Conclusion

Cryptography is hard. There exist people with full-time jobs, who are dedicated to breaking your cryptography. Enter Ledger Donjon.

Recent vulnerabilities discovered and responsibly disclosed by Ledger Donjon:

• ​Seed extraction on HTC Exodus 1.

• ​Side Channel Attack on Trezor One PIN.

• ​Seed extraction from Ellipal wallet.

• ​Unfixable Seed Extraction on Trezor.

• ​Multiple vulnerabilities on a vendor Hardware Security Module (HSM).

Gratitude list:

• ​Charles Guillemet, CTO @ Ledger

• ​Jean-Baptiste Bédrune, Head of Security Research @ Ledger

• ​Victor Servant, Security Engineer @ Ledger

Bonus:

• Pure Python Elliptic Curve library by Cedric Mesnil (co-founder @ Ledger): http://cslashm.github.io/ECPy​

• ​Ledger Donjon blog.