BITFI You Wouldnt Steal My Cloins

Andrew T delivers a humorous yet technically rigorous teardown of the Bitfi cryptocurrency hardware wallet, a device famously marketed by John McAfee as "completely unhackable" alongside a $250,000 bounty. The talk chronicles how an independent research team analyzed the hardware and dismantled the company's security assertions.

[05:47] An immediate physical inspection reveals that the Bitfi is not custom cryptographic hardware, but rather an inexpensive, repurposed MediaTek Android smartphone stripped of cellular components. Andrew T explains how researchers established communication with the device via exposed serial connections and ADB interfaces, swiftly obtaining root privileges without triggering any hardware tamper mechanisms or defensive wipe routines.

[13:58] The presentation examines Bitfi's "brain-wallet" design, which purported to eliminate cold storage vulnerabilities by recalculating private keys on the fly using a user passphrase and salt. By analyzing RAM during transaction signing and defeating the key-derivation routine, researchers demonstrated full extraction of passphrases, salts, and private keys. The talk concludes with a review of the vendor's controversial responses, public bounty disputes, and the essential security principles—such as secure boot, hardware security modules (HSMs), and transparent threat modeling—absent in the product's design.

(AI summary — Gemini Flash)