Architectural Vulnerabilities in Cryptosystems: A Systematic Cryptanalysis of Elliptic Curve Code (ECC) Implementations in Bitcoin Ecosystem Libraries – from Weak Nonces and Library Substitution to Private Key Leaks

Bitcoin’s security fundamentally rests not on the abstract mathematical impenetrability of elliptic curves, but on the quality of software implementations of cryptographic primitives—libraries that implement operations on the secp256k1 curve. It is here, at the boundary between proven mathematics and real code, that the most devastating vulnerabilities have historically arisen: errors in random number generation, incorrect handling of edge cases during point compression, side-channel leaks, and the possibility of deliberate substitution of system components.[ polynonce ]

This study provides a systematic review of critical security incidents in the most widely used cryptographic libraries in the Bitcoin ecosystem: from libsodium and libsecp256k1 to noble-secp256k1 , BitcoinLib , pyecdsa , and Spongy Castle . Each of these libraries, at various times, exhibited vulnerabilities capable of completely compromising a user’s private key.[ polynonce ]

A special place is occupied by a class of attacks that exploit the predictability of ECDSA nonces. The POLYNONCE attack demonstrates that given just four ECDSA signatures in which the nonce $k$ k obeys a polynomial recurrence of degree 128 bits, and it is possible to recover the full 256-bit private key using lattice methods (LLL/BKZ). This is a logical development of the work on the hidden number problem (HNP), first described by researchers at Kudelski Security. [ polynonce ]

No less significant is the Implementation Substitution Attack —an attack that replaces the ECC library. A compromised implementation allows for the creation of counterfeit signatures, forged public keys, and the generation of predictable keys vulnerable to subsequent cryptanalysis, all while remaining undetectable to an outside observer of the blockchain. Simultaneously, side-channel attacks— ChronoForge and Phantom Curve Attack —demonstrate the ability to reduce the effective security from 256 to 64 bits by analyzing timing variations during computations.[ polynonce ]

Taken together, these threats form a multi-layered attack surface: from flaws in point compression algorithms to flaws in language ecosystems through vulnerable dependencies. This study aims not only to catalog known incidents but also to develop a unified threat taxonomy and practical recommendations for developers of Bitcoin wallets, DeFi protocols, and key management systems.[ polynonce ]

Embedded/IIoT devices and network equipment.
Example: HMS Ewon Cosy+ industrial gateways – vulnerability due to hard-coded AES-CBC keys, allowing decryption of sensitive data (passwords, etc.) from backups. Such devices often use AES-CBC with fixed keys and no authentication, and are rarely updated.[ seclists ]
Software crypto libraries and their consumers
Node.js library jose: CVE-2021-29443 vulnerability in the implementation of the AES_CBC_HMAC_SHA2 algorithms (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) due to differences in the timing of padding processing and HMAC tag verification, which creates a padding oracle. Vulnerable software: Any Node.js applications using older versions jose.[ incibe ]
Project Jervis (up to version 2.2) – AES-256-CBC without proper authentication, which opens the possibility of ciphertext manipulation and padding oracle, although the risk is mitigated by additional SHA-256 verification and implementation.[ feedly ]

Devices where AES-CBC is particularly dangerous

CPUs/GPUs/ASICs/TPMs themselves aren’t “CVE-affected”; vulnerabilities arise at the firmware, OS, library, and application levels. However, there are certain device classes where using AES-CBC and BytesToKey-type schemes is particularly risky: [ learn.microsoft ]

Laptops and desktops with disk encryption.
Example: a broken BitLocker implementation. In 2026, Microsoft patched the critical vulnerability CVE-2026-50507 (“YellowKey”), which allowed access to protected data with physical access through a flaw in the encryption mechanism. This isn’t “educational” cryptography, but real mass-market consumer hardware. [ gazeta ]
Enterprise endpoint solutions and VPN clients:
Critical vulnerabilities (SQL injection, RCE, etc.) periodically surface in a number of Fortinet products and other solutions. These vulnerabilities are combined with cryptographic errors to bypass authentication and decrypt traffic. If a vulnerable CBC implementation is used internally, the attack becomes easier.[ 1275 ]
IoT/smart home, cameras, routers.
Typical pattern: AES-CBC, static key and IV, proprietary protocol, no updates. This is a classic breeding ground for padding oracle and key attacks, although each CVE is announced for a specific model/firmware.[ 1275 ]

Risks of the BytesToKeySHA512AES scheme

Schemes like BytesToKeySHA512AES (essentially, “password → SHA‑512 → AES key”) are vulnerable not at the hardware level, but at the cryptographic design level:

The lack of a modern KDF (PBKDF2/Argon2/scrypt) makes this scheme vulnerable to offline brute-force attacks on any sufficiently powerful hardware (GPU/ASIC farms), but this is not the subject of separate CVEs—specific products/protocols are assigned CVEs.[ learn.microsoft ]
If such a scheme is used together with AES-CBC without authentication (no HMAC/GCM/SIV), then the vulnerabilities of CBC decryption (padding-oracle, timing-leaks) become applicable to this data as well.[ incibe ]

In other words, it is not “AES-256-CBC decryption devices” that are vulnerable, but rather products in which:

AES-CBC without authentication or with incorrect MAC verification;[ feedly ]
Fixed or predictable keys/IVs (hard-coded into firmware, same for all devices);[ seclists ]
vulnerable error handling logic during decryption (padding oracle, different timings and error messages).[ incibe ]

How to track current CVEs for AES-CBC

Check the CISA KEV directory – it contains actively exploited CVEs (currently there are many vulnerabilities in the Linux kernel, Fortinet, GNU Inetutils, etc., although they are not specific to AES-CBC).[ 1275 ]
Monitor vendor bulletins (Microsoft, Fortinet, IIoT and router manufacturers) – this is how, for example, CVE-2026-50507 was disclosed in BitLocker.[ gazeta ]
See CVE descriptions for: AES-CBC, padding, HMAC, timing are key markers of cryptographic errors.[ feedly ]

Looking at the overall information security agenda around this date, the following are among the resonant topics:

Mass exploitation of CVE-2026-0625 in older D-Link ADSL routers (several DSL models), which puts the SOHO segment and small offices at risk. [ cisoclub ]
Microsoft’s major June patch day fixes over 200 vulnerabilities, including several 0-days and critical bugs in network stacks (HTTP.sys, DHCP client); important for servers, VPN gateways, etc. [ xakep ]
A continuing wave of patches in server and cloud software related to the HTTP/2 Bomb (CVE-2026-49160), which affects popular web servers and proxies.[ xakep ]
CVE-2026-0714 is a vulnerability in the boot chain of embedded devices with LUKS and TPM that allows the extraction of a disk encryption key from a trusted environment.[ securitymedia ]

This is more of a background: they are not all directly about PRNGs, but they show a general trend – the problems are in the implementation of cryptography and the environment, and not in the algorithms. [ cisoclub ]

Where does randomness most often break down?

Based on historical and current cases, weak PRNGs/nonces most often appear in the following classes of devices and software:

Embedded devices and SOHO hardware
- Cheap routers, firewalls, VoIP phones, print servers, and other embedded hardware traditionally suffer from poor entropy pools and flawed RNG implementations.[ xakep ]
- Heninger’s research showed that a significant proportion of weak RSA keys on the network belong to these devices, not to full-fledged servers.[ xakep ]
Network and server software using non-standard or outdated RNGs
- A number of SM2/SMx implementations (especially in open-source libraries) have been found to have bugs where nonces are generated with reduced entropy—for example, CVE-2026-22698 in SM2-PKE, where a mismatch of units causes only 32 bits of randomness to be requested instead of the expected 256.[ github ]
- For algorithms like ECDSA/DSA, this is critical: partial control over the nonce allows the private key to be recovered.[ opennet ]
Admin clients and tools (SSH, SFTP, VCS clients)
- A notable case is the CVE-2024-31497 vulnerability in PuTTY, where the ECDSA P-521 nonce generation used a smaller initialization vector than required, allowing an attacker to recover the private key. [ opennet ]
- The vulnerable code was borrowed by several applications at once: FileZilla, WinSCP, TortoiseGit, TortoiseSVN – i.e. the problem “spread” across the entire stack of client software. [ opennet ]
Web libraries and frameworks that implement their own authentication schemes / tokens / nonces
- Digest authentication and custom signature schemes often suffer from errors such as nonce reuse or lack of strict counter validation, which opens the door to replay attacks. A recent CVE example: issues with nonce reuse and non-compliance with nc requirements in libsoup. [ feedly ]
- There are also libraries where a symmetric cipher with a GCM-type mode always uses the same 12-byte nonce for each record, as in ARIA-GCM in some TLS/DTLS implementations (CVE-2026-5446), which completely breaks semantic security.[ feedly ]
Password modules and configuration storage
- In some clients and desktop applications, vulnerabilities in encryption of configs and passwords are tied to insufficiently complex RNGs or predictable data (an example is rustdesk-client: the use of weak schemes and the ability to extract sensitive data from configs).[ feedly ]

Typical weak PRNGs and anti-patterns

At the code and library level, there are several red flags to look out for:

Using standard non-cryptographic PRNGs: rand, random, family *rand48, RAND_pseudo_bytes, default Mersenne Twister, etc. in the context of keys/passwords/nonce.[ docs.exponenta ]
Insufficient nonce length or partial padding with random bits (example with PuTTY and a 521-bit nonce padded with only 512 bits, or SM2-PKE, where 32 bits of randomness are output instead of 256).[ github ]
Reuse nonce when using AEAD modes (GCM/ChaCha20-Poly1305) or for signature schemes where the nonce must be unique and unpredictable (ARIA-GCM example with the same 12-byte nonce).[ feedly ]
Bad sources of entropy in embedded systems: missing /dev/urandom or its proper initialization, generating keys early in the boot process when the randomness pool is still empty (a common cause of weak RSA keys in routers and similar devices).[ xakep ]

Devices and classes of IT equipment most susceptible to

Taking everything above into account, we can structure what exactly is most often compromised by weak PRNGs/nonces in the real world:

Device/Software Class	How is crypto used?	Where randomness breaks down	Examples/context
SOHO routers, modems, SMB firewalls	TLS for admin panel, VPN, SSH, x.509	Low entropy when generating RSA/ECDSA keys, RNG at an early stage of loading	Massively weak RSA keys in embedded devices from various vendors [ xakep ], recent vulnerable D-Link DSL routers [ cisoclub ]
Embedded devices with disk encryption	LUKS, TPM-linked encryption	Errors in the key chain, sometimes weak RNGs when generating keys in production	CVE-2026-0714: LUKS key extraction on embedded devices with TPM [ securitymedia ]
Cryptographic libraries (especially SM2/regional algorithms)	Generating nonces for PKE/signatures	Errors in randomness length request, biased nonce	CVE-2026-22698: SM2-PKE with 32-bit biased nonce instead of 256-bit [ github ]
SSH/SFTP/VCS client programs	Generating keys and nonces for ECDSA/DSA	Incorrect nonce size/filling	CVE-2024-31497 in PuTTY and derivatives (FileZilla, WinSCP, TortoiseGit, TortoiseSVN) [ opennet ]
Web server libraries and frameworks	TLS nonce, digest/client authentication, CSRF tokens	Reuse nonce, lack of strict accounting of nc	Examples with ARIA-GCM and libsoup digest-auth in the CVE lists for CWE-323 (reuse nonce) [ feedly ]
Desktop clients with “homegrown” encryption of configurations	Storing passwords and keys in config files	Using a weak PRNG and simple encryption schemes	Vulnerabilities in rustdesk-client security/config-encryption modules [ feedly ]

From an operational perspective, the most critical combinations are “curved nonce + ECDSA/DSA/SM2” and “nonce reuse in AEAD mode”, because this almost always leads to a complete key compromise or a plaintext leak.[ github ]

Bugs in secp256k1 libraries:

A hardware vulnerability in BootROM in Qualcomm Snapdragon chipsets (CVE-2026-25262) affects smartphones, cars, and IoT devices; it is critical if they are used for wallets/transaction signing.[ xakep ]
CVE-2025-27840 vulnerability in the ESP32, which is widely used in IoT devices, DIY devices, and some hardware crypto wallets; the issue is due to errors and low entropy in the PRNG, affecting the security of keys/signatures.[ cryptocurrency ]

Separately, in the past there were already bugs specifically in the secp256k1 software libraries (point compression, twist attacks, and CVE-2020-28498 for elliptic), but this is more a library/software level, rather than a specific hardware one. [ polynonce ]

What types of devices are particularly vulnerable?

Below is not a complete list of CVEs, but rather device classes where the combination of hardware + secp256k1/ECC poses the most significant risks.

1. Smartphones and tablets on vulnerable Qualcomm

CVE-2026-25262 affects the MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, and SDX50 series of chips used in smartphones, tablets, automotive, and IoT solutions. [ Kaspersky ]
If such a device is running wallets, mobile exchange clients, or applications that use secp256k1 for ECDSA/ECIES (Bitcoin/Lightning, many blockchains), successful exploitation of BootROM bugs can lead to persistent control over the device, bypassing trusted boot, and further access to key material (via subsequent exploits/side-channels).[ xakep ]

2. Hardware crypto wallets and specialized crypto devices

A case in point is the vulnerability CVE-2025-27840 in the ESP32, which is found in billions of IoT devices and is also used in some hardware wallets and cryptographic modules.[ cryptocurrency ]
In some of these devices, the PRNG and crypto subsystem are configured incorrectly, which leads to signature predictability, and therefore to the possibility of recovering the private key when using ECDSA on secp256k1.[ cryptocurrency ]
There are other cases: in 2025, Trezor fixed bugs related to the microcontroller responsible for crypto operations in the Safe 3 and Safe 5 models.[ cryptocurrency ]

3. IoT devices and embedded systems

The ESP32 (CVE-2025-27840) is widely used in smart home devices, sensors, controllers, custom payment terminals, and DIY devices.[ cryptocurrency ]
For some of these devices, manufacturers implement their own ECDSA/ECDH implementations on top of the ESP32 using secp256k1 or other curves, but weak PRNGs/errors in the crypto infrastructure make such implementations vulnerable to key theft.[ cryptocurrency ]

4. Software libraries used on different architectures

Formally, this is no longer a “device,” but the vulnerabilities in the secp256k1/ECC libraries affect an entire class of hardware at once:

For the secp256k1 library, a vulnerability was described in the point compression mechanism (risk of loss of funds and data integrity violation, requiring an update of all projects using the library).[ polynonce ]
The elliptic JS package (which supports standard curves, including secp256k1) was vulnerable to twist attacks, as identified by CVE-2020-28498; this allowed partial private key values to leak through specific sextic twist points on the curve.[ habr ]

Any device running these libraries (payment servers, PoS terminals, mobile clients, browser wallets on weak ARM platforms) automatically falls into the risk zone until an update.[ habr ]

Table of key hardware vulnerabilities

Device class	Chip example / CVE	Where is it used?	Risk for ECC/secp256k1
Smartphones/tablets on Qualcomm	Qualcomm MDM9x07 и др., CVE‑2026‑25262[kaspersky]	Smartphones, tablets, cars, IoT [ Kaspersky ]	Capturing the boot chain, further access to crypto-software and keys
Hardware crypto wallets, crypto modules	ESP32, CVE‑2025‑27840[cryptocurrency]	Hardware wallets, IoT devices[ cryptocurrency ]	Bugs and weak PRNGs → key leaks with ECDSA/secp256k1
IoT devices	ESP32 and compatibles[ cryptocurrency ]	Smart home, sensors, terminals [ cryptocurrency ]	Compromising crypto protocols using ECC (including secp256k1)
Servers/Clients with ECC Libraries	secp256k1, elliptic, CVE‑2020‑28498[polynonce]	Payment servers, browser and mobile wallets[ polynonce ]	Twist attacks, point-to-point compression issues → key leaks, transaction forgery

Practical conclusions for protection

For infrastructure that actively uses secp256k1 (exchanges, custodial services, payment gateways, wallets):

Hardware inventory: which Qualcomm/ESP32 chips and similar microcontrollers are present in mobile clients, POS terminals, hardware wallets, and trusted signature nodes. [ kaspersky ]
Check for CVE-2026-25262 and CVE-2025-27840, evaluate the possibility of updating firmware/replacing devices.[ xakep ]
Audit used ECC libraries (secp256k1, elliptic, etc.) for versions with known vulnerabilities and perform forced updates.[ polynonce ]
For high-value and HSM-class systems, minimize dependence on vulnerable consumer SoCs and general-purpose microcontrollers by moving keys to certified modules.

The main vulnerabilities in ECDSA implementations in recent years have primarily affected smart cards and tokens, SSH clients/servers (PuTTY, OpenSSH), crypto libraries (OpenSSL, Libgcrypt, NSS, etc.), as well as individual hardware platforms and the bootROM of some SoCs. However, a direct, “final” list as of June 17, 2026, is not publicly available. Below is what can be gathered from publicly available materials, with an emphasis on devices/hardware classes where ECDSA is actually used and is listed in CVEs.[ securitylab ]

Smart cards, tokens, and HSMs

A number of studies on side-channel attacks against ECDSA list smart cards and tokens that use the ECDSA standard module.[ securitylab ]
Examples of potentially vulnerable devices included the Valid S/A IDflex V, SafeNet eToken 4300, and TecSec Armored Card; they used an ECDSA module vulnerable to CVE-2019-13627 and related issues in Libgcrypt and other libraries.[ securitylab ]
This is critical because such cards and tokens are widely used for qualified electronic signatures, and vulnerabilities allow private keys to be recovered with unprivileged access to the host and the ability to observe ECDSA operations.[ securitylab ]

Crypto libraries and general-purpose software

Research on CVE-2018-0495 has shown the possibility of recovering ECDSA and DSA keys in a number of libraries: OpenSSL, LibreSSL, Libgcrypt (ECDSA), Mozilla NSS, Botan (ECDSA), WolfCrypt (ECDSA), LibTomCrypt (ECDSA), LibSunEC (ECDSA), MatrixSSL, CryptLib, etc. [ securitylab ]
These libraries underlie a large number of applications: browsers, VPN clients, server applications, TLS-terminating proxies, IoT firmware, which automatically makes a huge number of devices that use ECDSA for TLS, firmware signatures, etc. vulnerable.[ securitylab ]
Separate work (CVE-2019-2894 and CVE-2019-13627) demonstrated ECDSA key recovery in OpenJDK/OracleJDK and Libgcrypt, which affects Java systems, GnuPG, and projects using these libraries (including the same smart cards).[ securitylab ]

SSH clients and servers (PuTTY, OpenSSH)

A serious vulnerability (CVE-2024-31497) was discovered in PuTTY that allowed recovery of a user’s private key generated using ECDSA on the NIST P-521 curve (ecdsa-sha2-nistp521).[ opennet ]
PuTTY is widely used on Windows hosts for SSH access to servers, network equipment, and industrial systems: if such a key was used for signing/authentication, its compromise directly affects systems relying on ECDSA.[ opennet ]
In 2026, OpenSSH also described an issue with ECDSA key handling: with certain configurations of the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms directives, the server could accept any algorithm from the ECDSA family, even those not explicitly included in the list. This isn’t a cryptographic flaw, but rather a bug in the key acceptance policy, but it does affect the trusted surface in systems using ECDSA for SSH.[ securitylab ]

Hardware platforms and SoC

A separate vulnerability is the BootROM vulnerability of Qualcomm Snapdragon chipsets (CVE-2026-25262), discovered by Kaspersky ICS CERT.[ xakep ]
The vulnerability affects common series (MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, SDX50) used in smartphones, tablets, automotive components, and IoT devices. Although the description doesn’t explicitly state that the issue is ECDSA, such bootROMs traditionally use ECDSA/EdDSA/ECC to verify the bootloader signature, and an error at this level is critical to the trusted boot chain.[ xakep ]

Massive crypto stack bugs involving ECDSA

In 2026, a critical error (CVE-2026-5194) was described in the crypto library related to the validation of cryptographic parameters, allowing the use of too weak hashes when verifying certificates.[ securitylab ]
The vulnerability affects several algorithms at once, including ECDSA, DSA, ML-DSA, Ed25519, and Ed448, meaning all software and devices that use this library to verify certificates (from servers and clients to IoT devices).[ securitylab ]
In builds where ECC and EdDSA or ML-DSA are enabled simultaneously, the developers recommend urgently updating the library, which indicates a very broad potential vulnerability (billions of devices).[ securitylab ]

What is “widely used” in digital signature practice

If we boil it down to the hardware classes most widely used for ECDSA digital signatures and featured in CVE/research:

Smart cards and USB tokens for digital signatures (corporate and government segments) are susceptible to vulnerabilities in typical ECDSA implementations and dependent libraries.[ securitylab ]
SSH clients and servers (PuTTY, OpenSSH) on workstations and servers—vulnerabilities allow keys to be recovered or algorithm settings to be bypassed.[ securitylab ]
Servers and applications using OpenSSL/LibreSSL/Libgcrypt/NSS and others for TLS and signatures, including web servers, API gateways, mail servers, VPNs, etc.[ securitylab ]
Java platforms (OpenJDK/OracleJDK) and the GnuPG ecosystem, where ECDSA is used to sign code, documents, and packages.[ securitylab ]
Hardware platforms with vulnerable BootROM (Qualcomm Snapdragon and similar SoCs), where bootloader and firmware signing is often implemented via ECDSA or related ECC schemes.[ xakep ]

How can a practitioner work with this?

Track CVEs not by “devices,” but by stacks: crypto libraries (OpenSSL, Libgcrypt, NSS, Java/BC), SSH software, smart cards and tokens, BootROM/secure boot implementation of specific SoCs. [ opennet ]
In threat models for ECDSA-based digital signatures, consider: side-channels, generation of non-uniform nonces, errors in parameter/certificate verification, and configuration bugs (as in OpenSSH), and not just banal key-theft.[ securitylab ]

Bitcoin Core software and nodes

At the software level, the main “big” CVE of recent times is a bug in Bitcoin Core, identified as CVE-2024-35202. It affects Core versions prior to 25.0 and allows remote attacks on nodes through the processing of block transaction messages (type blocktxn). According to BitNodes, approximately 13.7% of active nodes continued to run vulnerable versions even after the patch was released. [ dzen ]

In practice this means that:

Most susceptible to this is any equipment (servers, home machines) that runs Bitcoin Core version ≤ 25.0 and has not been updated to 28.0.[ bits ]
The risk is highest on constantly accessible online nodes (VPS, bare-metal servers, data center nodes), where the likelihood of vulnerability detection and exploitation is higher.[ bits ]

Hardware wallets and microcontrollers (ESP32)

The vulnerability CVE-2025-27840 in the popular ESP32 microcontroller has attracted considerable attention in the hardware wallet and IoT device ecosystem. Researchers at Crypto Deep Tech have demonstrated that a flaw in the Wi-Fi/Bluetooth component allows an attacker to permanently infect the microcontroller and threatens the security of Bitcoin assets stored on ESP32-based devices.[ creditukraine.com ]

Additionally, there are reports of insufficient entropy in the PRNG used to create transaction signatures in a number of hardware wallets (including those using the ESP32), which theoretically makes it possible to recover private keys with long-term observation. Thus, the following are critically vulnerable: [ ru.tradingview ]

Hardware wallets (consumer devices) built on the ESP32, especially with enabled wireless interfaces without strict segmentation.[ creditukraine.com ]
Homemade or custom solutions (DIY wallets, IoT nodes) where the ESP32 is used without additional hardening (for example, without disabling the radio, without secure boot and firmware verification).[ ru.tradingview ]

Server infrastructure for cryptomining and Bitcoin

A separate class is IT infrastructure hardware and software used by crypto platforms, mining pools, and auxiliary services (panels, API gateways, web panels, backend servers). Check Point research shows that cryptominers are massively exploiting old CVEs in server components to inject mining software .

The most commonly used are:

Microsoft Windows Server 2003 vulnerability (CVE-2017-7269) is exploited in 46% of attacks on organizations.[ vesti ]
Oracle WebLogic vulnerability (CVE-2017-10271) – used in approximately 40% of attacks.[ vesti ]

That is, they are especially susceptible to:

Old Windows servers (including those used for auxiliary services around Bitcoin infrastructure, mining panels, etc.).[ vesti ]
WebLogic servers and other legacy Java stacks that may host mining dashboards, exchange admin panels, or API gateways for crypto services.[ vesti ]

Quantum risks and obsolete equipment

Research from Google and Cambridge indicates that blockchains in general are vulnerable to future quantum attacks, as public keys and transactions can already be stored and subsequently attacked using quantum computing power. Devices and systems with legacy cryptographic algorithms and hardware that have not migrated to post-quantum systems will be most at risk. [ shazoo ]

For Bitcoin this means that:

Older hardware wallets and devices with hard-coded classic ECC that cannot be updated in the future will be particularly vulnerable.[ shazoo ]
Long-lived nodes and servers where crypto provider and TLS updates are slow to roll out will become easy targets through a “capture now, hack later” strategy.[ shazoo ]

What is most critical from a practical point of view?

To summarize the types of IT equipment that are actively used in the Bitcoin ecosystem and, in practice, are most susceptible to CVEs:

Bitcoin Core nodes running older versions (especially always-on servers) are vulnerable to CVE-2024-35202.[ dzen ]
Hardware wallets and IoT devices on ESP32 with wireless interfaces enabled are vulnerable to CVE-2025-27840 and PRNG issues.[ creditukraine.com ]
Server infrastructure (Windows Server 2003, Oracle WebLogic, etc.) that is used as the basis for cryptocurrency services and is often not updated, resulting in old CVEs being exploited for cryptomining purposes.[ vesti ]
Legacy cryptosystems and hardware that are not ready for the post-quantum transition and may become vulnerable as real quantum attacks emerge.[ shazoo ]

Currently, the most vulnerable devices in the crypto industry are considered to be specialized hardware wallets, IoT and MCU platforms (ESP32 and similar), network and telecom equipment, as well as IP KVM and infrastructure based on popular OS/software (Linux, Nginx, PAN-OS, Exchange, etc.), which are often used to build crypto platform peripherals. Below is a brief digest and breakdown by device type.[ xakep ]

Key types of devices critical to the crypto industry

1. Hardware wallets and IoT microcontrollers

The CVE-2025-27840 vulnerability in the ESP32 affects millions of IoT devices, including crypto wallets and devices used to work with Bitcoin/Ethereum (Wi-Fi/Bluetooth connection).[ cryptocurrency ]
Researchers show that bugs in the MCU (weak PRNG, vulnerable crypto primitives, command backdoor functions) make it possible to steal private keys and spoof transactions.[ cryptodeep ]

Typical risks for the crypto industry:

Hardware wallets on MCU with a vulnerable stack (ESP32, Unisoc, etc.).
Homemade/”garage” solutions (IoT nodes, “cold” devices on ESP32/STM32, etc.) without firmware verification and without secure boot.

2. Mobile SoCs/Modem Chips

Critical vulnerabilities CVE-2024-39431/39432 have been discovered in Unisoc chips; the chips are widely used in smartphones, tablets, cars, and telecom equipment in Russia, Asia, and other regions.[ itsec ]
Compromising the modem stack can lead to traffic interception, code execution on the device, and, as a result, the theft of mobile crypto wallets.[ securitymedia ]

For crypto use cases:

Smartphones as the main carrier of mobile wallets.
Terminals/PoS devices using low-cost SoCs with similar chips.

3. IP-KVM and remote access to infrastructure

Eclypsium’s research has identified nine vulnerabilities in IP-KVM from four vendors (GL-iNet, Angeet/Yeeso, Sipeed, JetKVM), including unauthenticated RCE and root access.[ xakep ]
For Angeet/Yeeso ES3 KVM, critical bugs CVE-2026-32297 (file reading) and CVE-2026-32298 (command injection) are rated 9.8 and 8.8 by CVSS; there are no patches yet.[ xakep ]

Why this matters for crypto:

Such KVMs are used to manage servers of exchanges, custodians, mining farms, and data centers.
Compromising IP KVM gives an attacker direct access to the console of nodes, HSM systems, or backend services of a crypto exchange.

4. Network devices, VPNs and firewalls

Trending vulnerabilities include CVE-2026-0300 (Palo Alto PAN-OS, PA/VM-series, Authentication Portal), CVE-2026-42945 (Nginx), CVE-2026-31431 (Linux), as well as Exchange and Defender bugs.[ habr ]
Vulnerabilities in VPN gateways (for example, Check Point), Juniper ScreenOS and other network solutions that CISA includes in the catalog of actively exploited ones were separately noted. [ itsec ]

For crypto projects:

VPN and NGFW gateways are the entry point to the private networks of exchanges, OTC platforms, custodians, and mining pools.
RCE or auth-bypass in PAN-OS/Check Point/Juniper gives an attacker a foothold for lateral movement to nodes, API servers, and databases.[ 1275 ]

5. Web infrastructure: HTTP/2, Nginx, Linux, Exchange

In June 2026, Microsoft patched more than 200 vulnerabilities, including critical RCE vulnerabilities in the Windows kernel (CVE-2026-45657), HTTP.sys (CVE-2026-47291), and DHCP Client (CVE-2026-44815).[ xakep ]
Also fixed is the HTTP/2 Bomb bug (CVE-2026-49160) affecting popular web servers and proxies: nginx, Apache, IIS, Envoy, Cloudflare, Pingora.[ xakep ]

What does this mean for crypto?

Backends of crypto exchanges, DeFi platforms, RPC endpoints, and API gateways are often built on Nginx/Apache/IIS on Linux/Windows.[ habr ]
Attacks on HTTP/2 or RCE in a web server can bypass WAFs, cause DoS, or gain a foothold in the infrastructure and intercept requests to APIs/wallets.

6. Infrastructure software (backups, CI/CD, automation)

Positive Technologies experts and others are highlighting trending vulnerabilities in Veeam Backup Enterprise Manager, Jenkins, automation systems, and backup solutions.[ itsec ]
For example, CVE-2017-1000353 in Jenkins (an old but still exploitable RCE), as well as RCE in IoT systems like Meteobridge (CVE-2025-4008).[ 1275 ]

Why it’s often overlooked:

These systems maintain infrastructure (backups of key databases, smart contract/service deployment pipelines), but are not considered part of the “crypto circuits”.
RCE in Jenkins/Veeam allows you to inject a backdoor into releases, replace node configs, or inject malicious code into smart contracts and APIs.[ itsec ]

7. User devices and Trojans

Recent reports have documented an increase in attacks using Android Trojans like NFCShare, distributed as “banking app updates,” which steal bank card data and abuse the NFC module.[ securitymedia ]
Similar mechanisms (fake APK wallets, fake update channels) are used to steal seed phrases and private keys from user devices.[ cryptodeep ]

For the crypto ecosystem:

Desktop/mobile clients, out-of-date OS/browsers, messages like “update your wallet/exchange client” are a classic vector for a compromise user endpoint.
Even with a secure server infrastructure, compromising a user’s phone/PC can completely bypass server security measures.

Which device class is “particularly vulnerable” to CVEs in the crypto industry?

Roughly ranking by risk to the crypto industry (from a CVE landscape perspective):

Hardware wallets and IoT devices on MCU (ESP32, Unisoc, etc.), without secure boot and with closed firmware. [ cryptocurrency ]
Network and VPN gateways (PAN-OS, Check Point, Juniper, etc.) within the perimeter of crypto platforms. [ 1275 ]
IP KVM and remote management devices in data centers and mining farms. [ xakep ]
Web infrastructure (Nginx/Apache/IIS, HTTP/2) and service components (Exchange, Windows/Linux kernels, HTTP.sys, DHCP). [ citforum ]
Infrastructure software (backup/CI/CD/automation) and IoT gateways (Veeam, Jenkins, Meteobridge, etc.). [ itsec ]
User endpoints (smartphones, PCs) with vulnerable OS/chips and Trojans. [ itsec ]

For security practices in the crypto industry, this means prioritizing:

Device-level hardening for MCUs/hardware wallets.
Strict patch management and segmentation for VPN/NGFW and IP-KVM.
Mandatory hardening of the HTTP/2 stack, web servers, and Exchange/Windows infrastructure.
Supply chain control at the CI/CD, backup, and automation tool levels.

Russian and international media continue to cover cyberattacks and exploitation of new zero-days, including CVE-2026-3055 in Citrix NetScaler and CVE-2026-11645 in V8, which have been used in real-world attacks in recent weeks.[ safe.cnews ]
Cybersecurity reviews for June noted an increase in attacks on banking clients through Android Trojans (such as NFCShare) distributed under the guise of banking app updates.[ securitymedia ]
At the beginning of the year, Microsoft closed 59 vulnerabilities, six of which were already actively exploited, and CISA included them in the Known Exploited Vulnerabilities catalog, which directly affects the fintech sector on the Windows infrastructure. [ itb.spb ]

Network gateways, VPNs, and ADCs

Financial institutions are making extensive use of Citrix NetScaler (ADC, Gateway), Fortinet, Check Point and similar devices for employee and client access, and it is this category that is currently at increased risk. [ onlanta ]

Citrix NetScaler ADC/Gateway
CVE-2026-3055 is already being actively exploited for data theft; tens of thousands of accessible NetScaler devices have been discovered on the network, some of which remain vulnerable due to unpatched software. Fintech traditionally relies heavily on Citrix for remote access and web application publishing, so successful exploitation gives an attacker direct entry into the perimeter. [ safe.cnews ]
VPN Gateways and SSL VPNs:
Vulnerability analysis over the past few years has shown a consistent trend: critical bugs in VPN gateways (Check Point, Fortinet, Palo Alto, etc.) consistently appear on lists of “trending” and exploitable vulnerabilities. For fintech, this is a critical point, as these devices facilitate administrative and operator sessions to payment and banking systems. [ itsec ]

Network switches and infrastructure equipment

The next big layer is L2/L3 switches and routers, especially when they have sophisticated web and CLI management interfaces and centralized managers.[ cert.gov ]

Cisco, Juniper, Fortinet, Zyxel, Supermicro.
Critical CVEs are published in Cisco ASA/FTD and Cisco IOS XE (including RCE via the web interface and authentication bypass), Junos OS (BGP processing), FortiSwitch/FortiSwitchManager (command execution via the CLI), Supermicro, and Zyxel (BIOS/CLI command injection). For fintech networks, this is the backbone, and a successful exploit often gives complete control over the segment where payment gateways, broker APIs, etc. reside. [ onlanta ]
Cisco Nexus / IOS XE in Data Centers.
The National Coordination Center for Cyber Security regularly reports vulnerabilities in Cisco Nexus and IOS XE (DoS, confidential information leakage, RCE). These platforms are actively used in the data centers of banks and payment providers, so CVEs for them are almost automatically considered “fintech-critical.”[ cert.gov ]

Server platforms, Windows and virtualization

Fintech organizations make extensive use of Windows infrastructure, as well as virtualization and system software, which also currently have a number of actively exploited CVEs.[ securitylab ]

Windows and Client Systems:
In February, Microsoft patched 59 vulnerabilities, six of which had already been exploited (bypassing security mechanisms in Windows Shell and MSHTML, issues in Word, Desktop Window Manager, RDP, etc.), and CISA requires their mandatory patching. This is important for fintech, as many front- and back-office systems run on Windows, and EoP bugs allow for rapid persistence and escalation of access.[ itb.spb ]
A critical vulnerability,
CVE-2026-22709 (CVSS 9.8), was discovered in the vm2 library (used as a JS sandbox in Node.js), allowing for sandbox escape and code execution on the host. Positive Technologies’ reports also list trending bugs in VMware, Linux, and Veeam backup software, which are widely used in financial data centers.[ securitylab ]

For fintech companies that provide APIs and web platforms, bugs in vm2-like sandboxes are especially dangerous if they are used to run custom scripts (for example, custom integration logic).

Specialized ICS/IoT and terminal equipment

Part of the fintech infrastructure relies on peripheral devices: ATMs, controller boards, IoT cameras, and industrial/telecom hardware in branches and data centers.[ cert.gov ]

Industrial Controllers and RTUs:
The National Center for Cyber Security (NCCS) bulletins mention vulnerabilities in INEA ME RTUs and other controllers that involve improper authentication and security bypasses. These vulnerabilities can be exploited in the engineering infrastructure of data centers, branches, and payment centers (power, climate control, access), turning the OT segment into an entry point for attacks on the IT side.[ cert.gov ]
IP cameras, small office network devices.
There are CVEs enabling remote code execution in Zavio IP cameras and SOHO routers (e.g., TOTOLINK), as well as in Cisco IOS XE with a DoS effect. In the fintech environment, these devices are often located in branches, ATM areas, and cross-connections, and when accessed from the internet without strict segmentation, they become part of the attack chain.[ cert.gov ]