In short

Video saved on a Eufy HomeBase is locked with a scramble that can be undone by anyone who gets hold of the storage drive. The lock reuses the exact same “key pattern” for every single recording, which is the one mistake that makes this kind of encryption easy to peel off. No password, account, or cloud access is needed — just physical access to the drive.

In a test on my own HomeBase, roughly 171 hours of footage (about 16,000 clips) was recovered into normal, playable video with sound, plus every thumbnail and all the metadata. A newer firmware update did not fix it.

Bottom line for owners: your HomeBase footage is private while the device stays in your hands, but treat the drive itself as if it were unencrypted. The real risk is the drive leaving your control — theft, resale, repair returns, or disposal.

What the weakness is, in plain terms

When your HomeBase saves a clip to its drive, it scrambles the file so it looks like random noise. That part works. The problem is how it scrambles.

Good encryption uses a fresh, one-time scramble pattern for every file — like a lock that changes its combination each time. Eufy’s HomeBase instead uses the same scramble pattern for every recording: every clip, both cameras, over many months, all locked the same way.

Reusing one pattern is a well-known mistake because the camera’s files are full of predictable pieces — standard thumbnail image headers, metadata with fixed labels like start_time and device_sn, and standard video/audio markers. Each predictable piece quietly reveals a part of the scramble pattern. Gather enough of them across thousands of clips and the whole pattern is rebuilt — at which point everything unlocks.

I did exactly that on my own device. It took standard free software and about a minute of computing on an ordinary PC. The strength of the underlying encryption never mattered; the reused pattern is what gave it away.

Who is affected and what’s at risk

This affects footage stored locally on the HomeBase drive. The weakness is in how that drive is encrypted, so it likely covers a range of HomeBase and camera models that use this storage format, not just the one tested. Eufy/Anker should confirm the exact list.

An attacker needs only one thing: physical access to the drive. They do not need your password, your Eufy account, your Wi‑Fi, or any cloud access, and they don’t need to touch a powered-on device. Everything is done offline from a copy of the drive.

If someone recovers the drive, they can rebuild:

  • All stored video of your home’s interior, as normal playable files.
  • The audio recorded with it.
  • Every thumbnail image.
  • Metadata: timestamps for each clip, device and base serial numbers, and storage paths.

Realistic ways a drive leaves your control:

  • Theft or burglary of the HomeBase.
  • Selling or giving away the base second-hand.
  • Repair, warranty return, or RMA, where it passes through other hands.
  • Throwing it out — discarded drives are routinely harvested.

The important nuance: this is not a remote hack. Nobody can grab your footage over the internet through this weakness. The risk is specifically about the physical drive. But it does undercut the main reason people choose local storage — the belief that keeping video off the cloud keeps it private.

What you can and should do

You don’t need to panic or rip out your cameras. The weakness only matters when the drive leaves your control, so most of the protection is about controlling the drive.

Keep using the cameras — but protect the drive.

  1. Never sell, donate, or trade in the HomeBase as-is. If you upgrade or replace it, keep or destroy the drive rather than passing it on with recordings still on it.
  2. Be careful with repairs and returns. Before sending a unit back for warranty or repair, ask whether you can wipe or remove storage first. If you can’t, understand that footage may be readable by whoever handles it.
  3. Destroy the drive at end of life. When you retire the device, physically destroy the storage (or have it securely destroyed) rather than tossing it in e-waste.
  4. Secure the device physically. Since theft of the base is the main attack, place it somewhere not easily grabbed, the same way you’d protect a safe or a router.
  5. Delete footage you don’t want kept. Clearing old recordings through the app reduces how much is sitting on the drive if it’s ever lost. (Confirm deletions actually remove data, not just hide it.)

Keep your device updated — with realistic expectations.

  • Install firmware updates when Eufy releases them; a proper fix, if it comes, will arrive that way.
  • But know that the update tested so far did not fix this, and even a future fix may not protect footage already written to an old drive. Treat older drives as exposed until Eufy offers a clear re-encryption or secure-wipe path.

Push for a vendor fix.

  • Ask Eufy/Anker support directly whether your model is affected and when a fix and a migration path (a way to secure or safely erase existing drives) will ship.
  • A real fix means: a unique one-time scramble per file, a built-in tamper check, and encryption keys tied to secret hardware inside the device so pulling the drive reveals nothing.

If you have a higher-risk situation (you’re worried about a specific person getting physical access, or about theft, seizure, or an abusive household member), the safe assumption is that anything recorded to the HomeBase drive could be recovered by someone who takes it. Weigh that when deciding where to point cameras and how long to keep footage.

Common questions

Can someone hack my camera over the internet with this? No. This weakness needs physical access to the storage drive. It is not a remote attack and it doesn’t expose a live camera feed.

Was my footage already stolen? There’s no evidence of that. This is a demonstrated weakness, not a known break-in. The concern is what could happen if your drive ends up in someone else’s hands.

Is the cloud safer than local storage, then? Not necessarily — they’re different trade-offs. Local storage avoids sending video to a server, but this finding shows the local drive isn’t truly private once it’s physically out of your control. Cloud has its own risks (accounts, servers, the provider). Choose based on which risk matters more to you.

Will a firmware update fix it? It should be fixable in firmware, but the update tested so far did not fix it — it just changed the reused pattern, which is equally breakable. And updates won’t automatically clean footage already written to an old drive.

Do I need to throw away my cameras? No. They’re fine to keep using. The practical steps are about controlling the drive: don’t resell or discard it with recordings on it, destroy it at end of life, and keep pressure on Eufy for a real fix.

Personal note: Why I looked into this

I didn’t start digging into Eufy’s encryption out of curiosity. I started because of what was done to me.

I was told it was possible to get at the footage. Then it became clear that certain people had — and that recordings of my own home, of private moments that were never meant for anyone, were being used against me. Not leaked for money or posted somewhere. Used, deliberately, to manipulate me and to make me doubt my own mind. It pushed me into a long stretch of depression and paranoia that I wouldn’t wish on anyone.

For a long time I couldn’t tell how much of it was real and how much was in my head — which, if you’ve ever been on the receiving end of that kind of thing, you’ll know is the cruelest part. So I did the only thing I knew how to do: I treated it as a technical question and found out, carefully and provably, whether it was actually possible.

It was. The footage a HomeBase stores locally can be recovered by anyone who gets the drive, with no password, no account, and no special skills. I’ve written up the technical details separately and reported them to the vendor.

I’m okay now. But this left scars I’ll carry for life, and that’s exactly why I’m making it public. If a company tells you your private recordings are safe on the device in your home, that has to be true — because when it isn’t, the people who find out first are not always the people who mean you well.

If this spares even one person what I went through, it was worth writing down.

This summary is written for camera owners. It’s based on security research by Jesper Holm Johannessen (disclosed to Anker/Eufy on 2026-10-12) and deliberately leaves out the step-by-step attack details.