CVE-2025-69893 Trezor CVE debrief

Who should care

Users of Trezor One, Trezor T, and Trezor Safe hardware wallets should verify their device versions and update to a patched version if necessary. Additionally, operators of these devices, platform administrators, and security teams should be aware of the vulnerability and take appropriate measures to mitigate the risk. This includes reviewing device configurations, monitoring for suspicious activity, and ensuring that all necessary security updates are applied. The vulnerability's impact is significant because it could lead to asset theft if exploited.

Technical summary

The vulnerability exists in the BIP-39 mnemonic processing implementation. An attacker with physical access during the initial setup phase can collect a single side-channel trace. By utilizing profiling-based Deep Learning Side-Channel Analysis (DL-SCA), the attacker can recover the mnemonic code and subsequently steal the assets. This issue is particularly concerning because it affects multiple Trezor hardware wallet models, including Trezor One, Trezor T, and Trezor Safe, across specific version ranges. The exploitation of this vulnerability requires physical access to the device during the initial setup phase, making it a localized threat. However, the potential impact is significant as an attacker could gain unauthorized access to the mnemonic code, leading to asset theft.

Defensive priority

Medium priority due to the requirement of physical access and specific conditions for exploitation. However, given the potential impact of asset theft, it is crucial to address this vulnerability promptly.

Recommended defensive actions

• Verify device versions and update to a patched version if necessary
• Use secure practices when setting up and using hardware wallets
• Monitor for any suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The issue was patched. The CVE record was published on 2026-04-14T15:16:25.357Z and last modified on 2026-07-05T02:17:37.393Z. Evidence is based on the BIP-39 standard guidelines and side-channel analysis techniques. The vulnerability was observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. Defenders should verify device versions and update to a patched version if necessary. The CVE record and NVD detail page provide additional context for understanding the vulnerability.

Official resources