Malicious firmware can embed secret data into a public Bitcoin transaction, which the attacker can then use to extract a person’s seed words.