Affected scope
S1 evaluated by Kraken
What the attack requires
Physical access and flash manipulation.
What changed
Downgrade issue fixed in 1.0.24.
What this finding establishes
Kraken explicitly did not demonstrate stealing cryptocurrency.
SafePal / Public disclosure
Physical tamper and downgrade weaknesses
Tamper defenses could be bypassed and firmware downgraded.
Source date: 2021-02-16Reviewed: 11 October 2026