Trezor discloses potential vulnerability in older Safe 3 crypto wallets following white hat research by rival Ledger

The Block

On March 5, hardware wallet provider Trezor disclosed a potential vulnerability in one of its older crypto wallet models. The attack is largely "theoretical" and would likely only affect users who purchased their device third-hand.

Trezor made the disclosure after its primary rival, Ledger, communicated the issue to the firm. On Wednesday, Ledger released additional insights into the exploit, exploring in greater detail how the extremely technical attack could be pulled off. Donjon, Ledger’s Paris-based security unit, reportedly reused a known "physical supply chain attack" and found that a particular Trezor model released in 2023, Safe 3, remains insecure.

"Ledger Donjon recently evaluated our Trezor Safe Family and successfully reused a previously known attack to demonstrate how some countermeasures against supply chain attacks in Trezor Safe 3 can be bypassed," Trezor said.

That said, the attack does not affect most of Trezor's wallets, including its most recent release, Trezor Safe 5, or its first two generations, Trezor Model One and Model T. Moreover, the attack depends on a specific set of circumstances and a high degree of expertise to pull off — making it impractical for widespread exploitation. For that reason, Trezor does not caution immediate action from Safe 3 users, especially if the device was purchased from official sources.

At some point, however, if a third party has physical access to a user's device, it may be at risk.

The attack

The attack demonstrated by Donjon exploits a weakness in Trezor Safe 3's microcontroller — a small, programmable computer chip that handles user inputs and signs transactions — using a technique called voltage glitching. If an attacker can physically access the device, desolder the microcontroller and apply precise voltage changes, he can trick the device into revealing its flash memory contents.

This enables the attacker to reprogram the microcontroller with malicious software, potentially allowing the attacker to reveal a wallet’s seed phrase and access the stored funds — whether the hacker currently has access to the device or manipulated it before a victim acquired it.

"While hardware wallets offer strong security, no system is entirely immune to physical attacks," Trezor writes. "Given enough time, expertise, and resources, a determined attacker could theoretically attempt to extract private keys from a stolen device."

To mitigate risks, newer Trezor models include a "passphrase," which is kept off the device as an extra layer of security for a wallet backup. It has also reinforced its multi-layered security, including firmware integrity checks. The Trezor Safe 5 also uses an upgraded STM32U5 microcontroller that is resistant to voltage glitching.

Staying safe

Both Trezor and Ledger suggest that users only purchase devices directly to ensure that a wallet has not been compromised. A third party, like an unauthorized reseller, could tamper with the device during the supply chain process and alter its hardware or software. In other words, users should be aware of a wallet's chain-of-custody, given that these attacks require physical possession, even briefly, of the hardware wallet.

Many newer hardware wallets contain a "Secure Element," a tamper-resistant physical chip in a device designed to protect sensitive information. The Secure Element locks a user's seed phrase behind a PIN, and includes a retry counter to prevent brute-force attacks. However, a weak PIN could still allow an attacker with physical access to unlock it. This is particularly true for Safe 3 devices, which remain vulnerable to microcontroller-based attacks. However, using a longer PIN can make exploitation more difficult.

Users can also check to ensure their wallets are running the correct firmware using the official Trezor Suite, which includes a verification step using a random challenge. Trezor notes users should update their devices to the latest firmware version as upgrades are released and, if there are signs of tampering, reset the device and restore it in a secure environment.

Perhaps most importantly, as Bybit recently learned after its $1.5 billion hack, users should always know whether they are interacting with the application or entity they think they are. This is difficult given the sophistication of certain exploits today, designed to conceal a malicious transaction by "spoofing" a wallet's UI. However, users can learn to use a separate, trusted device (like a clean computer) to avoid any hazards.

If these sound like technical solutions, it's worth noting again that these are highly sophisticated attacks. Unless North Korea's Lazarus Group can find a way to insert itself in the supply chain process between Trezor and an end user, it's unlikely to scale. Instead, if this attack is carried out, it'll likely be against a high-value target. However, that isn't to say users shouldn't be aware of this.

"At Ledger Donjon, our mission is to push the boundaries of security for the benefit of the whole crypto ecosystem," Ledger CTO Charles Guillemet said. "We appreciate Trezor’s responsiveness to this responsible security disclosure, and that Trezor addressed the vulnerabilities we found, showcasing the importance of continuous improvement and cooperation in the crypto space."

Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.

Risk Warnings and Disclaimers

You understand and acknowledge that there is a high degree of risk involved in trading. Following any strategies or investment methods may lead to potential losses. The content on the site is provided by our contributors and analysts for information purposes only. You are solely responsible for determining whether any trading assets, securities, strategy, or any other product is suitable for investing based on your own investment objectives and financial situation.

Add to Favorites

CoinDesk Bitcoin Price Index Lost 3.36% to $80136.38 — Data Talk

Dow Jones Newswires

CoinDesk Bitcoin Price Index is down $2787.80 today or 3.36% to $80136.38

Down seven of the past eight days
Down two consecutive days, down 3.57% over this period
Down 4.72% month-to-date
Down 14.21% year-to-date
Down 24.92% from its all-time high of $106734.51 on Dec. 17, 2024 (based on 4 p.m. levels)
Up 15.63% from 52 weeks ago (March 14, 2024), when it traded at $69302.60
Down 24.92% from its 52-week high of $106734.51 on Dec. 17, 2024 (based on 4 p.m. levels)
Up 49.90% from its 52-week low of $53461.36 on Aug. 5, 2024 (based on 4 p.m. levels)
Traded as low as $79936.28
Down 3.60% at today's intraday low

Note: CoinDesk Bitcoin Price Index (XBX) at 4 p.m. ET close

Data compiled by Dow Jones Market Data

Risk Warnings and Disclaimers

Add to Favorites

BlackRock’s BUIDL first to cross $1 billion mark, making it the largest tokenized fund tracking onchain Treasuries

The Block

The BlackRock USD Institutional Digital Liquidity Fund, better known as BUIDL, has surpassed $1 billion in assets under management, according to a company announcement on Thursday. This marks a major advancement for the tokenization sector as the first tokenized fund issued by a Wall Street institution to reach the billion-dollar milestone.

BUIDL, launched in March 2024, was BlackRock’s first tokenized fund to be issued on a public blockchain. It offers qualified investors the ability to earn onchain U.S. dollar yields paid daily through dividends earned through its basket of short-term Treasury reserves. The interoperable BUIDL token is pegged to the U.S. dollar, meaning it operates like a revenue-earning alternative to stablecoins like USDT and USDC.

The entire tokenized Treasury market stands around $4.2 billion, meaning BUIDL has captured about a quarter of the market.

Up until today, Hashnote’s USYC was the world’s largest tokenized money market fund backed by tokenized Treasuries, according to RWA.xyz. At around 3 p.m. ET on Thursday, RWA showed that USYC had less than $1 billion in AUM and BUIDL $800 million. According to the site, RWA updates every afternoon — though it's unclear how it sources its data.

On Wednesday, Securitize, the tokenization provider for BUIDL, integrated its first oracle, making it possible to move assets like BUIDL deeper into DeFi. Securitize also works to bring institutional-grade products from the likes of Apollo, Hamilton Lane and KKR onchain.

"We are proud of our pioneering work to make this product a reality, which demonstrates that tokenized securities are not just a concept, but a tangible innovation," Securitize CEO Carlos Domingo said in a statement. "BUIDL has set a new standard, proving to the investment community that this market is here to stay—and the momentum behind that recognition is only growing."

BUIDL was launched on the Ethereum mainnet and has since been deployed on Aptos, Arbitrum, Avalanche, Optimism. and Polygon. It uses the cross-chain Wormhole bridge for chain swaps. BlackRock tapped crypto-native firms Anchorage Digital, BitGo, Copper and Fireblocks as digital asset custodians and the Bank of New York Mellon as for cash and securities services.

BlackRock has moved swiftly into the crypto space, including issuing the fastest-growing Bitcoin and Ethereum exchange-traded funds. The firm also partnered with Coinbase to enable institutional clients to manage crypto alongside traditional portfolios.

Risk Warnings and Disclaimers

Add to Favorites

21Shares to Liquidate of Two ETFs

GlobeNewswire

NEW YORK, NY, March 13, 2025 – 21Shares US LLC ("21Shares"), an affiliate of 21Shares AG, one of the world’s largest issuers of crypto exchange traded funds (ETFs), today announced the scheduled liquidation of two bitcoin futures and ethereum futures ETFs (the “Funds”), based on routine review of the firm’s product lineup to ensure it aligns with market dynamics, the needs of its clients and a maturing digital assets landscape.

21Shares and ARK Investment Management LLC (“ARK Invest”), the Funds’ investment sub-advisor, remain committed partners and look forward to advancing regulated cryptocurrency products in the U.S. market.

The ETFs scheduled for liquidation are the following bitcoin futures and ethereum futures ETFs:

ARK 21Shares Active Bitcoin Ethereum Strategy ETF (Cboe BZX: ARKY)
ARK 21Shares Active On-Chain Bitcoin Strategy ETF (Cboe BZX: ARKC)

Shareholders may sell their holdings in the Funds prior to the end of the trading day on Thursday, March 27, 2025, and customary brokerage charges may apply to these transactions. The last day of trading for both Funds will be March 27, 2025. The Funds will liquidate on or around March 28, 2025 (the “Liquidation Date”).

Shareholders who continue to hold shares of a Fund on the Fund’s Liquidation Date will receive a liquidating distribution with a value equal to their proportionate ownership interest in the Fund on the date. Shareholders who receive a liquidating distribution will generally realize a capital gain or loss equal to the amount of the net asset value of their shares.

Distribution of liquidation proceeds, if any, to a Fund’s shareholders may result in a taxable event for shareholders, depending on their individual circumstances. Shareholders should consult their own tax advisors about any tax liability resulting from the receipt of liquidation proceeds.

Press Contact

21Shares: press@21Shares.com

ARK Invest: Shaina Lamb, shaina@dlpr.com

About 21Shares

21Shares is one of the world’s first and largest issuers of crypto exchange traded products. We were founded to make cryptocurrency more accessible to investors, and to bridge the gap between traditional finance and decentralized finance. In 2018, 21Shares listed the world’s first physically-backed crypto ETP, and we have a six-year track-record of creating crypto exchange-traded funds that are listed on some of the biggest, most-liquid securities exchanges globally. In addition to our six-year track record, 21Shares offers investors best-in-class research and unparalleled client service.

21Shares is a member of 21.co, a global leader in decentralized finance. For more information, please visit www.21Shares.com.

About ARK Invest

ARK Investment Management LLC is a federally registered investment adviser and privately held investment firm. Specializing in thematic investing in disruptive innovation, the firm is rooted in over 40 years of experience in identifying and investing in innovations that should change the way the world works. Through its open research process, ARK identifies companies that it believes are leading and benefiting from cross-sector innovations such as robotics, energy storage, multiomic sequencing, artificial intelligence, and blockchain technology. ARK's investment strategies include Autonomous Technology and Robotics, Next Generation Internet, Genomic Revolution, Fintech Innovation, Space Exploration & Innovation, 3D Printing, Israel Innovative Technology, the overall ARK Disruptive Innovation Strategy, and the ARK Venture Fund.

For more information about ARK, its offerings, and original research, please visit www.ark-invest.com. For additional information regarding ARK's funds, please visit http://www.ark-funds.com.

The information provided does not constitute a prospectus or other offering material and does not contain or constitute an offer to sell or a solicitation of any offer to buy securities or financial instruments in any jurisdiction, including the U.S. Some of the information published herein may contain forward-looking statements and readers are cautioned that any such forward looking statements are not guarantees of future performance, involve risks and uncertainties, and actual results may differ. Additionally, there is no guarantee as to the accuracy, completeness, timeliness or availability of the information provided and 21.co and its affiliated entities are not responsible for any errors or omissions. The information contained herein may not be considered as economic, legal, tax or other advice and viewers are cautioned not to base investment or any other decisions on the content hereof.

Important Information

Investors should consider the investment objectives, risks, charges and expenses carefully before investing. For a prospectus or summary prospectus with this and other information about the Funds, please call: (646) 370-6016 or visit our website at: www.21Shares-funds.com Read the prospectus or summary prospectus carefully before investing.

Investments involve risk. Principal loss is possible. Bitcoin, Bitcoin Futures, Ethereum, and Ethereum Futures are relatively new investments, which have unique and substantial risks and which may be more volatile than other types of investments. The value of an investment in the Funds could decline significantly and without warning, including to zero. You may lose the full value of your investment within a single day. If you are not prepared to accept significant and unexpected changes in the value of the Funds and the possibility that you could lose your entire investment in the Fund you should not invest in the Funds. The performance of Bitcoin Futures and/or Ethereum Futures may differ from the performance of bitcoin and/or ethereum respectively. Derivatives Risk: The Funds use of derivatives (in the form of Bitcoin and Ethereum Futures) presents risks different than investing directly in traditional securities. Using derivatives can lead to losses because of adverse movements in the price or value of the underlying reference asset, which may be magnified by features of the derivatives. New Fund Risk: The Funds are newly organized, non-diversified management investment companies with no operating history. There can be no assurance that the Funds will grow to or maintain an economically viable size, or that an active trading market for the Funds shares will develop or be maintained.

The Fund does not invest directly in bitcoin, ether or other digital assets or maintain direct exposure to “spot” bitcoin or ether.

ARK Invest 21Shares ETFs are distributed by Quasar Distributors, LLC.

21Shares US LLC is the investment adviser to the ARK 21Shares ETFs.

21Shares is not affiliated with Quasar Distributors, LLC.

21Shares is not affiliated with ARK Investment Management LLC

21Shares is not affiliated with Empowered Funds, LLC dba EA Advisor

Risk Warnings and Disclaimers

Add to Favorites

Hyperliquid ups margin requirements after $4 million liquidation loss

Cointelegraph

Hyperliquid, a blockchain network specializing in trading, has increased margin requirements for traders after its liquidity pool lost millions of dollars during a massive Ether liquidation, the network said.

On March 12, a trader intentionally liquidated a roughly $200 million Ether long position, causing Hyperliquid’s liquidity pool, HLP, to lose $4 million, unwinding the trade.

Starting March 15, Hyperliquid will begin requiring traders to maintain a collateral margin of at least 20% on certain open positions to “reduce the systemic impact of large positions with hypothetical market impact upon closing,” Hyperliquid said in a March 13 X post.

The incident highlights the growing pains confronting Hyperliquid, which has emerged as Web3’s most popular platform for leveraged perpetual trading.

Hyperliquid said the $4 million loss was not from an exploit but rather a predictable consequence of the mechanics of its trading platform under extreme conditions.

“[Y]esterday’s event highlighted an opportunity to strengthen the margining framework to address extreme conditions more robustly,” Hyperliquid said.

These changes only apply in certain circumstances, such as when traders are withdrawing collateral from open positions, Hyperliquid said. Traders can still take on new positions with up to 40 times leverage.

Perpetual futures, or “perps,” are leveraged futures contracts with no expiry date. Traders deposit margin collateral — typically USDC for Hyperliquid — to secure open positions.

By withdrawing most of his collateral and liquidating his own position, the trader effectively cashed out of his trade without incurring slippage — or losses from selling a large position all at once.

Instead, those losses were borne by Hyperliquid’s HLP liquidity pool.

Leading perps exchange

As of March 13, HLP has a total value locked (TVL) of approximately $340 million sourced from user deposits, according to DefiLlama.

Launched in 2024, Hyperliquid’s flagship perps exchange has captured 70% of the market share, surpassing rivals such as GMX and dYdX, according to a January report by asset manager VanEck.

Hyperliquid touts a trading experience comparable to a centralized exchange, featuring fast settlement times and low fees, but is less decentralized than other exchanges.

As of March 12, Hyperliquid has clocked approximately $180 million per day in transaction volume, according to DefiLlama.

Risk Warnings and Disclaimers

Add to Favorites

Top Cryptocurrencies Mixed; Bitcoin Falls Below $81,000

MT Newswires

Major digital assets were mixed late afternoon Thursday with Bitcoin (BTC/USD) falling below $81,000.

The CoinDesk Market Index, which tracks dozens of digital assets including Bitcoin, shed 2.3% in the past 24 hours. The Nasdaq 100 shed 2%, the S&P 500 fell 1.4% and Dow Jones Industrial Average decreased 1.3%.

Bitcoin fell 3.1% to $80,223 according to CoinMarketCap data. The most popular cryptocurrency's 24-hour trading volume decreased 22% to $31.4 billion.

Ethereum (ETH/USD), the second-largest digital asset by market value, declined 1.5% to $1,851.

XRP (XRP/USD) rose 0.2%, BNB (BNB/USD) added 2.1%, and Solana (SOL/USD) surged 2.6%.

Dogecoin (DOGE/USD) dropped 3.7%, while Cardano (ADA/USD) fell 4.4%.

The US 10-year Treasury yield stood at 4.274% at 3 p.m. ET Thursday, declining from 4.314% Wednesday, while the five-year yield dropped to 4.028% from 4.077%.

The total market value of the cryptocurrency industry decreased 2.2% in the past 24 hours to $2.62 trillion with trading volume dropping 13% to $91.6 billion.

Risk Warnings and Disclaimers

Add to Favorites

Bitcoin Bottom Confirmed? Data Shows 87.5% Chance The Worst Is Over

NewsBTC

In the ongoing debate over Bitcoin’s market trajectory, two prominent crypto analysts have shared contrasting viewpoints on X, underscoring the community’s divided sentiment. While one maintains that a drastic downturn remains possible, the other posits that the worst of the market downturn has already passed—citing a notable 87.5% probability.

Bitcoin Bears In Trouble?

Crypto analyst Doctor Profit (@DrProfitCrypto) posted on X and laid out two potential paths for Bitcoin: “There are two scenarios: A) Bottom to be 68-74k region in normal market, B) Full crash towards 50k in Black Swan event.”

He did not provide a specific probability for either outcome but emphasized that a Black Swan event—a term used to describe a rare, unexpected event that can drastically impact markets—cannot be ruled out. While noting that such an extraordinary downturn was previously unlikely, he now concedes that recent shifts in the macro landscape may leave room for it:“Take your bets, I would say that a Black Swan event was very unlikely in the last few months, but ask me now, I would not rule it out, rather welcome it.”

In direct contrast, crypto analyst Astronomer (@astronomer_zero) responded with a more bullish outlook, asserting that the bottom is already behind us. He referenced a track record of Bitcoin price reversals around Federal Open Market Committee (FOMC) meetings, claiming it works “14 out of 16 times,” or roughly 87.5% of the time. “Not guarantees, but an 87.5% chance, granted the chart below and all the confluences I already presented. So far so good.”

His approach relies on mapping out price movements in proximity to FOMC dates, noting that markets often price in interest rate decisions (and related news) before official announcements. Astronomer’s method contends that Bitcoin typically finds local bottoms in a window spanning from up to five “2D bars” before an FOMC date to the day of the meeting itself.

“All it requires is flip on a daily (or 2 daily in my case to keep the chart clean) timeframe, plot out all the dates FOMC meeting appeared, and see what price did. This shows that indeed price tends to reverse when time is nearing into FOMC. The caveat is that the price reverses before or at the very latest, right at the FOMC day,” the analyst writes.

He points out that the next FOMC meeting is scheduled for March 19, meaning the bottom—if the historical pattern holds—should appear no later than that date: “Works almost every time, 14 out of 16 times in fact (or 87.5% of the time)… The time difference the bottom happens versus the FOMC day is usually 0 to 5 2D bars before the exact date. Given the next FOMC is the 19th of March, that means the low is in the latest that day and the earliest the 5th of March.”

To bolster his argument, Astronomer points to what he perceives as “peaking fear” in the market. He views heightened pessimism and “cautionary posts out of nowhere” from established traders as typical signals that a rebound could be imminent: “Sentiment wise, fear is peaking to hilarious levels. Even ‘Reputable’ traders are protecting their reputation […] I don’t blame anyone’s methods, but I take it as a great sign of a bottom.”

At press time, BTC traded at $83,277.