In 2024, security researchers demonstrated Dark Skippy—a malicious-signer attack capable of leaking a Bitcoin wallet’s seed through as few as two transaction signatures. At the time of disclosure, the researchers were not aware of Dark Skippy being used in the wild. The research instead demonstrated how devastating compromised signing firmware could be. This retrospective examines how Dark Skippy worked, why it mattered, and what lasting security lessons users and wallet manufacturers can take from the Dark Skippy disclosure.
What is Dark Skippy?
Dark Skippy is a malicious-signer attack disclosed in 2024. It is not a vulnerability in one particular hardware-wallet model. Instead, it assumes that a signing device is already running malicious firmware – for example after tampering, a supply-chain compromise or the installation of a fraudulent firmware update.
The danger lies in the fact that malicious firmware can exploit the signing process to secretly leak a user’s seed phrase. Instead of generating truly random values, an infected device embeds fragments of the seed phrase into transaction signatures. Once broadcast to the blockchain as valid transactions, these signatures can be collected and analyzed to reconstruct the entire seed phrase.
In the researchers’ demonstration, two signatures were enough to recover the entropy behind a 12-word recovery phrase using Pollard’s kangaroo algorithm.
How Dark Skippy works
Dark Skippy is a method by which a malicious Bitcoin signing device could covertly leak a user’s wallet seed. Publicly disclosed in 2024, it is not a vulnerability in any particular hardware wallet or manufacturer. The attack assumes that the device is already running malicious firmware – whether through tampering, a compromised supply chain or the installation of a fraudulent firmware update.
The malicious firmware manipulates the secret nonces used when signing transactions, encoding fragments of the wallet’s seed entropy into otherwise valid signatures. The attacker can identify these signatures as they are relayed across the Bitcoin network or recorded on the blockchain and then extract the concealed information.
In their proof of concept, the researchers reconstructed the entropy underlying a complete 12-word recovery phrase from only two signatures using Pollard’s kangaroo algorithm. Since a transaction can contain multiple signed inputs, both signatures can be produced in a single transaction. A single use of a compromised signing device could therefore be sufficient to expose the entire wallet.
How dangerous is Dark Skippy?
Dark Skippy is particularly serious because keeping a hardware wallet offline does not prevent the attack once the device has been compromised.
An air-gapped wallet has no direct internet connection. However, its signed transactions must still be transferred – such as by QR code, memory card or USB – to an online device for broadcasting. Malicious firmware can hide fragments of the wallet seed inside those signatures, allowing the concealed information to leave the device without any separate internet connection.
To the user, the signatures appear normal and remain cryptographically valid. An attacker can identify the affected signatures after they reach the Bitcoin network and use them to reconstruct the hidden information. This makes the attack extremely difficult for an ordinary user to detect.
In their demonstration, the researchers reconstructed a complete 12-word recovery phrase from only two signatures, which could potentially be included in a single transaction. This efficiency is what made Dark Skippy an important development in malicious-signer attacks.
However, Dark Skippy cannot remotely infect an otherwise genuine and secure hardware wallet. The attacker must first compromise the device – for example through physical tampering, malicious firmware or a compromised supply chain. A genuine device running honest firmware will not perform the attack.
Solutions from manufacturers to prevent Dark Skippy
Hardware-wallet manufacturers can reduce the risk by making devices harder to tamper with – and by limiting what compromised devices can hide inside transactions.
- Block unofficial firmware: Devices should only run properly verified software and should have their factory-access ports locked before sale.
- Make firmware verifiable: Signed and openly checkable firmware helps independent experts confirm that wallet software has not been secretly modified.
- Protect devices before delivery: Secure distribution, authenticity checks and tamper-evident packaging make it harder to sell customers modified devices.
- Add anti-exfil protection: The hardware wallet and accompanying app can work together when signing transactions, preventing the device from secretly manipulating signatures to leak the recovery phrase.
Some hardware wallets add anti-exfil protection. For example, Blockstream Jade and Jade Plus can use compatible wallet software to help prevent a compromised device from hiding secrets inside certain transaction signatures. However, protection depends on the connection method, wallet software and type of Bitcoin transaction used.
How can you reduce the risk of Dark Skippy?
- Buy from a trusted source: Purchase directly from the manufacturer or an authorized reseller. Avoid used or preconfigured hardware wallets, and do not use it if the packaging or device shows signs of tampering.
- Set up the wallet yourself: A new device should ask you to create a new recovery phrase. Never use recovery words supplied inside the box or provided by a seller.
- Use trusted software and official firmware: Download wallet software from its official source and keep your device updated using only manufacturer-approved firmware. Avoid unofficial or experimental firmware on your primary wallet.
- Keep control of your device: Do not lend or share your hardware wallet. If the device has been outside your control and you suspect tampering, do not sign another transaction until you have a safe migration plan using a trusted replacement device.
- For larger holdings, consider multisig: Using separately set-up devices from different manufacturers means one compromised signer is not enough to steal the funds by itself. Multisig adds complexity, so seek help if you are unfamiliar with it.
Conclusion
Dark Skippy demonstrates that even an offline hardware wallet can leak secrets if the device or its firmware has already been compromised. However, it cannot remotely infect an otherwise genuine and secure wallet.
For most users, the practical response is straightforward: buy from a trusted source, set up the wallet yourself, use official software and firmware, and keep control of the device. For larger holdings, properly configured multivendor multisig can prevent one compromised signer from being enough to steal the funds.
