News Heat Trend
Project Overview
Trezor is a cryptocurrency hardware wallet that allows users to securely receive, store, and send cryptocurrencies. It is designed and marketed by SatoshiLabs.
Ledger Received Hardware Wallet Implant Warnings Early On, Former Mt. Gox CEO Says Response Was Insufficient
Odaily News: French hardware wallet manufacturer Ledger received multiple reports of malicious implants months before its latest security crisis occurred. Former Mt. Gox CEO Mark Karpelès stated that at least two people had contacted Ledger since December 2025 to report tampered devices, but no public warning was found to have been issued.Security researcher Joe Grand stated that on March 4, 2026, he reported a malicious implant to Ledger. The implant was found in a Nano X purchased through Lazada in Thailand in August 2025. Ledger confirmed the findings and said it would launch an internal investigation, but did not proactively alert customers.Mark Karpelès believes that the increase in the number of reports and the growing sophistication of the techniques used should prompt Ledger to take action and at least remind customers to remain cautious. Ledger declined to comment on how it handled Joe Grand's disclosure, only directing people to view its public statement on X.The Ledger security crisis became public on October 9, involving the loss of crypto assets from wallets sold by Southeast Asian authorized reseller CryptoBilis; Ledger confirmed that one affected device contained an unauthorized implant. Trezor had also previously received reports involving devices tampered with by unauthorized sellers. (Cointelegraph)
Trezor Reduces Number of Resellers Amid Supply Chain Security Incident, Says No Evidence Devices Were Compromised
Hardware wallet manufacturer Trezor has announced that, in light of recent supply chain security incidents, the company has decided to reduce the number of its resellers in order to conduct more effective vetting of its partners.Trezor emphasized that there is currently no evidence suggesting its devices have been compromised, and that this adjustment is a precautionary measure taken out of an abundance of caution.
The EU Cyber Resilience Act officially takes effect, requiring crypto wallet vendors to report vulnerabilities within 24 hours.
According to Cointelegraph, the EU Cyber Resilience Act (CRA) officially entered into force, requiring cryptocurrency hardware and software wallet providers to submit an early warning within 24 hours of discovering a serious security vulnerability or an actively exploited vulnerability, a complete notification within 72 hours, and a final report within 14 days after remediation measures are implemented. The regulation applies to all "products with digital elements" sold in the EU market. Violating companies face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing false or misleading information will result in an additional fine of up to €5 million. Previously, Trezor and BitBox have both disclosed user data breach incidents and warned users to be vigilant against phishing emails disguised as security notifications.
Trezor Third-Party Email Service Provider Compromised, Phishing Emails Impersonate Official Communications
The official X account of Trezor (@Trezor) announced that its third-party email service provider was compromised by hackers, with a phishing email titled "Critical Security Alert: STM32 Entropy Vulnerability" circulating. Trezor explicitly clarified that the message was not sent by the company, and has urgently taken down the associated domains while launching an investigation. In recent days, Trezor had already suffered a customer data breach, resulting in the theft of the names, home addresses, and email addresses of approximately 67,000 users. Trezor advised users to avoid clicking any suspicious links and strictly refrain from disclosing their wallet mnemonics to anyone.
Trezor's Third-Party Email Service Provider Breached; Users Warned of "Critical Security Alert" Phishing Emails
Odaily News: Trezor stated that its third-party email service provider has been breached and is currently under investigation. It warns users not to click on links in fraudulent "Critical Security Alert" phishing emails. (Cointelegraph)
Independent verification scope expanded, Sparrow Wallet releases v2.5.4 security update
Odaily News: Sparrow Wallet v2.5.4 has been released following an extensive AI-assisted review, featuring multiple security hardening updates aimed at reducing users' reliance on external servers such as Electrum.Additionally, this version strengthens Ledger, Keycard, Trezor, Payjoin, PSBT, and multi-signature handling, removes Bitcoin Core credentials and other sensitive information from debug logs, restricts permissions for existing wallet and backup directories to owner-only access, closes residual local DNS resolution leaks when using Tor, and reinforces validation for wallet import, signing, downloads, and server responses. The update expands Sparrow Wallet's scope of independent verification for transaction data, hardware devices, and other inputs, reducing dependence on data provided by external servers. (Bitcoin News)
Hardware Wallet Supply Chain Attack Leads to $100 Million Theft, Former Mt. Gox CEO Mark Karpelès Reveals Ledger Attack Details
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
AI Could Break Encryption Algorithms, Ethereum Researchers Call for "Bunker Mode"
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
Approximately 233,000 Bitcoin moved as a precaution, with around $15 billion involved following the Coldcard exploit
Odaily News: After a firmware vulnerability in Coldcard hardware wallets was exploited, approximately 2,100 Bitcoin were stolen, with losses nearing $130 million. On-chain data shows that in the days surrounding the incident, wallets held by long-term holders transferred out approximately 233,000 Bitcoin, valued at around $15 billion. Casa CEO Nick Neuman stated that some of the transferred funds came from Coldcard users migrating to multi-signature wallets, with Ledger and Trezor users also taking similar measures after the event. During the same period, approximately 22,000 Bitcoin were transferred into exchanges. Coinkite has advised users who generated seed phrases using firmware versions 4.0.1 through 4.1.9 to treat their wallets as compromised and immediately migrate to new seed phrases. These versions cover the period from March 2021 to July 2026. (Decrypt)
Trezor: Approximately 10% of Global Crypto Users Self-Custody Their Private Keys
hardware wallet company Trezor stated there is a distinction between Bitcoin self-custody and holding Bitcoin credit exposure. When users store assets on exchanges, brokerages, or funds, they are actually relying on third-party ledger records and withdrawal arrangements. The company noted that after the full implementation of new EU crypto regulations, some exchanges that failed to obtain licenses in time have stopped offering regulated services to EU users. Trezor stated that its founders Marek Palatinus and Pavol Rusnák launched the first hardware wallet 12 years ago, moving private keys from internet-connected computers to dedicated devices. Trezor explained that private keys are generated on the device and never leave it, with transactions being signed inside the device before being sent. Trezor CCO Danny Sanders previously stated that if users put Bitcoin into ETFs and call it Bitcoin ownership, it would be one of the worst outcomes for the industry. Trezor estimates that among approximately 600 million global crypto users, about 10% self-custody their private keys, and around 12 to 13 million people use hardware wallets.
Trezor Exec: Putting All Bitcoin into ETFs Might Be the Worst Outcome for the Industry, Undermining the Core Principle of Self-Custody
: Danny Sanders, Chief Business Officer of hardware wallet manufacturer Trezor, stated that "putting everything into ETFs" might be the worst development path for the Bitcoin ecosystem. Since the launch of US spot Bitcoin ETFs in early 2024, cumulative inflows have exceeded $53 billion, making them a significant driver of BTC prices, but also potentially altering the structure of how users hold their assets.Sanders believes that over-reliance on ETFs will weaken Bitcoin's core principle of "self-custody," gradually shifting asset control to third-party institutions instead of users holding their private keys. Although self-custody carries risks such as lost seed phrases or unrecoverable private key leaks, he considers these more of a psychological barrier than a technical challenge, adding that "it's not difficult once you actually start doing it."Data shows that out of approximately 600 million crypto users globally, only about 10% practice self-custody, and only around 12 to 13 million users employ hardware wallets.As an early hardware wallet provider in the industry, Trezor helped popularize the BIP-39 seed phrase standard and continues to advocate for lowering the barriers to self-custody through improved user experience and educational tools, rather than relying on intermediary custody.Sanders concluded that the industry's long-term goal should be to gradually approach a Web2-level user experience, rather than simply replacing self-custody with ETFs. "That would probably be the worst possible outcome for the entire industry." (The Block)
Hardware Wallet Supply Chain Attack Leads to $100 Million Theft, Former Mt. Gox CEO Mark Karpelès Reveals Ledger Attack Details
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
AI Could Break Encryption Algorithms, Ethereum Researchers Call for "Bunker Mode"
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
Trezor Reduces Number of Resellers Amid Supply Chain Security Incident, Says No Evidence Devices Were Compromised
Hardware wallet manufacturer Trezor has announced that, in light of recent supply chain security incidents, the company has decided to reduce the number of its resellers in order to conduct more effective vetting of its partners.Trezor emphasized that there is currently no evidence suggesting its devices have been compromised, and that this adjustment is a precautionary measure taken out of an abundance of caution.
The EU Cyber Resilience Act officially takes effect, requiring crypto wallet vendors to report vulnerabilities within 24 hours.
According to Cointelegraph, the EU Cyber Resilience Act (CRA) officially entered into force, requiring cryptocurrency hardware and software wallet providers to submit an early warning within 24 hours of discovering a serious security vulnerability or an actively exploited vulnerability, a complete notification within 72 hours, and a final report within 14 days after remediation measures are implemented. The regulation applies to all "products with digital elements" sold in the EU market. Violating companies face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing false or misleading information will result in an additional fine of up to €5 million. Previously, Trezor and BitBox have both disclosed user data breach incidents and warned users to be vigilant against phishing emails disguised as security notifications.
Brevo Login Breach Leads to Phishing Emails Sent to 347,000 Trezor Subscribers, BitBox and CoinTracking Accounts Also Affected
Odaily News: A vulnerability in email platform Brevo's login system allowed attackers to access 138 customer accounts and send phishing emails to approximately 347,000 Trezor newsletter subscribers. Accounts belonging to BitBox and cryptocurrency portfolio and tax reporting platform CoinTracking were also used to send similar scam emails.Trezor stated that the phishing email was titled "Critical Security Alert: STM32 Entropy Vulnerability," with links pointing to an app that asked users to submit their wallet backups. Trezor disabled the relevant domain via DNS within 20 minutes, but approximately 2,500 people had visited the link, and the company has alerted all 347,000 subscribers to the risk.Brevo stated that attackers exploited a failure in single sign-on configuration permission boundaries to access all organizations reachable by invited users. Six accounts were used to send phishing emails, and contact data from 43 accounts was exported. BitBox and CoinTracking said they have found no evidence of leaked company credentials, funds, or recovery phrases, but are treating the affected email addresses as potentially compromised. (Cointelegraph)
Trezor Third-Party Email Service Provider Compromised, Phishing Emails Impersonate Official Communications
The official X account of Trezor (@Trezor) announced that its third-party email service provider was compromised by hackers, with a phishing email titled "Critical Security Alert: STM32 Entropy Vulnerability" circulating. Trezor explicitly clarified that the message was not sent by the company, and has urgently taken down the associated domains while launching an investigation. In recent days, Trezor had already suffered a customer data breach, resulting in the theft of the names, home addresses, and email addresses of approximately 67,000 users. Trezor advised users to avoid clicking any suspicious links and strictly refrain from disclosing their wallet mnemonics to anyone.
Ledger Received Hardware Wallet Implant Warnings Early On, Former Mt. Gox CEO Says Response Was Insufficient
Odaily News: French hardware wallet manufacturer Ledger received multiple reports of malicious implants months before its latest security crisis occurred. Former Mt. Gox CEO Mark Karpelès stated that at least two people had contacted Ledger since December 2025 to report tampered devices, but no public warning was found to have been issued.Security researcher Joe Grand stated that on March 4, 2026, he reported a malicious implant to Ledger. The implant was found in a Nano X purchased through Lazada in Thailand in August 2025. Ledger confirmed the findings and said it would launch an internal investigation, but did not proactively alert customers.Mark Karpelès believes that the increase in the number of reports and the growing sophistication of the techniques used should prompt Ledger to take action and at least remind customers to remain cautious. Ledger declined to comment on how it handled Joe Grand's disclosure, only directing people to view its public statement on X.The Ledger security crisis became public on October 9, involving the loss of crypto assets from wallets sold by Southeast Asian authorized reseller CryptoBilis; Ledger confirmed that one affected device contained an unauthorized implant. Trezor had also previously received reports involving devices tampered with by unauthorized sellers. (Cointelegraph)
Hardware Wallet Supply Chain Attack Leads to $100 Million Theft, Former Mt. Gox CEO Mark Karpelès Reveals Ledger Attack Details
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
Security and hardware wallet support upgrades, Sparrow Wallet releases v2.5.5
Odaily reports: Bitcoin News posted on X platform that Sparrow Wallet has released version v2.5.5, adding stricter PSBT signature verification, Silent Payment output verification, and expanded support for BitBox02, Jade, Krux, Trezor, and Ledger hardware wallets.This version also strengthens Coldcard multisig import restrictions, improves chain reorganization handling mechanisms and Trezor debug log sensitive data protection, and adds a new system theme that can automatically follow the operating system's light or dark settings.
Trezor supports clear signatures via ERC-7730
The Ethereum Foundation announced that Trezor now supports clear signing via ERC-7730. This feature aims to improve the readability of transaction content, helping users better understand what they are signing when transacting on Ethereum. Previously, the Ethereum Foundation's "Trillion Dollar Security Plan" detailed progress from the Clear Signing Working Group and encouraged more wallets and decentralized applications to participate in developing this standard.
Independent verification scope expanded, Sparrow Wallet releases v2.5.4 security update
Odaily News: Sparrow Wallet v2.5.4 has been released following an extensive AI-assisted review, featuring multiple security hardening updates aimed at reducing users' reliance on external servers such as Electrum.Additionally, this version strengthens Ledger, Keycard, Trezor, Payjoin, PSBT, and multi-signature handling, removes Bitcoin Core credentials and other sensitive information from debug logs, restricts permissions for existing wallet and backup directories to owner-only access, closes residual local DNS resolution leaks when using Tor, and reinforces validation for wallet import, signing, downloads, and server responses. The update expands Sparrow Wallet's scope of independent verification for transaction data, hardware devices, and other inputs, reducing dependence on data provided by external servers. (Bitcoin News)
Coldcard incident boosts BitBox credit card sales by ~10x, while Trezor and OneKey see rising demand
Odaily News - Hardware wallet maker BitBox reports that credit card sales in August grew roughly 10x compared to the baseline of previous weeks, with the increase primarily driven by North America. Trezor and OneKey also confirmed rising sales during the same period, though neither disclosed specific figures.Trezor, BitBox, and OneKey have all re-reviewed their seed phrase generation, random number generator, entropy, and firmware verification processes. Trezor plans to conduct penetration testing on core firmware functions and publish related security audit reports. OneKey will strengthen reviews of security-critical code paths and transaction signing processes.Ledger CTO Charles Guillemet stated that AI-assisted attacks mean patch releases, vulnerability disclosures, and user education need to accelerate. Blockstream Jade has released a firmware update containing multiple fixes and recommends users simultaneously update their apps, operating systems, devices, routers, and home appliances. (Bitcoin.com News)
Related news
Trezor Warns That Safe 5 Devices Sold by CryptoBilis May Have Hardware Implants
Trezor stated that its security team received a responsible disclosure report alleging that a Trezor Safe 5 purchased from Southeast Asia's official distributor CryptoBilis had a hardware trojan implanted inside. The device was purchased through Tokopedia in August 2026. The report claims that an extra circuit board equipped with a cellular module and antenna was found between the motherboard and the screen, capable of reading the screen display contents and exfiltrating them via mobile network when the device is powered on. Trezor has not yet received the physical device for laboratory verification, but based on the customer's description and video communication, it considers the report credible and has issued a warning in advance. Trezor stated that no users have reported losses so far, and advised users who purchased devices through CryptoBilis starting March 2026 to migrate their assets to wallets using newly generated seed phrases as soon as possible, and under no circumstances should they enter existing seed phrases on suspicious devices. Affected users can contact the official team to request a replacement device or voucher. Trezor removed CryptoBilis from its official distributor list on October 9.
DOOM successfully ported to and running on Trezor hardware wallet
Odaily reports: Bitcoin News posted on X that DOOM has been successfully ported to the Trezor hardware wallet and is running on it.
Ledger Received Hardware Wallet Implant Warnings Early On, Former Mt. Gox CEO Says Response Was Insufficient
Odaily News: French hardware wallet manufacturer Ledger received multiple reports of malicious implants months before its latest security crisis occurred. Former Mt. Gox CEO Mark Karpelès stated that at least two people had contacted Ledger since December 2025 to report tampered devices, but no public warning was found to have been issued.Security researcher Joe Grand stated that on March 4, 2026, he reported a malicious implant to Ledger. The implant was found in a Nano X purchased through Lazada in Thailand in August 2025. Ledger confirmed the findings and said it would launch an internal investigation, but did not proactively alert customers.Mark Karpelès believes that the increase in the number of reports and the growing sophistication of the techniques used should prompt Ledger to take action and at least remind customers to remain cautious. Ledger declined to comment on how it handled Joe Grand's disclosure, only directing people to view its public statement on X.The Ledger security crisis became public on October 9, involving the loss of crypto assets from wallets sold by Southeast Asian authorized reseller CryptoBilis; Ledger confirmed that one affected device contained an unauthorized implant. Trezor had also previously received reports involving devices tampered with by unauthorized sellers. (Cointelegraph)
OneKey Launches Hardware Wallet Inspection Tool "One-Stone Package Inspector", Leveraging Vision Models to Detect Anomalous Components
OneKey founder Yishi announced the launch of the hardware wallet authentication tool "Yi Shi Jian Bao", designed to help users identify potentially anomalous implants on hardware device motherboards. The tool applies uniform verification rules to Ledger, OneKey, and Trezor without preferential treatment. After users upload photos of their disassembled motherboards, the system locally strips metadata such as geolocation information, then utilizes Anthropic’s Claude vision model to analyze motherboard model matching, main chip markings, and the presence of anomalous chips, modules, antennas, or jumper wires. The final verdict is generated based on predefined rules rather than the model making a direct determination.
Hardware Wallet Supply Chain Attack Leads to $100 Million Theft, Former Mt. Gox CEO Mark Karpelès Reveals Ledger Attack Details
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
AI Could Break Encryption Algorithms, Ethereum Researchers Call for "Bunker Mode"
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.