List of Hardware Wallet Hacks

This page is a running list of hardware wallet vulnerabilities, counting any flaw that lets an attacker change a device's intended behavior, whether or not it was exploited or rated low-risk by vendors. Entries run from 2014 to late 2018 and cover Trezor, Ledger and Shift Cryptosecurity's BitBox01. Notable entries include a 2015 Trezor power-analysis key extraction reported by Jochen Hoenicke, a 2018 Ledger isolation vulnerability reported by Sergei Volokitin, and a 2018 BitBox01 issue where the xpub API could reveal private keys, reported by Saleem Rashid.