Can Hardware Wallets Keep Up with Crypto Security, Nicolas Bacca, Ledger & ZKNox | ETHSofia 2025

[Music] And yes, so thank you all. Thank you for inviting me and thank you all for being here. I know it's difficult to be the first talk of the afternoon. So I will try to don't disturb you too much while you are digesting. No, just joking.

I mean uh the title is nice but well it will be a history of hardware wallets and basically what we can do and how you should look at them uh and what they protect you against. Uh quick words about me first. So I am one of the co-founder of Ledger hardware wallet company. If you have a ledger you can raise your hand so I can I can see you. Yeah lot of people.

So I have very good news. Uh it's good for my retirement. Uh and the bad news is that you your upsc is don't really good but we will see why later. But don't worry uh you shouldn't tell that you have a hardware wallet but you should definitely use it. Uh so what I did at leger uh wrote the different applications I'm doing a bit of hardware security as well and now I'm working with a new company u optimizing crypto algorithm and still trying to onboard more people into crypto.

Um so first I want to drive you through the different threats that you are facing when you are using a hardware wallet. But maybe first what is a hardware wallet? A hardware wallet is basically protecting keys. So the name is very bad. It should be called uh a key ring in my opinion because your assets are still in on the blockchain.

They are not on your wallet. You have a lot of different form factors. You have some with screen, some without screen. So you shouldn't use those. But just as an example and well why are you using a hardware wallet?

First you shouldn't wear it on your neck for obvious reasons. And when you have one, you should take it out of the of the box and actually use it. Um, so we will see we'll see what kind of threats you have. But the most important one is that you should the most important thing to remember this slide is that you should use your hardware wallet because the first threat you can get is a very simple malware that's going to steal keys from your computer. And that's actually the main source of loss of the past months.

I think we have lost several uh dozen of maybe hundred of millions due to that. You can catch malware in a lot of different ways. So the most popular one those days is to catch one. If for example you have a job interview, someone tells you to run a GitHub. Uh you just install the dependencies and you get wrecked.

Uh or you can be in an interview, someone can tell you I can't hear you, you should install a new version of Zoom and you get wrecked as well. So this is really the main threat that people are facing today. So you see the bar is very very low. Uh especially if you are running a protocol, if you are running a multi-IG, you should definitely have all signers in a hardware wallet. I could basically stop there because this is where the bar is.

But well since I have 20 minutes, I will speak about a lot of other threats. Uh fishing is also another threat that you are facing because fishers have a lot of time to spend to convince you that you can give them your 24 words and they will be very very convincing and they will have a lot of different tactics. For example, they will just tell you you can give me the four first letters and it's fine. And for someone you know who is used to only give the last number for example of the credit card they think it's safe and it's not safe because if you have the first force the first four letter of the word you have the full words and then you don't have your money because your seat is your money. Uh one solution to that might be to think you don't need to have a seat phrase.

So actually I agree you don't need to have a seat phrase and we shouldn't onboard people with a seat phrase. Uh this is what Tom buyer presentation was about. I'm I'm really big on account abraction, but for a hardware wallet, you should still have a seat phrase associated to your hardware wallet. Um, then a little bit more creative way form of fishing which is also popular those days. Uh, people will try to send you transaction with a message.

Uh, for example, they will send you an NFT and the NFT you will have a URL. If you click on the URL, you will see you can get some rewards if you give your 24words and so on and so forth. So we are back to the previous attack but this one is a little bit uh this one is a little bit more creative and people manage for example to send you um wrong tokens to an address which is very similar to yours. So if instead of using an address that you know you are just looking at your transaction and copying the address to send again more assets to an address uh you will get wrecked. So here the best solution I have in mind is to use something like ENS if you are on is if you are on another chain then well maybe verify your address using a secondary source as much as you can.

Now moving into a more advanced threat malware which is a bit smarter. So in that case the malware will not steal the key uh but the malware will try to change the destination of what you're sending. So the malware will try to trick you into sending your assets while the key is still protected. So hardware wallet cannot really protect you against that. Uh you have to be very careful and you have to read the address on the screen.

So read all the address because you have smart malware today that can try to use some kind of well address that look very similar in the beginning and in the end. It's not that costly to do that those days and there is a lot of idle power due to AI and other things. Um so please pay attention to what your hardware wallet is displaying if you want to avoid this. Uh then moving into even smarter uh malware. So North Korea is very famous for doing that.

They did that with with SE with safe uh recently. Uh if you have counter measures on your hardware wallet, the malware will try to break those counter measures. For example, if you're running a transaction simulation on your PC and then you're reading the result of the transaction simulation, you think it's fine. Uh but then it will send a different transaction to sign to the hardware wallet. So here the solution would be to run all the checks either elsewhere and verified on the hardware wallet with a signature for example or to run everything on chain.

So this is another option that on buyer was talking about this morning. Uh but the main thing to remember here is that all the implementation that you have if you are checking them on your hardware wallet today are proprietary and run on the server side. So even if you are protected on your hardware wallet and I think only Ledger is supporting that uh it's not great for decentralization. So we'll see the better solution some of them including uh onchain checks. Um now we are moving into threats which are a little bit more in the physical world.

Um let's say someone is going to steal your hardware wallet because for example you raise your hand and you said you had one. Uh so here you have two strategies to deal with that. The first one is to is to protect your hardware wallets against physical attacks. We'll see how to do this. And the second one is to manage is to design your hardware wallet in a way uh so that there is no information in your hardware wallet when you are not using it.

And I would say the second way is a bit more complicated to do because you will still have code running in your hardware wallet at some point. And if someone manage to hack you and then come back, for example, drop the hardware wallet back and change the code running inside, even if you don't have data into your hardware wallet, you could still be compromised because you would be interacting with something that is very different from what you expected. Um, but it's easier to do. I mean, the second one is easier to do than the first one, but uh we'll dig a little bit more into how you can actually achieve that. So, first description about physical attacks.

So other thing other than stealing the hardware wallet an attacker could try to modify the environment to extract information from the hardware wallet I will classify physical attacks into two kinds. The first one is active which means that the attacker will try to change the behavior of the hardware wallet through uh doing modifications with power given to the hardware wallet with a clock for example. Also here the attacker can hold the hardware wallet in its hand usually and perform those modifications trying to bypass the pin or trying to bypass the protection of the hardware wallet. The second one is more interesting uh from an attacker point of view because here you will be trying to listen uh to electromagnetic signals of the hardware wallet. So it is something that could run for example in a USB in a USB cable.

uh if you get a cable and if your hardware wallet is designed in some way and leak information then the attacker could manage to retrieve secrets from that. So here it's a bit like when you see a phone charger some people will tell you do not plug your charger your phone into random charger here it's a bit the same thing if you are if you don't exactly know what your hardware wallet is protecting you against it's best not to plug it into random stuff. Um so to defend against physical attack the best way that we have today is to use tools that have been designed in the 80s and used by governments used by banks and used by everybody which is a smart card. So you have a smart card in your pocket. You have one in your credit card.

You have one in your passport. Uh but it is not protecting your secrets. It's usually protecting the secret of someone else and someone else being your bank or your telecom operator. So being able to work with a smart card is quite complex, especially being able to run everything inside it, all your code inside it, but it would be the best way in my opinion to protect to protect you against physical attacks. So it's a strategy that is used by uh Ledger and a few other manufacturers.

So I'm listing them here. So Satoshi, Burner, TJM status. Uh so here, yeah, for me it's the best way to protect against the active and the passive attacks. But then we have something that doesn't make them very future proof is that they are very slow and they don't have a lot of RAM. So if you want to if you want to implement new cryptographic algorithms or if you want for example to do a full check of your transaction directly on a smart card it get difficult because again the platform is extremely constrained.

Um, so another way to try to deal with physical attacks if you can't access a smart card, if you can't fully program a smart card, is to divide the problem into different chips. For example, you could put your secrets in a chip that is very good at protecting secrets and all your code in something else because that chip would be good at protecting secrets but not at signing etherum transactions for example. So in that case uh you have an architecture where you can have one chip which is running your code and one secure element or even several secure elements doing uh the computation on the secrets and actually trying to protect them. The problem with this architecture is that usually it's done for not a very good way. I mean the honest way to use this architecture is to say I can't have access to the smart card.

But if you do it and if you don't really think about the different possible attacks. So I'm very open to talk about that later during the day. Uh you can end up with very weird problems where people will be able to attack directly the secrets on the chip that is supposed to protect them by asking them nicely to do something with them because you have no authentication between the code and the secrets. And if the code and the secrets are not in the same place, uh the attackers will try always to go for the weakest point. And here the weakest point will be the code.

um moving into now attacks in the physical world. So the $5 range attack which is now 15 due to inflation uh people will try just to attack you and tell you yeah well uh we know you have money and you are going to give it to me otherwise I'm going to cut you a finger. Well usually that works unfortunately. Uh but here one way you could use to fight against this is to use a passphrase in your in your hardware wallet. So the passphrase known also known as the 25th word uh is a special word you will add and with this word you will know that well you will create completely a different seed.

So you can either have it on a different pin if your architecture supports it or you could have it as a word that you enter every time you are going to sign a transaction. So it's a bit more annoying to do I mean from a user point of view but it's the best protection if you think that you are dealing with an attacker that doesn't know exactly how much you have. Um now considering the risk of the manufacturer itself here it's where things get extremely tricky because you have the best solution to avoid an evil manufacturer is basically to build the hardware wallet yourself. Uh but since there there are not a lot of people who will be doing this and it's not really good for adoption uh you have to you have to look for architecture that will minimize trust even if you buy a hardware wallet and for that the best way to minimize trust is just to use well it's to only use one component and to only trust one component because the more component you add the more risk you the more risk you get there. Um so here as I said the best way to do that is to just use a do-it-yourself solution.

In that case you build everything yourself. You source components which are not related to hardware wallets. You source them from different sources and well you have less risk of course but then uh you have a lot of other problems. um it's difficult to do and you might be susceptible to hardware attacks to physical attacks because those components are not protecting not protected against those. Uh if you don't do it do it yourself but your hardware wallet is advertised as being completely open source then you run into a completely different kind of problem.

It's actually very difficult to verify that the code which is running in your hardware wallet is exactly the code that you compiled and the code that you loaded on the device. Why? Because when you build the device yourself, you are directly talking to the hardware. When you are acting with the device that you bought, you are going through an extra piece of software to load your firmware. And if that extra piece of software is compromised, of course, you could think you are loading the right firmware, but you would be running a different firmware.

For example, you could have a bootloader that is modifying your code on the way. uh an example here random example of a nice attack of a bootloader was used to transform one device into another. So one manufacturer decided to do a treasure clone. Actually the manufacturer died because it was not a very good business model. Uh but since they have a bug in the bootloader you can replace the bootloader by the bootloader of a treasor and then you have a traor since they are physically equivalent.

Uh but it's an example of a nice way to use this attack and you could use it in a very bad way and steal money from users. So the best way for me to consider a hardware wallet as being future proof is to use a platform approach. With a platform approach, you run an OS. So you consider that your hardware wallet is running applications. It's running an operating system.

You are designing applications on top and everybody can design those applications. So if you want to change something, you can do an application yourself. You can design it and well then this is the best way to be future proof in my opinion. Uh I'll skip that one because I'm a little short on time. That's what you can do and well possible architecture that we have on hardware wallets using hardware wallet in the future is the one actually presented by ump buyer you are putting a lot more logic on chain and in the end the hardware wallet is an element that you use to authenticate to your contract to change the configuration of your contract or to do special tasks.

Uh typically it's perfectly okay to buy uh to buy your quason with your uh uh with your phone but if you want to buy your home then you would use your hardware wallet and the account uh with account abstraction you can have a unique address to do that. So the same account could be used with different with different uh kas. So it could say for example for a small amount of money you can use your phone and for a bigger amount of money then you need to use your hardware wallet. A last to finish with a really really strong challenges. So postquantum cryptography are hardware wallets concerned.

So the quick answer is no because there are different algorithms today considered for that. They can all be implemented on hardware wallets with uh some some trade-offs. So some are best designed to be running uh in a web two scenario. Some are best designed to be running on chain. Uh some are slower, some are faster, some are bigger than others.

But in the end they can all be implemented in a hardware wallet. So today the choice of a postquantum uh algorithm is absolutely nonde but we have a few uh it could be a presentation on its own. So I'm going very fast on this and what we can do in the future so to keep the hardware wallet future proof I think the best way would be to have clear signing. So verifying what you are signing and transaction simulation that can be reviewed in the hardware wallet because in that case that protects you again all kind of all kind of non-physical malware. Uh it still needs to be open.

It still needs to be designed. So well uh we maybe a way to do that would be to have an ERM application that has a standardized set of features and that can run on the different hardware wallet so that the manufacturer don't spend time reinventing the wheel and you can expect to have the same security from everything but uh it's still a large work in progress. So if you want to explore this uh you can reach me on Twitter, you can reach me here. I mean I will be here two days and maybe Yeah. So that's my that's my Twitter account.

And to get back on the most important slide of the presentation, which is exactly the first one. Yes. So just use a hardware wallet. Even if it's not the best one, even if you are not sure what it does, you have to use a hardware wallet. If you are I have a message from the SE 911 that you might be familiar with.

There are a group of white hackers protecting protocols from uh well from different attacks. And one of the members so the lead member of the group Pika Versace told me to add in the presentation that if you are not using a hardware wallet it will come back and haunt you in your dreams. So that's it. So that is the general message. So please use a hardware wallet.

Thank you. [Applause] [Music] Heat.