More Compromised Hardware!? | THE BITCOIN BRIEF 95

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.

AOB bitcoiner.guide down due to hosting headaches Correction to last week's chat about Bitkey

NEWS Hardware hacker Joe Grand examined a Trezor Model T bought on Facebook Marketplace in Canada in 2025 and a Trezor One from a TikTok shop in August 2026, both from unauthorized sellers on models Trezor discontinued in January 2026; in both, the main microcontroller had been replaced so the device produced one of about a dozen phrases the attacker already knew instead of a random recovery phrase, with a microSD card soldered inside the Model T holding genuine firmware to pass the integrity check and the Trezor One's swapped chip carrying both the malicious and official firmware, costing its owner about $50. Trezor told Zero Day on 15 October this is a known counterfeit method it has warned about since fake Model Ts turned up on Russian marketplaces in 2022, that it hasn't examined these specific units, that its Suite check is designed to catch devices producing predetermined phrases and it knows of no way to pull this off on its current Safe range, and that its 13 October comment about no evidence of compromise referred to new devices bought from its website or authorized resellers. Both hosts stressed this is not a Trezor supply chain issue, unlike the Ledger case, since both devices were counterfeits sold by unauthorized sellers, and urged listeners to buy hardware directly from the manufacturer and be wary of any reseller -- Zero Day (Kim Zetter), Cryptoast Trezor said on 13 October it has cut the number of resellers it works with and is reviewing vendor relationships as a preventive step following the CryptoBilis implants, with dropped resellers able to sell existing stock until 1 January 2027; this isn't a flaw unique to Trezor, the hosts noted, but something that could affect any hardware manufacturer -- Bitcoin Magazine, Cointelegraph Recapping the 9 October CryptoBilis drain of $86M to $93M, Ledger's 15 October statement says a "highly organized criminal group" bought devices, fitted the implants and fed them back through resellers with seed-collection, draining and laundering servers built in advance, that there was no flaw in its chip, operating system or servers, and it has asked resellers across Southeast Asia and Hong Kong to suspend sales without giving an official loss figure. Mark Karpelès says a Ledger Nano X bought at MediaMarkt in Germany is confirmed to carry the same implant, and reported another from a shop at Singapore's Changi airport, though Ledger hasn't examined either device and every confirmed theft still traces back to CryptoBilis; MediaMarkt has pulled Ledger devices worldwide. Chainalysis found a scam operator who stole roughly 60 BTC ($5M) from task-scam victims had it swept up in the same drain after moving it onto a compromised Ledger device, a bit of karma the hosts enjoyed -- Ledger statement, Bitcoin Magazine, Bitcoin Magazine (scammer victim), ForkLog (Karpelès), crypto.news (MediaMarkt), TokenPost (Gauthier v Karpelès) On the same day as its CryptoBilis statement, Ledger announced Atom, an Android phone due mid-2027 that runs everyday apps and switches into a protected mode for managing keys, with an OpenClaw AI assistant whose actions need physical approval on the device; Ledger says a tamper-sensing enclosure with its own battery will block screen-reading implants like the CryptoBilis ones, and Atom will sell only through Ledger's own website at $849 for a Founders Edition ($899 after launch). The hosts called the timing tasteless but the engineering impressive, questioning whether a phone that also runs WhatsApp and TikTok belongs anywhere near your keys -- CoinDesk A UK trader posting as "realist" on X says attackers held him at knife point and forced him to transfer close to $800,000, with $40,000 coming from a hot wallet and $720,000 from a Ledger hardware walle