Secure Element

Anna loses her hardware wallet. A thief need not just try PINs: they might take the device apart and try to read its memory. A Secure Element is designed to make access to protected data follow defined rules and to make physical interference harder. Resistance is always assessed against particular attacks and attacker capabilities. A side channel can mean inferring a secret from power consumption or computation time; fault injection deliberately causes an error in a computation. These are different situations from typing a password on a screen. The chip should increase the effort and cost required, not promise invulnerability in every circumstance. [1] [2]

A Private Key is a secret numerical value that a wallet uses to create a digital signature authorizing bitcoin to be spent. Some designs can store and use that key directly in a security chip. Others store an auxiliary secret that unlocks protected data elsewhere. A Secure Element may also count attempts or hold a certificate for device verification. So “the key never leaves the chip” needs a follow-up: which key, in which model? The main microcontroller is the processor running the rest of the device; adding another chip does not remove its role. The same label on a box therefore does not imply the same protection. [1] [3] [5]

Trezor’s documentation says Safe 3 and Safe 5 use OPTIGA Trust M (V3). It holds an auxiliary secret that, together with the user’s PIN, protects private keys stored on the main chip. That relationship is intended to make attacking a stolen device harder. It does not describe all Bitcoin signatures being created inside the Secure Element. The manufacturer also lists hardware attempt limits, authenticity checks and a contribution to randomness when a wallet is created. Here randomness supplies unpredictable values for keys. This describes those particular models, not a universal design for every hardware wallet. [1]

Suppose Anna loses the paper containing her Seed Phrase, the recovery words, instead of the device. Anyone obtaining all the information needed for recovery can restore the wallet elsewhere; the original chip’s protection and PIN do not prevent that. Similarly, the chip alone cannot tell that Anna is approving a scammer’s address rather than her intended recipient. Safe backup storage, checking the entire address and amount on a trusted display, and the firmware—the program inside the device—still matter. Even Air-Gapped Wallet, a wallet with no direct network connection in the procedure concerned, does not itself describe chip resistance. Separating data transfer and resisting physical attacks address different parts of the problem. [1] [4]

Device attestation checks a device’s authenticity using its certificate and response to a verification challenge. Within the protocol’s limits it can establish a connection to the manufacturer, but it cannot say whom you want to pay. If a compromised computer offers a different address, a successful device authenticity check will not change it back. Device verification, firmware checks and your approval of a particular payment are therefore separate steps. A beginner need not know the cryptographic details of certificates, but should understand which question the application’s green checkmark is answering. [1] [4]

Common Criteria is a framework for evaluating a defined target against specified security requirements. A chip’s EAL6+ level does not mean the entire device, its display or every future firmware version was evaluated in the same way. A Protection Profile describes required security properties for a defined product type and configurations. For example, GlobalPlatform published version 2.0 of this profile in July 2025, aligned with CC:2022. These abbreviations become useful alongside a specific certificate: what was evaluated, in which configuration, and against which threats? A higher number in an advertisement does not answer those questions by itself. [2] [1]

Tropic Square publishes design materials for TROPIC01. They include RTL, a machine-readable description of digital circuit behavior, application firmware and security architecture. The chip uses a core with the RISC-V instruction set and a SPECT auxiliary processor for cryptographic operations. At this review, however, the repository also lists an unpublished bootloader, the program that starts the firmware, because of IP providers’ rights. Here IP means licensed design components, not an internet address. Openness allows examination of the specific published parts. It does not automatically prove a bug-free design or that every manufactured unit matches it. [3]

Trezor describes a January 2026 finding by Ledger Donjon on a separately tested TROPIC01. Laser fault injection—causing a fault with a laser in laboratory conditions—bypassed firmware verification and exposed that chip’s secrets. It required physical access and specialized equipment. According to the published impact analysis, this was one protective layer in Safe 7; OPTIGA and STM32U5 provide others. The finding alone does not establish a compromise of the whole device. It is nevertheless a real vulnerability, not something to dismiss with “unbreakable.” The manufacturer says the hardware cause of this particular issue cannot be fixed remotely through a firmware update. A sound assessment therefore considers the exact model, the scope of the flaw and the manufacturer’s response, not merely the presence of a security chip. [4]