Hardware Wallet Side-Channel Attacks: Power and EM Risks

By DeFi Intel Research · Reviewed 2026-07-02 · 9 min read · advanced

Hardware wallet side-channel attacks represent a sophisticated threat that bypasses conventional security by analyzing physical emissions—specifically power consumption and electromagnetic radiation—during cryptographic operations. Unlike brute-force or malware-based attacks, these side-channel techniques do not require breaking encryption mathematically; instead, they monitor the device's physical behavior to infer secret data such as private keys, PINs, or seed phrases. For advanced users managing significant crypto assets, understanding how power analysis and EM attacks work is essential to selecting and configuring hardware wallets with robust countermeasures.

Power analysis and electromagnetic emission attacks are particularly dangerous because they can be performed with relatively affordable equipment (e.g., an oscilloscope, near-field probe, and software) and do not leave traces on the device. Researchers have demonstrated successful key recovery from popular hardware wallets like Trezor and Ledger by capturing power traces during ECDSA signing or AES encryption. While manufacturers have implemented defenses—secure elements, masking, shuffling, and Faraday shielding—the efficacy varies widely. This guide provides an in-depth technical examination of the threat model, real-world attack examples, and actionable evaluation criteria for advanced users.

Understanding Side-Channel Attacks on Hardware Wallets

A side-channel attack exploits unintentional information leakage from a physical system. In hardware wallets, the two most prominent channels are power consumption and electromagnetic (EM) emissions. Every cryptographic operation—whether it's hashing a seed, deriving a key, or signing a transaction—causes characteristic fluctuations in current draw and radiated EM fields. By precisely measuring these signals, an attacker can deduce intermediate values, and eventually, the secret key itself.

Key concepts include:

• Leakage model: The relationship between processed data (e.g., key bits) and physical observation (e.g., power trace). The Hamming weight or Hamming distance of data often correlates with power consumption.
• Trace capture: Using a high-speed oscilloscope (e.g., 1 GS/s) and a small resistor in series with power supply, or an EM probe placed near the chip's decoupling capacitors.
• Signal processing: Alignment, filtering, and statistical averaging to reduce noise and extract subtle correlations.

“Side-channel attacks are non-invasive or semi-invasive—they require no physical alteration of the device, making them stealthy and repeatable.”

Power Analysis: The Core Threat

Power analysis is the most studied side-channel technique for hardware wallets. It relies on the fact that CMOS logic gates draw current only when switching, and the amount of current depends on the data being processed. Two main variants exist: Simple Power Analysis (SPA) and Differential Power Analysis (DPA).

SPA involves visually inspecting a single power trace to identify operation sequences. For example, during RSA exponentiation, the square-and-multiply pattern reveals whether a key bit is 0 or 1. In ECDSA, the nonce generation loop’s timing and power profile can leak bits of the ephemeral key. DPA, pioneered by Kocher et al., uses statistical methods over many traces to extract small biases correlated with fixed secret data. Here’s a comparison of the two:

Simple Power Analysis (SPA) – Pattern Recognition

In SPA, the attacker directly interprets power trace features. For instance, the squaring and multiplication steps in RSA modular exponentiation produce distinct power patterns: squaring is often more power-hungry than multiplication. If the multiplication is executed only when the key bit is ‘1’, an attacker can read the entire private key from a single trace. Similarly, in ECDSA, the double-and-add loop is targetable. Many older hardware wallets without SPA countermeasures are vulnerable to this kind of low-cost attack.

Concrete example: security researchers have shown power side-channel weaknesses on older Trezor One devices, which lack a dedicated secure element and run cryptographic operations on a general-purpose microcontroller. In response, Trezor firmware added countermeasures such as random delays and operation shuffling to mitigate SPA-style leakage.

Differential Power Analysis (DPA) – Statistical Extraction

DPA goes a step further by statistically correlating many traces with a hypothesized key model. The attacker guesses a small subkey (e.g., one byte of AES key), divides traces into two sets based on a predicted bit (e.g., the LSB of the output after S-box), and computes the difference-of-means. If the guess is correct, the difference trace shows a sharp spike at the time the S-box output was processed. Correlation Power Analysis (CPA) is a refined version that uses Pearson correlation coefficients for higher efficiency.

Hardware wallets that lack proper masking are vulnerable to DPA/CPA. Implementations that perform ECDSA nonce handling on a general-purpose microcontroller without hardware-level masking are especially exposed, because repeated signing operations can supply an attacker with the large number of traces DPA requires. This is a key reason vendors like Ledger rely on dedicated secure elements with certified side-channel resistance (e.g., the ST33 series with masking and constant-time execution).

Electromagnetic (EM) Side-Channel Attacks

EM attacks exploit the magnetic field fluctuations radiated by current flowing through wires and chip internals. Unlike power analysis, EM probes can be placed near specific parts of the chip (e.g., the I/O bus, the crypto core) to isolate leakage from a single component, reducing noise. Attackers often use a near-field probe (e.g., Langer RF-R 3-2) connected to a low-noise amplifier and an oscilloscope with bandwidth up to 1–2 GHz. The capture setup is more finicky but can achieve signal-to-noise ratios superior to power analysis.

EM side-channel attacks are especially relevant for hardware wallets because the device may be operational while the user enters their PIN or during transaction signing. In 2019, the Ledger Donjon team published a side-channel attack on the Trezor One that recovered the device PIN by capturing power and electromagnetic traces during PIN verification. An attacker with physical possession of a stolen device could reconstruct the full PIN within minutes; Trezor mitigated it in a March 2019 firmware update. The research highlighted that even without permanently opening the device, an attacker with physical access could extract sensitive data.

“EM attacks are often the preferred vector for advanced adversaries because they can be performed through some enclosures and allow spatial resolution of individual chip blocks.”

Real-World Attack Examples and Research

Several high-profile studies have shown the practicality of side-channel attacks on hardware wallets:

• Power side-channel on Trezor – researchers have shown that the STM32 general-purpose microcontroller used in the Trezor One can leak key-dependent information during signing, with traces captured from the device's power line.
• Side-channel PIN recovery on KeepKey – researchers demonstrated recovery of the device PIN by measuring power/emissions during PIN verification, without opening the enclosure.
• Secure-element leakage studies – template and profiling attacks against secure-element crypto chips (such as the Microchip ATECC family used in some wallets) have been studied, showing that even dedicated crypto chips can leak during operations like nonce generation if not adequately protected.
• Wireless interfaces as an EM concern – wallets with Bluetooth (e.g., the Ledger Nano X) add a radio interface that researchers examine as a potential EM side channel. Note that in Ledger's design the private keys remain inside the secure element and are never transmitted over Bluetooth.

These examples underscore that no hardware wallet is immune; the degree of vulnerability depends on the specific chip, firmware version, and implementation of countermeasures.

Countermeasures – How Hardware Wallets Defend

Modern hardware wallets employ a layered set of defenses against side-channel attacks:

• Shielding: Physical enclosures with conductive paint or metal layers (e.g., Faraday cages) to block EM emissions. Coldcard’s metal body acts as an effective EM shield.
• Secure elements (SE): Dedicated chips like the ST33K1M5A (Ledger) or Microchip ATECC608A (Coldcard) are designed with hardware-level masking, dual-rail logic, and noise injection that break the correlation between data and power/EM.
• Constant-time execution: Removing conditional branches based on secret data prevents timing and SPA leaks. For example, using Montgomery ladder for ECDSA instead of double-and-add.
• Masking: Splitting every intermediate value into random shares so that power consumption depends only on the shares, not the real secret. Typically implemented in hardware on the secure element.
• Shuffling and random delays: Randomizing the order of operations (e.g., shuffling AES rounds) and inserting random dummy cycles to obscure the temporal structure.
• Voltage regulation and filtering: On-board voltage regulators and decoupling capacitors smooth out power consumption variations, making external measurements harder.

Users should verify that their wallet’s secure element is certified against side-channel attacks (e.g., Common Criteria EAL5+ or FIPS 140-2 Level 3).

Comparative Analysis of Attack Vectors

This table illustrates that while powerful, side-channel attacks are not trivial. The cost and complexity increase with advanced methods, but even low-cost SPA poses a risk to poorly protected wallets.

Best Practices for Advanced Users

To minimize exposure to hardware wallet side-channel attacks, consider the following:

• Choose a wallet with certified secure element. Models like Ledger Nano X, Coldcard Mk4, and Trezor Safe 5 incorporate certified SEs with side-channel resistance.
• Use physical shielding. Keep the wallet in a metal enclosure (e.g., an empty mint tin or a commercial Faraday bag) when not in use. This reduces EM leakage range.
• Minimize physical access. Never leave the wallet unattended in public. Side-channel attacks require close proximity (a few centimeters for EM, direct connection for power).
• Update firmware regularly. Manufacturers like Ledger and Trezor regularly patch side-channel vulnerabilities through updated constant-time implementations and shuffling.
• Beware of modified USB cables. Attackers can inject resets or insert shunt resistors. Use only official cables or verify with a multimeter.
• Consider a dedicated offline signing environment. For high-value transactions, use an air-gapped wallet (e.g., Coldcard) with QR code or SD card communication to break the electrical contact entirely.

Future Directions in Side-Channel Security

As hardware wallets evolve, so do attack techniques. Deep learning–based side-channel analysis (DL-SCA) has shown that neural networks can automatically extract features from traces, often bypassing traditional countermeasures like masking. Researchers have successfully applied CNNs to recover AES keys from masked implementations with only a few thousand traces.

In response, wallet manufacturers are exploring physical unclonable functions (PUFs) that generate keys from unique chip variations, making power traces non-replicable. Another promising approach is randomizing the clock frequency (clock jitter) to desynchronize trace alignment, a known bane of statistical attacks. The tension between usability (fast signing) and side-channel resistance (random delays) will continue to shape the market. Advanced users should stay informed by following academic conferences like CHES and securing their digital assets with multiple layers of defense.

Common mistakes to avoid

• Assuming a hardware wallet is automatically immune to side-channel attacks just because it has a secure element.
• Using the wallet while plugged into a public USB charger, which can serve as a power analysis probe point.
• Storing the wallet near other electronic devices that introduce EM noise, making signal analysis harder but also masking leaks unpredictably.
• Relying solely on password protection or PIN without checking if the implementation leaks timing or power during verification.
• Failing to update firmware after side-channel vulnerability disclosures, leaving known exploits unpatched.
• Believing that a Faraday bag for the whole wallet prevents all EM attacks—the bag must be complete and its shielding effective against the specific frequency bands used by the crypto operations.

Frequently asked questions

Related reading

• How To Protect Hardware Wallet Supply Chain
• How To Secure Browser Wallet Extensions
• How To Secure Crypto Social Recovery Wallet
• How To Use Burner Wallet High Risk DEFI
• How To Use Hardware Wallet DEFI
• How To Use Hardware Wallet Passphrases Advanced
• Secure Your Crypto Multifactor Hardware
• Sandwich Attack