- A computer hardware hacker has retrieved $2 million worth of crypto from a Trezor wallet
- The wallet’s owner had lost the pin since 2018 and asked Joe Grand to try and breach it
- Grand took 12 weeks to accomplish the task but managed to do it
A computer hardware hacker has beaten the odds and recovered a Trezor wallet containing $2 million worth of THETA tokens that have been inaccessible since 2018. The hacker, Joe Grand, was contacted by the wallet’s owner Dan Reich who had lost the PIN to the wallet which contained the treasure trove. In a YouTube video describing the incredible 12-week journey the pair went on to regain access to the funds, Grand showed how he went about recovering the wallet’s PIN from the flash memory, a process of trial and error that almost failed on multiple occasions with only one chance of success.
Wallet Hopes Had Long Been Buried
Reich and his friend had bought the THETA tokens in 2017, with their investment reaching $50,000 by the end of the bull run the following year. Unable to cash out their winnings due to losing the security pin to the Trezor One wallet on which they were stored, the pair eventually gave up having used up 12 of the 16 attempts the wallet allowed before it wiped itself.
However, with the price of THETA ballooning in 2021, the pair’s haul hit seven figures, so they redoubled their efforts and contacted Grand to help them.
PIN Still Held in Flash Memory
Grand worked out that older firmware previously installed on the device would have temporarily stored the PIN in the device’s flash memory, and was able to essentially attack the wallet and retrieve it:
After three months of trying, Grand was able to hack the wallet and retrieve the coins for Reich, with Trezor quick to mention that they have since patched the vulnerability that allowed Grand to achieve the impressive feat:
Hi, we just want to add that the vulnerability was already fixed, and all new devices are shipped with a fixed bootloader. Thanks to @saleemrash1d for his security audit. Learn more about our Security approach and responsible disclosure program here👇https://t.co/pyV1Ya6X8b
— Trezor (@Trezor) January 24, 2022
