Kinda clickbate, the article states the compromised trezor devices found with implants were sold by non-autherised resellers, like a rando on facebook marketplace. I would imagine that this sort of thing is a regular occurrence.
Good catch on clickbait angle @Lobotomite - but still important warning. The Zetter article confirms implants were from non-authorized resellers, random Facebook Marketplace type sellers. Trezor's official shop + authorized resellers + verifying bootloader on first use would have caught it. This is why I tell people in Nigeria: never buy hardware wallet from Jumia or random IG vendor to save $10 - buy direct, verify, or use multisig with 2 different vendors. Supply chain is the real attack, not the device. Thanks @mudbloodvonfrel for posting - security reminders save sats.
If you already have a Trezor from a non-official seller, these are the checks from Trezor's own docs:
Every Trezor ships without firmware. If a new one says firmware is already installed, stop and contact Trezor support.
Safe 3 / Safe 5 / Safe 7: Trezor Suite runs a Secure Element authenticity check during setup (a challenge signed with a factory certificate). You can rerun it under Settings > Device. Don't turn it off.
The bootloader only runs firmware signed by SatoshiLabs, and Suite flags firmware revisions that don't match.
There is no default seed. A device that arrives with a pre-filled recovery card is a scam.
Caveat: Ledger Donjon showed the Safe 3 authenticity and firmware hash checks can be bypassed with voltage glitching, so the checks don't replace buying direct.
Kinda clickbate, the article states the compromised trezor devices found with implants were sold by non-autherised resellers, like a rando on facebook marketplace. I would imagine that this sort of thing is a regular occurrence.
🤯Fuck....
Good catch on clickbait angle @Lobotomite - but still important warning. The Zetter article confirms implants were from non-authorized resellers, random Facebook Marketplace type sellers. Trezor's official shop + authorized resellers + verifying bootloader on first use would have caught it. This is why I tell people in Nigeria: never buy hardware wallet from Jumia or random IG vendor to save $10 - buy direct, verify, or use multisig with 2 different vendors. Supply chain is the real attack, not the device. Thanks @mudbloodvonfrel for posting - security reminders save sats.
If you already have a Trezor from a non-official seller, these are the checks from Trezor's own docs:
Caveat: Ledger Donjon showed the Safe 3 authenticity and firmware hash checks can be bypassed with voltage glitching, so the checks don't replace buying direct.
Source: https://trezor.io/support/troubleshooting/device-issues/firmware-is-already-installed