A critical vulnerability has been discovered in the ESP32 chip widely used in affordable Bitcoin hardware wallets. This vulnerability poses risks to users.
Discovery of the Vulnerability
The vulnerability, registered as CVE-2025-27840, is linked to insufficient entropy in the chip's random number generator. This exposes users to risks from malicious software updates or key-pair attacks.
Random Number Generation Issues
The ESP32, developed by Espressif Systems, lacks a hardware security module, compromising its ability to generate secure private keys. The vulnerability allows attackers to potentially guess or compute private keys, threatening user funds.
User Recommendations
Developers using ESP32 to build wallets are advised to incorporate external sources of entropy or shift to more secure architectures. Users relying on ESP32-powered hardware wallets should consider temporarily transferring their assets to more secure devices.
The emerging vulnerability in the ESP32 chip highlights the importance of security in cryptocurrency applications, urging users to be especially cautious in their choice of asset storage.
