Bither

CryptoBilis update We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do: Already using it? Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Not set up yet? Don’t set it up, and never enter your existing wallet backup on it. We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives. On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far. NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it. If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: trezor.io/support#open-chat We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else. For more information, visit our blog: trezor.io/blog/news/implant-…

User funds are SAFU! Yet, this pregnant lady 👇 pulled an all nighter, along side hundreds of Binancians. Many industry friends and even competitors (including some previously-not-so-friendly ones) provided very much needed help. 🙏 It hurts, but we will survive. 💪

硬件钱包泄漏用户住址、电话的事件，今年已经不知道是第几起了…

《公告》 因为团队没有人买的起 iPHONE DUO 所以 PANDA 钱包 UI 短时间内适配不了折叠屏。

本质上“供应链攻击”对所有硬件钱包都是一样的，那为什么这次事件只涉及了 Ledger？因为量最大的攻击者收益最大，小厂没受这次供应链攻击的影响不代表攻击者不能这么做，只是做了没意义而已。就像这些年盛行的假钱包，其实假钱包团伙们仿冒的主要就是 pie 和剩下的一两家，非主流的连假钱包都没人做的。

不过目前DIY离线签名器的方案好像主要适配比特币，智能合约之类的复杂交互还是要用旧电脑或旧手机

本质上“供应链攻击”对所有硬件钱包都是一样的，那为什么这次事件只涉及了 Ledger？因为量最大的攻击者收益最大，小厂没受这次供应链攻击的影响不代表攻击者不能这么做，只是做了没意义而已。就像这些年盛行的假钱包，其实假钱包团伙们仿冒的主要就是 pie 和剩下的一两家，非主流的连假钱包都没人做的。

这就是为什么不要买硬件钱包的另一个原因：你不仅要信任设计者和生产商，还要信任物流方。数据泄露会增加扳手攻击风险，甚至物流有可能被掉包。相比之下，旧手机虽然也需要信任，但信任负担小太多了。

8月的时候，一名硬件钱包的经销商老哥因为对硬件钱包公司的失望和对 PANDA 钱包冷热架构的认可和我私信取得了联系。 他和我吐槽自己辛苦整理的硬件钱包供应链攻击文档发给Ledger 后，没有任何回应。 不知道老哥最近会不会受到重视。 😑