{"id":137902,"date":"2026-08-01T18:37:51","date_gmt":"2026-08-01T11:37:51","guid":{"rendered":"https:\/\/bitcoinvn.io\/insights\/?p=137902"},"modified":"2026-08-01T18:37:51","modified_gmt":"2026-08-01T11:37:51","slug":"dark-skippy-revisited","status":"publish","type":"post","link":"https:\/\/bitcoinvn.io\/insights\/dark-skippy-revisited\/","title":{"rendered":"Dark Skippy Revisited: What the Hardware-Wallet Attack Taught Us\u00a0"},"content":{"rendered":"

In 2024, security researchers demonstrated Dark Skippy\u2014a malicious-signer attack capable of leaking a Bitcoin wallet\u2019s seed through as few as two transaction signatures. At the time of disclosure, the researchers were not aware of Dark Skippy being used in the wild. The research instead demonstrated how devastating compromised signing firmware could be. This retrospective examines how Dark Skippy worked, why it mattered, and what lasting security lessons users and wallet manufacturers can take from the Dark Skippy disclosure.\u00a0<\/span><\/i><\/p>\n

What is Dark Skippy?<\/b><\/h2>\n

Dark Skippy is a malicious-signer attack disclosed in 2024. It is not a vulnerability in one particular hardware-wallet model. Instead, it assumes that a signing device is already running malicious firmware – for example after tampering, a supply-chain compromise or the installation of a fraudulent firmware update.\u00a0<\/span><\/p>\n

The danger lies in the fact that malicious firmware can exploit the signing process to secretly leak a user\u2019s seed phrase. Instead of generating truly random values, an infected device embeds fragments of the seed phrase into transaction signatures. Once broadcast to the blockchain as valid transactions, these signatures can be collected and analyzed to reconstruct the entire seed phrase.<\/span><\/p>\n

In the researchers\u2019 demonstration, two signatures were enough to recover the entropy behind a 12-word recovery phrase using Pollard\u2019s kangaroo algorithm.\u00a0<\/span><\/p>\n

How Dark Skippy works<\/b><\/h2>\n

Dark Skippy is a method by which a malicious Bitcoin signing device could covertly leak a user\u2019s wallet seed. Publicly disclosed in 2024, it is not a vulnerability in any particular hardware wallet or manufacturer. The attack assumes that the device is already running malicious firmware – whether through tampering, a compromised supply chain or the installation of a fraudulent firmware update.<\/span><\/p>\n

The malicious firmware manipulates the secret nonces used when signing transactions, encoding fragments of the wallet\u2019s seed entropy into otherwise valid signatures. The attacker can identify these signatures as they are relayed across the Bitcoin network or recorded on the blockchain and then extract the concealed information.<\/span><\/p>\n

\"\"<\/p>\n

In their proof of concept, the researchers reconstructed the entropy underlying a complete 12-word recovery phrase from only two signatures using Pollard\u2019s kangaroo algorithm. Since a transaction can contain multiple signed inputs, both signatures can be produced in a single transaction. A single use of a compromised signing device could therefore be sufficient to expose the entire wallet.<\/span><\/p>\n

How dang<\/b>erous is Dark Skippy?<\/b><\/h2>\n

Dark Skippy is particularly serious because keeping a hardware wallet offline does not prevent the attack once the device has been compromised.<\/span><\/p>\n

An air-gapped wallet has no direct internet connection. However, its signed transactions must still be transferred – such as by QR code, memory card or USB – to an online device for broadcasting. Malicious firmware can hide fragments of the wallet seed inside those signatures, allowing the concealed information to leave the device without any separate internet connection.<\/span><\/p>\n

To the user, the signatures appear normal and remain cryptographically valid. An attacker can identify the affected signatures after they reach the Bitcoin network and use them to reconstruct the hidden information. This makes the attack extremely difficult for an ordinary user to detect.<\/span><\/p>\n

In their demonstration, the researchers reconstructed a complete 12-word recovery phrase from only two signatures, which could potentially be included in a single transaction. This efficiency is what made Dark Skippy an important development in malicious-signer attacks.<\/span><\/p>\n

\"Reduce
Reduce the risk of receiving a tampered device by purchasing hardware wallets directly from the manufacturer or an authorized reseller<\/a><\/figcaption><\/figure>\n

However, Dark Skippy cannot remotely infect an otherwise genuine and secure hardware wallet. The attacker must first compromise the device – for example through physical tampering, malicious firmware or a compromised supply chain. A genuine device running honest firmware will not perform the attack.<\/span><\/p>\n

\"xPub:
xPub: information used to generate receiving addresses. Nonce: a one-time value used when signing a transaction<\/figcaption><\/figure>\n

Solutions from manufacturers to prevent Dark Skippy<\/b><\/h2>\n

Hardware-wallet manufacturers can reduce the risk by making devices harder to tamper with – and by limiting what compromised devices can hide inside transactions.<\/span><\/p>\n