Engineering a backdoored bitcoin wallet
summary
A backdoor modifies ECDSA signing to embed a wallet seed into normal-looking signatures by choosing nonces that encode linear combinations of seed bits, allowing recovery via short-interval ECDLP solvers (Pollard’s lambda and time–memory tradeoffs). The implementation leaks a 256-bit seed in 10 signatures during an end-to-end Bitcoin testnet demo, requires only modest computation (laptop-scale), works when implanted after key generation via firmware update, needs no persistent storage, and produces signatures indistinguishable from legitimate ones.
AI-written summary · about
chapters (10)
- 0:00Cryptographic subversion intro
- 1:35Real-world subversion examples
- 2:16Backdooring signature schemes
- 4:22Backdoor assumptions and goals
- 5:49Effective backdoor requirements
- 10:04Backdoor scheme construction
- 14:38Team recruitment
- 15:00Live attack demo
- 16:08Mitigations and hardening
- 17:12Conclusion and Q&A
related talks
38mExtracting Seeds from Hardware Wallets
28mThe Coldcard Exploit What Happened & Why Bitcoin is Stronger Than Ever
32mBitcoin Self Custody: Challenges & Tradeoffs
35mAt the crossroad of Crypto and Security: A dev insider view
25mMINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection
18mThe Future of Crypto Wallets: Trends and Innovations
37mCryptocurrency - building a wallet on your phone
15mWallets: How Cold It Can Get?