A newly demonstrated BitLocker bypass is drawing attention because it does not rely on complex malware chains or exotic hardware access. Instead, the method uses a USB stick, a specific key sequence, and physical access to a locked Windows 11 machine to expose data that should have remained protected.
The finding has raised even sharper questions because the researcher behind the proof of concept says the behavior looks more like a backdoor than a normal software flaw. That claim is tied to how the mechanism appears to work inside WinRE, and to the fact that the issue affects the BitLocker setup many consumers use every day.
How the bypass works
The proof of concept, called YellowKey, was released on May 12 and targets Windows 11 as well as Windows Server 2022 and 2025. Windows 10 is said to be unaffected, while the vulnerable configuration is BitLocker running in TPM-only mode.
According to the published details, the exploit begins with a folder that can be copied to a USB stick. That folder, named FsTx, is placed in a specific path inside the System Volume Information directory.
Once the USB drive is connected to a locked Windows 11 device, the process continues in Windows Recovery Environment, or WinRE. The user holds Shift while selecting Restart, then releases Shift and holds CTRL at the reboot moment.
If the timing is right, the system opens a command prompt with unrestricted access to the encrypted volume. From there, the BitLocker-protected drive can be mounted with diskpart and its contents read.
Why the case stands out
BitLocker is designed to keep drive contents unreadable if a laptop is lost or stolen. It is tied to the TPM so that the disk remains protected when the device falls into the wrong hands.
That is why a relatively simple bypass has caused such concern in the security community. The method suggests that physical access, a USB stick, and a carefully timed reboot sequence may be enough to undermine a protection layer that is supposed to be the main barrier for data on the drive.
Nightmare-Eclipse, the researcher who disclosed the issue, said the mechanism’s behavior is difficult to explain in a normal way. For that reason, the researcher described it as resembling a backdoor.
Independent confirmation and broader scope
The claim did not remain a one-person demonstration. Security researcher KevTheHermit said he reproduced the technique on Windows 11 build 10.0.26100.1 and shared the result on X.
That independent confirmation makes YellowKey harder to dismiss as an isolated claim. It also increases the concern because the targeted BitLocker mode is common on consumer devices.
Nightmare-Eclipse also said a similar method may work on TPM+PIN configurations, although that version was not published. No outside party has yet publicly verified or rejected that specific claim.
Why Windows 10 matters here
One of the strangest parts of the issue is that Windows 10 is not affected. The reason for that difference is still unclear, and the researcher said the deeper cause has not been fully understood.
The exploit’s odd behavior is also tied to location. In the YellowKey explanation, the component responsible for the bypass exists only in the WinRE image, while the component with the same name in a normal Windows installation does not trigger the bypass.
That detail is a major reason the researcher suspects intentional design rather than an ordinary bug. So far, no other explanation has been presented that fully accounts for the behavior.
What users and organizations can do now
Switching from TPM-only to TPM+PIN sounds like a natural defense, but the researcher says that alone may not solve the problem. Until that configuration is independently tested and confirmed, preventing physical access to the device remains the strongest mitigation.
For enterprise environments that still rely on TPM-only through policy, the risk may be close to a drive that is effectively unencrypted until a patch arrives. That makes the issue especially sensitive for organizations that assume BitLocker is the final line of defense.
Microsoft has not publicly acknowledged YellowKey or assigned a CVE at the time of the statement. The company has said it is committed to investigating security reports, updating affected devices as quickly as possible, and supporting coordinated vulnerability disclosure.
A fix may not be straightforward because the problem appears to sit in the WinRE image rather than in the main operating system. Recovery-partition updates have also been uneven in the past, so attention is now on how quickly and cleanly Microsoft can close the gap.