Wallets have
fingerprints too
A demo of a "pseudo-malicious" app;
See what a webpage can learn about a connected hardware wallet over WebHID / WebUSB.
No on-device prompts / taps / notifications disclosing the leak!
Some device APIs are unavailable in this browser. For full functionality, open this page in desktop Chrome, Edge, or Opera over HTTPS or localhost.
Connect a device
Automatically re-scan granted devices on load, connection, and every 3 seconds.
Send 1 "NOP" WebHID req. / 1 sec. to interfere with other wallet apps.
Device intelligence
Passive fingerprint
|
USB descriptors reveal common information about the wallet. |
Active fingerprint
|
Read-only queries reveal what’s running. |
Eavesdropped account data
ADDRESSESLedger · Ethereum app
getAddress e0 02 00 00 (P1=0) → an account address, without confirmation prompts.
Patterns:
0x9000+ 40 ASCII hex chars → this address is in the wallet;getAppConfiguratione0 06→ the app's settings (blind-signing on/off, ERC-20, Starknet)
Ledger · Bitcoin app
- Legacy app (CLA e0): getWalletPublicKey (P1=0) → account xpub/zpub + chain code;
- New app 2.x (CLA e1): GET_MASTER_FINGERPRINT +
GET_EXTENDED_PUBKEY (display=0)
Patterns:
- 1 extended key → past & future addresses, balance and history;
- Receive addresses are derived from device-provided leaf pubkeys (
hash160 + bech32 / base58check)
Ledger · some other apps
Each app exposes getAddress/getPubkey (P1/display=0) - yes, without confirmation prompts :
- Solana (
e0 05) →base58(ed25519 key); - Tron (
e0 02) → Base58Check T-address; - XRP (
e0 02) → r-address (derived Client-side); - Hyperliquid → reuses the EVM
e0 02address; - USDC has no address of its own — it rides the ETH/SOL/TRX address (ERC-20 / SPL / TRC-20);
- TON/GRAM returns the ed25519 pubkey; its address needs the wallet-contract, shown as experimental.
Ledger · dashboard (BOLOS)
GET_APP_AND_VERSIONb0 01→ which app is open + whether the device is unlocked;getDeviceInfoe0 01→ firmware, MCU,targetId→ exact model;e0 10→ battery % (Stax/Flex).- A status word:
0x5515=locked,0x6985=a confirmation was required/declined.
Trezor · GetFeatures (WebUSB)
GetFeatures → device name (label), language, model, firmware, device_id (a stable cross-app tracker) & PIN/passphrase settings (!).
What this thing CAN NOT see
- PIN / button presses: handled securely, never streamed to the "host" device;
- Account names: Ledger / Trezor store these names in Ledger Live / Trezor Suite metadata off-device;
- Pending operations / Statuses of inactive apps: requests / responses are handled within a "1-host" session, so this app cannot keep "watching" while another operation takes place (this is the exact behaviour the "Spam mode" relies on)
|
Discovered addresses and device details will appear here. |