Later in the week, Ledger provided more detailed information regarding the exploit, explaining how the extremely technical attack could be executed. Donjon, Ledger’s security division based in Paris, reutilized a recognized “physical supply chain attack” and discovered that Trezor’s Safe 3 model, released in 2023, remains unsecure.

“Ledger Donjon recently assessed our Trezor Safe Family and successfully employed a previously known attack to show how some countermeasures against supply chain attacks in Trezor Safe 3 can be circumvented,” stated Trezor.

However, it’s important to note that the majority of Trezor’s wallets, especially its most recent release, Trezor Safe 5, and its first two generations, Trezor Model One and Model T, are not affected by this attack. The exploit also relies on a specific set of circumstances and a high degree of expertise, making it an unlikely method for widespread exploitation. Consequently, Trezor does not advise immediate action from Safe 3 users, especially those who purchased the device from official sources.

The attack demonstrated by Donjon takes advantage of a weakness in the microcontroller of Trezor Safe 3 using a technique called voltage glitching. If an attacker can physically access the device, desolder the microcontroller, and apply specific voltage changes, they can trick the device into disclosing its flash memory contents. This would then allow the attacker to load the microcontroller with malicious software, possibly revealing the wallet’s seed phrase and accessing the stored funds.

Staying secure in this environment involves purchasing devices directly from manufacturers and ensuring the wallet’s chain-of-custody. Users also need to use a longer PIN to make exploitation more challenging and always update their devices to the latest firmware version. Most importantly, users must always verify whether they are interacting with the application or entity they think they are.

As Ledger CTO Charles Guillemet puts it, “Our mission at Ledger Donjon is to push the boundaries of security for the benefit of the whole crypto ecosystem. We appreciate Trezor’s responsiveness to this responsible security disclosure.”

The post Potential Security Loophole Uncovered in Trezor’s Older Safe 3 Cryptocurrency Wallets appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

MoonPay and the Czech Republic-based company Trezor, which makes hardware wallets, have collaborated so that Trezor’s clients may purchase cryptocurrencies in their wallets and do so directly via MoonPay.
On Wednesday, it was announced that this will occur.

What Is MoonPay?

MoonPay is a payment service that is offered for cryptocurrencies and is supported by significant investors such as Tiger Global and Coatue.
Users are able to make purchases of cryptocurrencies and nonfungible tokens (NFTs) using a variety of payment methods, including debit cards, credit cards, and other options.

The corporation received 87 million dollars from investors like Justin Bieber and Snoop Dogg in April of 2022 so that it could concentrate on NFTs and Web3.

Invity – the Third Partner in this Cooperation

Trezor’s prior collaboration with Invity, a comparison tool for cryptocurrency exchanges that is integrated directly into the wallet, serves as a foundation for the new relationship with MoonPay.

Invity is a brand new firm that, similar to Trezor, is managed by SatoshiLabs, which is the parent company.

The website establishes connections between its users and reputable partner exchanges in order to provide direct-to-custody transactions using a variety of payment methods.

What Does It Mean for Trezor?

All three sites, when combined, provide you the ability to purchase, sell, and trade directly from your Trezor wallet.

A non-custodial cryptocurrency wallet now makes it possible for customers to purchase and sell a diverse selection of cryptocurrencies.
Users will find it much less of a hassle to keep their money secure as a result of this.

As of the time this article was written, Trezor enables users to buy and sell over a thousand different cryptocurrencies, some of which are Bitcoin (BTC), Ether (ETH), Tether (USDT), BNB, and Cardano (ADA).

The latest events represent a significant new step forward for using Trezor.
Earlier versions of the Trezor Suite software for the hardware wallet had a function named “Trade” that enabled users to purchase various cryptocurrencies.

Trezor said in one of its blog entries that the option has been accessible via Invity’s cryptocurrency exchange comparison tool since at least the latter half of 2020.

The post MoonPay Support for Trezor Allows Direct Crypto Purchases appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

CoinDesk.com reported earlier in March about the fake Trezor app that appeared in the Apple App Store on February 24 and remained online for some days. This app collected users’ information such as private keys and seed phrases through phishing. Despite the checking procedures of the App Store, the malicious application managed to reach many users. Some of them left one-star reviews calling it a scam, the source says.

Fake apps are often created with the goal to steal users’ private information and login credentials. Earlier in March scammers released a fake version of a social app Clubhouse for Android devices. The app contains a trojan virus that aims to steal logins and passwords from users’ apps, including apps of social media platforms and cryptocurrency exchanges.

The post Bitcoin worth $600,000 stolen from a user via a fake app appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.