‘Trusted seller’ vends fake Trezor wallets stealing crypto: Kaspersky
Amid the rising popularity of hardware cryptocurrency wallets, the Russian cybersecurity firm Kaspersky has reminded users about the importance of using authentic crypto devices.
Kaspersky’s cyber incident expert Stanislav Golovanov on May 10 reported on an issue with fake hardware wallets impersonating major wallet firm Trezor.
According to the blog post, the fake wallet allowed fraudsters to steal Bitcoin (BTC) via a replaced microcontroller, which enabled attackers to take over control of the user's private keys.
The victim reportedly purchased a tampered hardware wallet that posed as Trezor’s advanced crypto wallet Trezor Model T. The fake wallet appeared to be exactly the same as a genuine Trezor Model T wallet, providing a standard set of wallet functions.
“When handling the wallet, nothing felt suspicious either: all the functions worked as they should, and the user interface was no different from the original one,” Golovanov wrote.
The fake wallet was tampered from the inside, though. According to the Kaspersky team, attackers managed to access users' crypto assets by replacing the inner firmware. “The actual mechanism of the theft remains unclear,” Golovanov noted, adding that the issue was caused by a “typical supply chain attack.”
To prevent supply chain attacks, Kaspersky’s cybersecurity experts advised users to only buy hardware wallets directly from the official vendor. The firm noted that the victim bought the fake Trezor wallet through a “trusted seller through a popular classifieds website.”
Kaspersky didn’t immediately respond to Cointelegraph’s request to comment on exactly which reseller was involved in the incident.
The issue described by Kaspersky isn’t something new for the crypto community. In 2022,
Read more on cointelegraph.com
