipWhisperer coils, a USB trigger/sniffer (Beagle or the open-source 5whisper USB), and timed glitches; firmware patches and optional seed passphrases mitigate the issue.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:36Blockchain history
- 1:47Hardware wallets
- 3:10Wallet vulnerabilities
- 5:30Analyzing the exploit
- 7:16Exploiting USB descriptors
- 11:41Fault injection setup
- 13:54Tooling and commercialization
- 15:40Fault injection demonstration
- 18:03FIDO token vulnerability
- 20:58Mitigation and best practices
- 22:41Conclusion and Q&A
related talks
30mAffordable EMFI Attacks Against Modern IoT Chips
44mSilicon Under Attack Physical Exploitation Of Modern Chips
19mBe Write Back: An in-depth Study of Fault Injection Effects on FRAM Technology
38mExtracting Seeds from Hardware Wallets
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
01h 07mPEW PEW PEW: Designing Secure Boot Securely
44mPractical Software Countermeasures 4 Hardware Glitch Attacks
27mProtecting Data In-Use from Firmware and Physical Attacks