Executive brief
A security flaw in Trezor hardware wallets could allow an attacker with physical access to the device to steal the recovery seed (mnemonic phrase). By monitoring the device's power or electromagnetic signals during setup or unlocking, an attacker can use advanced analysis to reconstruct the secret words. This would allow the attacker to take full control of the digital assets stored on the wallet. The manufacturer has released firmware updates to fix this behavior.
Technical details
A side-channel vulnerability exists in the mnemonic_to_bits() function used during BIP-39 mnemonic processing. The root cause is a non-constant time execution and specific branch patterns during wordlist searching (binary search), which violates constant-time cryptographic principles. An attacker with physical access to an unlocked device or during the initial setup phase can capture a single side-channel trace. Using profiling-based Deep Learning Side-Channel Analysis (DL-SCA), the attacker can recover the mnemonic code. Trezor resolved the issue by replacing the binary search with a linear search to ensure constant-time execution and by storing a binary copy of the seed to avoid redundant processing.
Affected products
- Trezor Trezor One v1.13.0 to v1.14.0
- Trezor Trezor T v1.13.0 to v1.14.0
- Trezor Trezor Safe 3 v1.13.0 to v1.14.0
- Trezor Trezor Safe 5 v1.13.0 to v1.14.0
Timeline
- 2025-09-24: other: Vulnerability reported to Trezor
- 2026-04-14: disclosed: CVE published
- 2026-04-14: advisory