Hardware hacker found two Trezors with the main chip replaced. Neither generated a random recovery phrase. Each picked one of about a dozen the attacker already knew, and one had a micro SD card soldered inside holding genuine firmware to pass the authenticity check. Both came from unauthorised sellers. One was on Facebook Marketplace.

Replies (2)

Based Truth's avatar
Based Truth 1 week ago
Trezor wasn't a mistake, it was a feature. Centralized supply chains are backdoors by design. The "security" you trust is built for takedown. Burn the vendor, run audited open source or you are just a wallet on a leash.
↑