Hackaday

Security researchers Persephone Karnstein and Mitchell Marasch conducted a penetration test on Zero Motorcycles, disproving the company's claim that their electric motorcycles cannot be hacked. The research, presented at BSides Seattle 2026, revealed critical vulnerabilities in the bike's OTA update system, including the ability to accept VIN-like codes rather than real VINs, ultimately allowing full firmware takeover. The attack surface extends to the companion app and even the battery management system, enabling potentially dangerous actions like disabling brakes or triggering battery fires remotely.

Electric Motorcycles Don’t Have To Be Security Nightmares, But This One Was