Hardware Hacker Rescues $2M in Crypto From Trezor Wallet

After two investors lost hope in recovering $2 million worth of Theta tokens, engineer and inventor Joe Grand, came to the rescue. The funds were stored in a Trezor wallet, one of the most popular cold wallets.

In 2018, Dan Reich who is the CEO and a Co-Founder at Troops Inc invested $50,000 in Theta token along with a friend. Theta was being traded at $0.21 when the pair purchased it and the price started rising in late 2020. Theta reached an all-time high of $15.90 in April of last year, making the $50,000 investment worth more than $3.5 million.

Reich and his friend were desperately looking for a hacker to help them recover the long-lost 5-digit pin, which they initially thought was four digits, and the recovery phrase for accessing the money in the wallet. They almost lost hope while many refused to help while others were deemed too risky. 

Reich saw a 2018 conference showing three engineers hacking a Trezor wallet and said, “We at least knew that it was possible and had some directional idea of how it could be done.”

Breaking into the Trezor

When they found Joe Grand, Reich knew that he was likely the only one to help them crack the wallet. Grand has an impressive background when it comes to engineering and started hacking when he was only 10.

“I remember thinking, ‘Wow, this is perhaps one of the brightest electrical engineers I’ve ever met,” Reich said.

Grand learned a fault-injection method, also known as glitching, from a 15-year-old hacker named Saleem Rashid, who had previously recovered $30,000 worth of Bitcoin in 2017 using the same technique. 

Grand uploaded a complete video of the whole process on YouTube, saying, “If we can glitch the chip at the right time, we’re going to defeat the security and then we can continue with our attack.” Grand mentioned that he wanted to recover the PIN and phrase from the RAM, but if anything went wrong, the PIN might be gone forever;

“We are basically causing misbehavior on the silicon chip inside the device in order to defeat security. And what ended up happening is that I was sitting here watching the computer screen and saw that I was able to defeat the security, the private information, the recovery seed, and the pin that I was going after popped up on the screen.”

After successfully trying the attack on three identical wallets, Grand was able to read the PIN and recovery phrase from the RAM, making Reich $2 million richer after giving a percentage of the Theta tokens to Grand as a reward. 

Grand says that he wants to help others with the same issues and help companies to further secure their wallets. The engineer thinks that he can use his skills to access almost any wallet saying, “It depends on the design, but with enough time and effort and resources, anything is hackable.”

Trezor wallet team responded to the hack in a tweet, saying, “We just want to add that the vulnerability was already fixed, and all new devices are shipped with a fixed bootloader.” Moreover, they thanked Saleem Rashid for his effort in finding the vulnerability.