Spy Chip Inside a Crypto Wallet — Plus WordPress Under Mass Attack
Friday, October 30, 2026 · 5-minute read
Ahmad Umar Agha — a member of the Syrian Electronic Army — has been sentenced to 42 months in a U.S. federal prison. In 2013, his group hijacked the Associated Press's Twitter account and posted a fake tweet saying President Obama had been injured in White House explosions. The false report wiped $136 billion off the stock market in minutes before it was corrected.
↗ The Hacker NewsA customer in Indonesia bought a hardware wallet called Trezor Safe 5 from a reseller named CryptoBilis — and found an extra circuit board hidden inside it. That board reads the wallet's secret recovery phrase and quietly sends it out over a mobile network every time the device is plugged in. Trezor says anyone who bought from CryptoBilis since March 2026 should move their funds immediately.
↗ BleepingComputerThe world's largest crypto exchange, Binance, says a staggering $6.3 billion in cryptocurrency was stolen — and the breach started with a single engineer's compromised work laptop. This would be one of the largest crypto heists in history. The investigation is ongoing.
↗ BleepingComputerHackers started targeting a serious flaw in WordPress just two days after a patch was released. The flaw affects WordPress Core versions 4.7 through 7.1.3 and lets an attacker run their own code on your web server. The attack only works during a narrow window while WordPress is applying a full update — but nearly 63,000 attempts were recorded in a single 24-hour period, showing attackers are watching closely and moving fast. No CVE number has been assigned yet.
Polymarket, a popular prediction betting platform, temporarily shut down trading after attackers compromised a third-party service it relies on. The hackers injected a malicious JavaScript snippet that drained cryptocurrency directly from users' connected wallets. About $2.5 million has been traced to a suspected attacker wallet.
TeamViewer is software millions of people use to remotely control another computer — think IT support taking over your screen to fix a problem. This flaw flips that relationship on its head: the machine being controlled can attack the person who connected to it. A malicious or compromised host computer can crash the viewer's TeamViewer app and, in some cases, run code on the viewer's machine. It affects Windows, macOS, Linux, and Android versions before 15.83.
Status: Patch available — update to TeamViewer version 15.83 immediately.
A hacker group called UAT-11473 is actively exploiting a flaw in Cisco's SD-WAN controllers. The bug lets attackers bypass login entirely — no password needed. Once in, they install custom malware called KeyDrift that gives them a persistent foothold in the network. SD-WAN controllers are critical pieces of corporate network infrastructure.
Status: Patch available — Cisco has issued a fix; network admins should apply it without delay.
GitLab patched a maximum-severity vulnerability earlier this month, and now CISA — the U.S. government's cybersecurity agency — confirms attackers are actively exploiting it in the wild. GitLab is used by developers to store source code, so a breach could expose proprietary software and credentials across entire organizations.
Status: Patch was released earlier this month — if your team runs a self-hosted GitLab instance, check that it's fully updated now.
Researchers discovered a batch of malicious Chrome extensions with a combined 13.4 million installs that were quietly redirecting users' searches to different engines — likely to earn ad revenue or harvest search data. This discovery is a reminder that browser extensions carry real risk. Google is working to remove them. In the meantime, it's worth auditing what extensions you have installed: go to chrome://extensions in your browser, remove anything you don't recognize or haven't used recently, and only install extensions from developers you trust. Fewer extensions means a smaller window for attackers to sneak something in.
The whole point of a hardware wallet is that your money is safe even if your computer is hacked — because the secret keys never leave the physical device. That promise just took a serious hit. A customer in Indonesia discovered his Trezor Safe 5 had been physically tampered with before he even opened the box.
Hidden between the wallet's main board and its screen was an extra circuit board that nobody was supposed to know about. It had a cellular module — basically a tiny SIM card chip — and an antenna. Every time the wallet was plugged in, that hidden board read what was displayed on the screen, including the recovery phrase, and sent it out over the mobile network to whoever planted it. The attacker didn't need to be nearby. They didn't need to hack anything. They just waited for the victim to set up the wallet.
This is called a supply chain attack. The wallet was genuine Trezor hardware bought through a legitimate-looking reseller called CryptoBilis, listed on the Indonesian marketplace Tokopedia. Trezor has not been able to examine the device yet — it's still being shipped to their lab — but they found the customer's account credible enough to issue a public warning the same day. Anyone who bought a Trezor from CryptoBilis since March 2026 is potentially affected.
This case matters far beyond Trezor. It shows that even "offline" security devices can be compromised if you don't buy them from the right place. Trezor's own advice: always buy directly from their official website or a verified authorized reseller. When you receive a new hardware wallet, check it carefully for signs of tampering — loose seams, broken holographic seals, or anything that looks off. And if you're ever uncertain, generate a new seed phrase on a freshly verified device before putting any funds in. The hardware wallet market will likely face much tighter scrutiny from regulators and resellers in the weeks ahead.