Kraken Security Labs has identified a critical vulnerability in Trezor’s crypto wallets, which allows hackers to withdraw cryptocurrencies in less than 15 minutes after accessing them.

in one posts Yesterday, Kraken claimed that hackers can exploit a vulnerability in the Trezor One and Trezor Model T wallets in just 15 minutes and then gain access to what’s on the device.

According to the publication, Trezor has been aware of this vulnerability since its product design process.

Before announcing the security flaw, Kraken revealed in October 2019 the details of the attack on Trezor.

The Ledger security team alsoLedger Dungeonconducted similar research last year.

Read:SEC Commissioner: Some NFT sales may be illegal

According to Kraken’s head of security, Nick Bercoko, the flaw is still present in Trezor’s wallets because they are still using the same “microcontroller” which is why the vulnerability persists despite Trezor’s knowledge of it.

Berkoko said:

It’s a hardware flaw, not something they can just put an official update on and fix it for all their customers

To address this issue, they need a new hardware version.

Following the publication of the Kraken blog, Trezor indicated in a tweet as an official response to Ledger’s research published in March 2019.

According to the response, the attack cannot happen remotely and will not succeed if users run the “BIP 39” passphrase.

In a subsequent tweet, Trezor said:

Physical access is a threat to 6-9% of people, according to our research

If physical access is part of someone’s threat model, we recommend using the passphrase feature.

But again, physical access is not a widespread condition.

Bercoko confirmed Trezor’s response and said:

We would not be able to perform this attack if there was a BIP 39 passphrase, but unfortunately the passphrase is an optional add-on that is not provided to all users

Read:Bursa Malaysia Explores Blockchain Technology and Incorporates It into the Bond Market

So, the real recommendations here are to make sure you control physical access to your Trezor wallet, and to add that extra passphrase to the wallet.

Read:EOS decentralized network applications lose $1 million in 5 months as a result of hacking

Kraken has previously carried out a similar attack against the KeepKey wallet, and Kraken concluded in a blog post that:

These “Trezor and KeepKey” chips are not designed to store secrets and… users should not rely on them alone to secure cryptocurrencies.

Bercoko said Kraken decided to make this announcement in order to raise awareness of this type of vulnerability.

This is for our customers and for users within the crypto community who need to be aware that they need to take extra precautions when using a hardware wallet to ensure their coins are protected.

Read also:

Beware Cardano’s Yoroi Wallet Website is Targeted by Scammers

Best apps to track cryptocurrency prices and your wallet