Would a Trezor passphrase have mitigated the Ledger supply-chain attack?
Following the reported supply-chain attack on Ledger devices sold by a third-party reseller in Southeast Asia, I've been thinking about whether a Trezor with a passphrase (the "25th word") would have been protected.
According to current reports, a hidden implant captured the recovery words as they were displayed on the device screen during setup and passed them to the attackers. If that's accurate, here is my reasoning:
- On the Trezor Model One and Safe 3, the passphrase can only be entered in Trezor Suite on the computer. It is never shown on the device screen.
- The touchscreen models (Model T, Safe 5, Safe 7) can take it on the device, but that is optional.
- So a screen-capturing implant could get the seed but not the passphrase, and the attacker would only be able to rebuild the empty default wallet.
- A keylogger or malware on the computer could capture the passphrase, but without the seed that alone doesn't put funds at risk, and the reverse is also true. An attacker needs both.
Given this, is it fair to say Trezor's passphrase implementation is more secure than Ledger's against this kind of attack, or am I missing something?
Stay safe everyone 🙏.