Basic Exfil Tester
v0.1.3
Generate a fake PSBT, sign it with an air-gapped hardware wallet (SeedSigner, Specter DIY, …), and compare the signed transaction byte-for-byte against the results expected from standard deterministic-nonce algorithms (RFC 6979). Malicious firmware can covertly leak ("exfiltrate") your master seed inside signature nonces — in attacks such as Dark Skippy, a 12-word seed can be extracted from as few as two signatures, and air-gapping does not stop it because the leak rides in the signed transaction itself. Dark Skippy has not yet been seen in the wild. Signatures that differ from the deterministic expectation are a red flag. For more information, see darkskippy.com.
A match here does not prove the device is safe. Checking deterministic nonces once is not a robust mitigation: malicious firmware can behave honestly most of the time and only exfiltrate later — for example after X transactions, above a spend threshold, at a specific block height (nLockTime), on specific UTXOs, or only for certain multisig setups. This tool is a spot check, not continuous monitoring.
1 Seed phrase
Only use throwaway seed phrases here. Never enter a real seed phrase that has been used for real Bitcoin or that will be used for real Bitcoin. This page handles the seed in plain text and displays it as a QR code.
Standard SeedQR — scan it with either SeedSigner or Specter DIY to load this seed.
2 nLockTime
0 disables the locktime.
3 Transaction inputs
4 Transaction outputs
Total inputs:
Sent to external addresses:
Fee:
Wallet balance change:
Sent to change addresses:
TXID:
The total amount of outputs must not exceed the total amount of inputs; the difference is the mining fee. “Wallet balance change” is payments to external addresses plus the fee (change stays in the wallet).
5 PSBT version
6 PSBT
Animated BC-UR QR (ur:crypto-psbt)
— scannable by both SeedSigner and Specter DIY.
7 Expected signed transactions
Different wallets choose the ECDSA nonce differently. All of the algorithms below are deterministic, so the exact signed transaction each family of wallets should return can be computed in advance. Wallets that add random extra entropy (e.g. anti-exfil protocols with host commitments) cannot be predicted this way.
The expected signed transactions will appear once the PSBT above can be built.
8 Signed transaction from the hardware wallet
Paste the signed transaction / signed PSBT returned by the wallet (hex, base64,
ur:crypto-psbt parts or Specter pMofN parts), upload it as a
file, drag & drop the file anywhere on this box, or scan the wallet's QR code with
your camera. Once a final network transaction can be extracted, this box is replaced with
its raw transaction hex. Binary files are converted to hex automatically.
Camera not working? In some browsers the camera
is not available when this page is opened directly as a file
(file://…). Serve it over localhost instead: open a terminal in the
folder containing this HTML file and run
python -m http.server 8000
then browse to http://localhost:8000/ and open this
page from there.
Summary
The verdict will appear here after you provide the signed transaction returned by the hardware wallet.
Could not read the provided data:
The signed transaction matches the expected signed transaction of .
The signed transaction does not match any of the expected signed transactions.
Details:
Don't panic — this does not necessarily mean that your hardware wallet is malicious. Maybe it is a different air-gapped hardware wallet that we did not test, or a new firmware version that uses a different algorithm for choosing the signature nonce. Consider asking in online forums — since the seed here should be fake, you can freely share the seed phrase, the PSBT and the signed transaction that the hardware wallet returned.