Beware Blockstream Jade Wallet (Patreon)

A popular microcontroller installed in billions of Internet of Things (IoT) devices has a severe bug that is exposing bitcoin (BTC) to theft.

The bug — called Critical Vulnerability Error of 2025 number 27840 (CVE-2025-27840) — affects the popular ESP32 chip and allows hackers to exploit module updates to sign unauthorized transactions or even remotely steal private keys.

ESP32, which is found inside hardware wallets like Blockstream Jade that generate signatures for BTC transactions, also has insufficient entropy in its random number generator, allowing brute force guessing of keypairs by anonymous attackers.

Other wallets impacted are

• Bowser: An open-source hardware wallet project that utilizes the ESP32 chip.

• Colibri: Another open-source project incorporating the ESP32, noted for its use in security-critical environments.

Crypto Deep Tech, a cybersecurity research firm, has already proven its ability to forge transaction signatures using the chip’s flawed message hashing and to extract private keys from the chip.

Indeed, its white hat hackers decrypted the private key of a real wallet containing 10 BTC.

Blockstream deny any issue

Not sure who is telling the truth here but rem it takes a lifetime to make it and a second to lose it so always err the side of caution