Here, he is 3D printing the molds used for vacuforming the carbon fiber composite airframe.
Seems like a fun home project. But apparently this is Harry Margolis of @sladetechusa.
$100M across 500+ addresses so far. Crypto hardware wallet owners are freaking out because of a new supply chain attack. Let’s see how we could make it worse!
People are opening their hardware wallets to look for hardware implants. REMINDER: 5 years ago I converted a Ledger into a malicious wallet WITH NO VISIBLE CHANGES. So visual inspection isn’t everything.
The attack seen today is a hardware backdoor that reads the seed phrase right off the screen & sends it to the attacker using its own cellular radio. And it seems the attacker may have purchased an official Ledger reseller so they could ship backdoored wallets to customers. (It’s all still unfolding, not everything is confirmed, new implants are showing up, etc)
A Chinese company bought an official reseller of Ledger, & possibly used an NDA to prevent it from being made public. I will say that even if the new owner wasn’t complicit, mergers & acquisitions are very attractive times to target a company. Lots of stuff is changing quickly, lots of new names, lots of urgent needs, etc.
In theory, the reseller is where they inserted the implants. They opened legit Ledger wallets and added an extra PCB with extra components. The implant tapped the lines of the Ledger’s screen & was able to read the seed phrase exactly as shown to the user. This phrase was then sent out over a slow cellular radio designed for low traffic IOT.
Tapping the screen has been a known attack. Joe Grand did a talk on it earlier this year. We have seen more “primitive” looking implants that do it.
But buying a company is a big step forward from prior attempts. I wouldn’t be surprised if there was some state funding here. I guess we will find out as people dig into the corporate paper trail of the business, the account associated with the cell service, etc.
Hardware wise, they cleaned things up a lot to make it less noticeable to a wallet owner who opens the case. But I can’t help but wonder why they didn’t improve a few areas… I’ll go into that in replies to this post.
🧵1
Trezor joins the backdoor party!
A few hours ago Trezor posted there is “not a single piece of evidence that Trezor devices have been compromised”. Which conveniently leaves out the fact that @joegrand found implanted Trezor wallets IN THE WILD and even notified Trezor 2 months ago.
Story by @KimZetter:
zetter-zeroday.com/trezor-wa…
🧵13
Trezor confirms the exact same hardware implant technique was found in a Trezor wallet sold by an OFFICIAL reseller!
🧵14
CryptoBilis update
We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:
Already using it?
Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.
Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.
We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.
On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far.
NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.
If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: trezor.io/support#open-chat
We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.
For more information, visit our blog: trezor.io/blog/news/implant-…
Plastics are alien technology to hardware nerds. Surely nobody would ever be able to replicate the plastics of an existing product to make an identical exterior. Or seal it back into the original box.
Here is an unrelated video:
This is what a @Trezor Safe 3 would look like if you tried to supply chain hack it.
Still works BTW.
When it comes to misc devices that need to be targeted, there are a variety of tricks for doing disassembly that allow reassembly with minimal visual evidence. But if you have more time, producing some replacement plastic is ideal.
I have 3 primary approaches for production:
- 3D prints. Good for dimensional prototyping, but not always the best visual result
- low yield injection molds. Good for a result that’s much closer to perfect, but the molds only last for a small number of uses
- full production injection molds. These are going to start at like $50k per mold for really simple stuff. But the surface finish will be perfect.
Still laughing at this a day later.
It’s especially funny when you remember how large parts of the drone community refused to acknowledge dual use. I know @d0tslash remembers.
Oct 2026, AI travels back in time by 7 months and turns me into @hak5darren to feed the slop machine.
I’m surprised by Grok @bot. I have a mountain of complete bullshit that eats my time while running every aspect of a business. It’s the first fully managed solution where I can meaningfully offload tons of it in the form of a few dozen “micro employees”.
I tried doing with OpenAI’s “Dot” and it quickly turned into a firehose of different topics colliding into a singular chat UI, where Grok Bot lets you separate each topic domain. And for time sensitive stuff, Grok Bot can repeat checks every 5min compared to Dot’s 1hr.
Sure, there are roll your own options, like Hermes. But fully managed is much lower friction for a lot of stuff.
Hey @sama, you should see what I can do with a bent spoon.
I get that this is outside of what YOU think hackers can do, but this is well within the scope of what a well resourced red team can do during an op. Wait till you learn that every trace on a PCB is an antenna.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
I don’t think giving an agent access to your bank qualifies as unauthorized access, so my post from 2 days ago isn’t quite as prescient as it seems.
But I suppose this is… better late than never:
“banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong”
Wow… he wasn’t exaggerating! It really looks like AI.
Looks like a F-35 had babies with a Lambo. It’s got self-recharging thrusters that lets it fly. A 0-60 of 0.59-1.6 sec depending on model. And the base model price somehow seems to be $50k?!
Tesla Roadster. I have so many questions.
The $50k for base model and $250k for mid model has got to be purely the initial deposit. The reservation page is confusing. But a super stripped down 2 seater, with 1.6sec 0-60, with no thrusters does seem like something Tesla could pull off for $50k. 🤷♂️🤷♂️
tesla.com/roadster/reserve#p…
