Dark Skippy Attack: Is Your Hardware Wallet Safe?

Understanding the Dark Skippy Attack Vector

Dark Skippy, made public by security researchers in 2024, showed how malicious hardware wallet firmware can leak a whole seed through ordinary-looking signatures. It has not been seen in the wild, but it shows that even careful users are exposed if their device firmware has been compromised, and it explains why where you buy a device and how you install firmware matter so much.

At its core, the Dark Skippy attack targets the nonce generation process during Bitcoin transaction signing. When a hardware wallet signs a transaction, it must generate a unique random number — called a nonce — that protects the private key during signing (both ECDSA and the newer Schnorr signatures use one). The mathematical security of this process depends entirely on the quality and unpredictability of these nonces. If an attacker can compromise the firmware to generate weak or predictable nonces, they can recover the seed from as few as two signatures on the public blockchain, and both can sit in a single transaction with two inputs.

Every signature uses a one-off secret number, the nonce. Honest firmware makes a new 32-byte nonce for every signature that nobody can guess, so there is nothing to work back: far too many possibilities. Dark Skippy firmware splits your 12-word seed, which is 16 bytes, into two halves. Bytes 1 to 8 become the nonce of the first signature and bytes 9 to 16 the nonce of the second; the rest of each nonce is filler the attacker knows. Both signatures sit in one ordinary transaction with two inputs: the coins arrive and nothing looks wrong. The attacker spots the transaction in the mempool, works each 8-byte nonce back on a decent laptop and joins the halves into your seed. Two signatures can carry a whole 12-word seed, so one transaction from a bad device can be enough to lose everything. — **Dark Skippy hides your seed in the nonces.** Honest firmware uses a 32-byte nonce nobody can guess. Malicious firmware uses 8 bytes of your seed instead, small enough for the attacker to work back, so one ordinary two-input transaction can leak a 12-word seed.

What makes Dark Skippy particularly alarming is its stealth. Unlike physical tampering or obvious malware, a compromised firmware generating biased nonces produces transactions that appear perfectly normal on the surface. The signed transactions are valid, the funds move as expected, and there is no immediate indication that anything is wrong — until the attacker has collected enough signatures to extract the master seed. Even additional security measures like BIP39 passphrases may not provide protection, since the attack operates at the cryptographic signing level.

Supply Chain Attacks: The Hidden Threat

The most realistic pathway for a Dark Skippy-style attack is through supply chain compromise. When a hardware wallet passes through unauthorized hands between the manufacturer and the end user, the risk of firmware tampering increases dramatically. Resellers, marketplaces, and even compromised shipping channels all represent potential points where a device could be intercepted and modified. This is not hypothetical: in October 2026 Ledger confirmed a hidden implant that copied the recovery words during setup in a device sold by CryptoBilis, an authorised reseller of Ledger and Trezor in Southeast Asia (our advisory).

Supply chain attacks are particularly insidious because they compromise the device before the user ever powers it on. A sophisticated attacker could replace legitimate firmware with a modified version that appears identical in every way — same interface, same features, same behavior — except for subtle modifications to the random number generator. The user would have no way to detect the compromise through normal operation.

The risks extend beyond simple device interception. Advanced supply chain attacks might involve manufacturing counterfeit devices that look identical to legitimate products, complete with packaging, holographic seals, and serial numbers. These counterfeits can contain hardware backdoors at the chip level, compromised secure elements, or firmware that passes superficial verification checks while harboring malicious code.

Purchasing hardware wallets directly from the manufacturer remains the single most important defense against supply chain attacks. When buying directly, you eliminate every middleman who could potentially tamper with the device. Manufacturers like Coinkite (Coldcard), Trezor, and Ledger maintain their own stores specifically to minimize this risk. If the maker does not deliver to your country, use a reseller listed on the maker’s own website, and check our security advisories for that reseller first: as the CryptoBilis case showed, an authorised reseller is still a middle link.

Firmware Verification: Your First Line of Defense

Cryptographic firmware verification represents the most critical technical defense against both Dark Skippy and supply chain attacks. Every reputable hardware wallet manufacturer signs their firmware releases with cryptographic keys, allowing users to verify that the software running on their device has not been modified.

The verification process typically works as follows: the manufacturer publishes firmware files along with their cryptographic signatures. When you update or initialize your device, the wallet checks the firmware signature against the manufacturer’s known public key. If the signature does not match — indicating the firmware has been altered — the device should refuse to operate or display a clear warning.

Your device compares the firmware's signature with the maker's public key. Three cases. The maker's firmware on a genuine device: the signature matches and it runs. Changed firmware, like Dark Skippy, on a genuine device: the signature fails and the device refuses it or shows a clear warning, so stop there. Tampered hardware, a fake device or a chip added on the way: the firmware check misses it. A fake device runs a fake check, though the maker's seal and app checks can catch one. An added chip isn't firmware, and no seal or app check can see it: in October 2026 one, in a device sold by CryptoBilis, read the recovery words off the screen. The check proves the software is the maker's, not the hardware, so against tampered hardware, buy new from the maker's own store. — **A firmware check catches changed software, not changed hardware.** It stops firmware like Dark Skippy from running on a genuine device. A fake device gets past it (the maker’s seal and app checks can catch one), and an added chip gets past those too, which is why where you buy matters most.

However, not all firmware verification implementations are equal. Some devices perform verification only during updates, while others check firmware integrity every time the device boots. Devices with secure boot processes that verify firmware at every startup provide stronger protection, as they can detect firmware that has been modified after the initial installation.

Open-source firmware designs add another layer of protection by enabling independent security audits. When the entire codebase is publicly available, security researchers worldwide can examine it for vulnerabilities, backdoors, or suspicious nonce generation behavior. Projects with public firmware — such as Trezor, BitBox02 and Blockstream Jade, and Coldcard, whose code is published under a source-available licence — benefit from continuous community scrutiny. This transparency makes it significantly harder for any single entity to introduce malicious code without detection.

Secure Element Architecture and Hardware Protection

Modern hardware wallets employ secure elements — specialized microcontrollers designed to resist both physical and electronic attacks. What they protect depends on the design: in some wallets the signing itself runs inside the secure element, while in others, such as Coldcard and the Trezor Safe models, the secure element guards the seed behind your PIN and the main processor does the signing.

Secure elements are designed to resist a wide range of attack vectors: power analysis attacks that try to infer key material from power consumption patterns, fault injection attacks that introduce errors to bypass security checks, and physical probing attacks that attempt to read data directly from the chip. The implementation quality of these protections varies between manufacturers and chip designs, making it important to evaluate the specific secure element used in any wallet you consider.

However, secure elements are not a silver bullet. Dark Skippy does not need to break the chip, only to replace the firmware that signs. Where the main processor signs, that firmware receives your seed as soon as you enter your PIN, and the secure element cannot see what it does with it. Where the signing runs inside the secure element, compromised firmware there leaks the seed in the same way. This is why firmware verification and supply chain integrity are essential complements to hardware security.

Some manufacturers have taken alternative approaches, arguing that secure elements introduce their own trust assumptions since they typically use proprietary, closed-source designs. These manufacturers instead rely on minimizing the attack surface through air-gapped designs and open-source implementations that can be fully audited. Both approaches have merit, and understanding the specific security model of your chosen wallet is crucial.

Practical Defense Strategies Against Nonce Attacks

Protecting yourself against Dark Skippy and similar nonce-based attacks requires a multi-layered defense strategy that goes beyond any single security measure.

1. Always buy new, direct from the maker’s own store. This eliminates the most common supply chain attack vector. If the maker does not deliver to your country, use a reseller listed on the maker’s own website, check our advisories for that reseller first, and inspect the device thoroughly upon receipt. Never buy second-hand.

2. Verify firmware before first use. Download firmware directly from the manufacturer’s official website and verify cryptographic signatures. Never use a device that comes pre-initialized or with a seed phrase already generated — this is a red flag indicating potential tampering.

3. Generate fresh seeds on verified devices. Always generate your seed phrase on a device running verified firmware. If you have any doubt about a device’s integrity, do not reset it and carry on: a reset cannot remove a chip added on the way. Stop using it and contact the maker for a check or a replacement. If it already holds funds, make a new seed on a device you trust and move your funds before you wipe the old one.

4. Use multi-signature setups for high-value storage. Multisig configurations using hardware wallets from different manufacturers provide robust protection against single-device compromise. Even if a Dark Skippy attack leaks one device’s key, the attacker cannot spend without enough other keys to reach the threshold, taken from another device or from another key’s recovery words. Keep each key’s device and recovery words in a different place from the other keys.

A 2-of-3 multisig wallet with three devices from three makers, each holding one key. The device from maker B has bad firmware, so the attacker gets key B from its signatures. One key of three can't spend: two are needed. You still hold keys A and C, two of three, enough to move the coins to a new setup without key B. With three makers, one bad firmware reaches one key. — **In a 2-of-3 multisig, one bad device can’t spend your coins.** Even if its firmware leaks its key, the attacker holds one of three keys and spending needs two. Devices from different makers keep one bad firmware from reaching a second key.

5. Verify addresses across multiple independent devices. Before sending funds, confirm the receiving address on multiple hardware wallets or through an independent verification method. This helps detect address substitution attacks that might accompany firmware compromise.

6. Monitor for unusual behavior. Stay informed about security advisories from your hardware wallet manufacturer. When a firmware vulnerability is discovered, manufacturers typically release patches quickly. Following official channels ensures you receive timely notification of any issues.

7. For extra assurance, use a device with anti-exfil signing. With anti-exfil, your computer adds its own random data to each signature and checks that the device used it, so a compromised device cannot hide your seed inside its signatures, as long as the computer or phone running the app isn’t compromised too. The BitBox02 and Blockstream Jade offer it. As of November 2026 it does not yet cover Taproot addresses (those starting bc1p), and it only works over USB or Bluetooth with a wallet app that runs the check, such as the BitBoxApp or the Blockstream app. When a Jade signs by QR code (air-gapped PSBT), it does not use anti-exfil, even with the Blockstream app.

Anti-exfil signing between your wallet app on your computer or phone and your hardware wallet, which may have bad firmware. 1: the app picks a random number and sends it sealed, only its fingerprint (hash) for now. 2: the device sends a lock on its nonce, not the nonce itself, before it can see your number. 3: the app unseals the number; it is too late to change the nonce. 4: the device returns the signature, with your number mixed into the nonce. Your app checks the mix; if your number isn't in it, it stops and warns you. The final nonce depends on a number the device couldn't see in time, so bad firmware can't steer the nonce to carry your seed. As of November 2026 the BitBox02 and the Blockstream Jade offer it over USB or Bluetooth, with an app that runs the check such as the BitBoxApp or the Blockstream app; not when a Jade signs by QR code, and not yet for Taproot addresses starting bc1p. This assumes the computer or phone running the app isn't compromised too. — **Anti-exfil: the device must lock in its nonce before it sees your app’s random number.** Your number is then mixed into every signature and the app checks it, so bad firmware can’t steer the nonce to carry your seed if the computer or phone running the app is sound.

The Role of Open Source in Wallet Security

The open-source movement in hardware wallet development plays a crucial role in defending against attacks like Dark Skippy. When firmware source code is publicly available, the security community can audit the nonce generation algorithms, verify the randomness of signature components, and identify any code that could weaken cryptographic operations.

Open-source projects benefit from what security researchers call “many eyes” — the more people who review the code, the more likely it is that vulnerabilities will be discovered and fixed before they can be exploited. This community-driven approach to security has proven effective across the broader software industry and is equally valuable in the hardware wallet space.

Some open-source hardware wallet projects have gone even further, making not just their firmware but their entire hardware designs publicly available. This enables independent verification of manufacturing processes and allows users to build their own devices if they prefer not to trust any manufacturer’s supply chain. While building your own wallet is impractical for most users, the option to do so represents the ultimate expression of trustless verification.

Looking Forward: The Arms Race Continues

The Dark Skippy attack represents just one chapter in an ongoing arms race between hardware wallet security and increasingly sophisticated threats. As the value secured by hardware wallets continues to grow, so does the incentive for attackers to develop new exploitation techniques.

The direct defense already exists: anti-exfil signing, offered today by the BitBox02 and Blockstream Jade, lets your computer add its own randomness to each signature and verify that the device used it, which closes the channel Dark Skippy relies on for the signatures it covers, as long as the computer itself isn’t compromised too. Support for Taproot signatures, and from more manufacturers, is the next step.

Hardware wallet makers are also working on stronger firmware attestation and better tamper detection. For users, the key takeaway remains constant: understand your device’s security model, verify everything you can, maintain strict supply chain hygiene, and never assume that any single security measure is sufficient on its own.

Hardware wallet security is not a destination but an ongoing practice. By staying informed about emerging threats like Dark Skippy, maintaining proper verification procedures, and implementing defense-in-depth strategies, you can significantly reduce your risk and protect your Bitcoin holdings against even the most sophisticated attacks.

Step-by-Step Guide: Verifying Your Hardware Wallet Against Dark Skippy

These steps help you verify that your hardware wallet has not been compromised by a Dark Skippy-style firmware attack, and establish ongoing protection practices.

Step 1: Verify your device’s provenance. Check your purchase records to confirm you bought new from the maker’s own store (or, where the maker does not deliver, from a reseller listed on its website that our advisories have not flagged). If the device came from a marketplace (Amazon, eBay, Craigslist, even listings labelled “official store”) or second-hand, treat it as suspect, move any funds to a seed made on a device bought from the maker, and stop using it. Inspect the packaging for signs of tampering — broken seals, misaligned holographic stickers, or repackaged materials. Coldcard devices include a tamper-evident bag with a unique serial number that can be verified against manufacture records.

Step 2: Verify firmware authenticity. Before trusting any wallet with funds, confirm the firmware is legitimate. On Coldcard: before installing an update, check the PGP signature on signatures.txt and that the firmware file’s SHA-256 hash matches the one it lists (coldcard.com/docs/upgrade shows how); then Advanced/Tools > Upgrade Firmware > Show Version confirms the installed version, and the green GENUINE light should be on. On Trezor: open Trezor Suite, connect the device, and check the firmware version under Device Settings — the Suite automatically verifies signatures. On Ledger: open Ledger Wallet (formerly Ledger Live) and run its Genuine Check.

Step 3: Generate a fresh seed on verified firmware. If you doubt the device itself (it arrived already set up, its seals were broken, or it came from a marketplace or second-hand), do not reset it and carry on: a reset cannot remove an added chip, and the implant Ledger confirmed in October 2026 copied the words during setup. Stop using it, contact the maker through its own website for a check or a replacement, and make your seed on a device you trust. If the device itself is sound and you doubt only the seed, move any funds first and confirm they arrived, then factory reset the device and generate a new seed phrase. On Coldcard, navigate to Advanced/Tools > Danger Zone > Seed Functions > Destroy Seed. On Trezor, use Device Settings > Wipe Device. Never import a seed from a potentially compromised device into a new one — always generate fresh entropy. On a Coldcard Mk4, Mk5 or Q, current firmware makes you add your own randomness (dice, coin flips or key presses) before it creates a seed; on a Mk2 or Mk3, firmware 4.2.0 fixes the normal setup and dice are optional. If a Coldcard made your seed on older firmware, read our Coldcard advisory first.

Step 4: Test with a small transaction before loading funds. After setup, send a small amount of Bitcoin to the wallet, then spend from it. This confirms the device can sign valid transactions. While this does not directly detect biased nonces (that requires cryptographic analysis), it verifies basic operation and gives you a signed transaction you could later analyze with specialized tools if a vulnerability is disclosed.

Step 5: Implement ongoing monitoring. Subscribe to your hardware wallet manufacturer’s security advisory channels — email lists, RSS feeds, or verified social media accounts. When a vulnerability is disclosed, the manufacturer will typically release a firmware update within days. Apply security patches promptly. For high-value holdings, consider monitoring Bitcoin security research outlets like the Bitcoin-dev mailing list and security-focused Bitcoin podcasts.

Warning: If a Dark Skippy or similar nonce vulnerability is publicly disclosed for your device’s firmware version, move your funds immediately. Do not wait for a firmware update — the attack can extract your seed from transactions already on the blockchain. Generate a new seed on a verified device (or a different manufacturer’s device) and transfer all funds before the attacker can act.

A row of blocks on the blockchain with a marker where the firmware is updated. Before it, two of your transactions signed by the bad firmware, each leaking part of your seed; they stay on the blockchain for good, and the attacker can read them at any time and work out your seed. After the update, your new signatures use clean nonces but come from a seed that already leaked. Two choices: update and keep the seed, and the coins stay on a seed the attacker already has; or make new words on a device you trust, send every coin there in a normal transaction and never type the old words into it. An update fixes the next signatures, not the ones already made. — **A firmware update can’t take back signatures already on the blockchain.** If bad firmware ever signed for you, treat the seed as leaked: make a new one on a device you trust and move every coin to it.

Common Mistakes to Avoid

Assuming “verified” firmware means permanent safety. Firmware verification confirms the software at the time of verification. It does not protect against future supply chain attacks if the device is physically accessed later, nor does it account for undiscovered vulnerabilities in the verified firmware itself. Treat verification as a snapshot, not a permanent guarantee.

Ignoring firmware updates because “it’s working fine.” Unpatched firmware with known vulnerabilities is an active risk. The Dark Skippy attack demonstrates that a firmware-level exploit can silently extract your seed over time. Each transaction you sign with vulnerable firmware potentially leaks information. Update promptly when security patches are released.

Using a single hardware wallet for all Bitcoin holdings. A single point of failure means a single Dark Skippy-style attack compromises everything. Distribute holdings across multiple wallets from different manufacturers. A 2-of-3 multisig setup using devices from Coldcard, Trezor, and BitBox02 ensures that even if one manufacturer’s firmware is compromised, your funds remain safe.

Buying from anyone but the maker to save money. The discount is not worth the risk. A tampered device sold at a slight markdown can steal everything you ever store on it. The $50-200 you might save on a marketplace, a second-hand listing or a reseller is small next to what you could lose. Buy new from the maker’s own store.

Frequently Asked Questions

Can Dark Skippy steal my Bitcoin without me noticing?

Yes. That is what makes it particularly dangerous. The compromised firmware produces valid-looking transactions with biased nonces. The Bitcoin moves as expected, and the transaction appears normal on the blockchain. The attacker silently collects signed transactions from the public blockchain and mathematically extracts the master seed after observing as few as two signatures, which can both come from a single transaction. You would not know anything was wrong until the attacker sweeps all funds.

Does a BIP39 passphrase protect against Dark Skippy?

Not fully. While a passphrase adds complexity, the Dark Skippy attack operates at the nonce generation level during transaction signing. Malicious firmware also sees the passphrase when you type it on the device, so a compromised device can leak it too. A passphrase provides better protection against physical seed theft than against firmware-level nonce manipulation. Do not rely on a passphrase alone as a defense against compromised firmware.

Which hardware wallets are immune to Dark Skippy?

No device is immune just because of its brand or its secure chip: if the firmware is compromised, it can hide your seed in the random nonce of each signature, because every Bitcoin signature (ECDSA or Schnorr) uses one. Wallets with public firmware (such as Trezor, BitBox02, Jade and Coldcard) allow community auditing that makes hidden nonce manipulation harder to introduce. Anti-exfil signing, offered by the BitBox02 and Blockstream Jade, closes this channel: your computer adds its own random data to each signature and checks that the device used it, so even compromised firmware cannot hide data in the nonce. As of November 2026 it does not yet cover Taproot addresses (those starting bc1p), your wallet app has to run the check over USB or Bluetooth, and a Jade signing by QR code does not use it. The computer or phone running the app must not be compromised too.

Should I stop using my hardware wallet because of Dark Skippy?

No. Dark Skippy requires the firmware to be compromised first — it is not a remote attack. If you bought your device directly from the manufacturer, run verified firmware, and keep it updated, your risk is extremely low. The attack is primarily a concern for devices obtained through untrusted supply chains or those running outdated firmware. Hardware wallets remain the most secure method of storing Bitcoin private keys.

Related Resources

Part of our free Bitcoin course: This topic is covered in Hardware Wallets Explained: How Cold Wallets Protect Your Bitcoin, from the Bitcoin Wallets & Self-Custody course.

Filed under: Bitcoin Security