New Crypto Wallets Arrived With Malware Already Installed

A new report details how crypto hardware wallets were compromised before reaching customers, alongside analysis of zero-click attacks and AI agent risks.

A recent security analysis has uncovered a sophisticated supply chain attack targeting cryptocurrency users, where brand new hardware wallets were shipped with pre-installed malware. According to the Smashing Security podcast, these devices appeared factory-sealed, giving buyers a false sense of security. The report highlights a critical vulnerability in the physical distribution chain, a vector that bypasses many standard digital security measures. The same analysis also brought attention to two other emerging threats: zero-click malvertising campaigns specifically targeting journalists and the opaque activities of AI agents running on employee laptops. These distinct issues all point to a common theme of attackers exploiting trusted channels and new technologies to execute stealthy, high-impact compromises.

Supply chain attacks on hardware are particularly insidious because they corrupt a product before it ever reaches the end-user. In this case, attackers likely intercepted the hardware wallets somewhere between the factory and the distributor or retailer. They would then carefully open the packaging, modify the device's firmware or internal components to include a backdoor, and then expertly reseal the package to make it indistinguishable from a genuine, untampered product. This backdoor could allow attackers to steal private keys the moment they are generated or used on the device, draining the user's crypto assets. Because the compromise is at the hardware or firmware level, it is extremely difficult for the average user—or even many security tools—to detect. The attack subverts the very purpose of a hardware wallet, which is to provide a secure, offline environment for cryptographic keys.

The incident fits into a broader trend of attackers shifting their focus to more foundational layers of technology. As operating systems and applications become more secure, adversaries are targeting firmware, hardware, and the physical supply chain itself. These vectors are often less monitored and harder to patch than software vulnerabilities. This strategy mirrors the sophistication seen in the other threats discussed, such as zero-click malvertising. In those attacks, a malicious ad can compromise a device without any user interaction, exploiting vulnerabilities in the browser or operating system's ad-rendering pipeline. Similarly, the rise of autonomous AI agents on corporate networks introduces a new class of risk. These agents, often installed by employees to boost productivity, can access sensitive data and perform actions with a level of autonomy that security teams are not yet equipped to monitor or control, creating a potential insider threat vector.

For technical and security leaders, these developments demand a fundamental reassessment of trust and verification. The hardware wallet incident proves that trusting factory seals is no longer sufficient; organizations must consider procurement from highly vetted, direct-from-manufacturer channels. For critical hardware, implementing procedures to verify firmware integrity upon receipt may become necessary. The threat of zero-click exploits reinforces the importance of robust ad-blocking, browser isolation technologies, and timely patching for all software, especially for high-risk employees. Finally, the challenge of AI agents requires immediate attention. Companies need to establish clear governance policies that define which AI tools are permissible, what data they can access, and how their activity is logged and monitored. Without proactive policies, organizations risk allowing unaudited, autonomous code to operate within their most sensitive environments.

This highlights the persistent threat of supply chain attacks, even for security-focused hardware. For developers and security teams, it proves that physical device integrity cannot be assumed, requiring verification measures beyond just checking for shrink-wrap or superficial signs of tampering.

Compromised hardware, whether for crypto or corporate use, represents a severe breach vector that bypasses traditional network security. This incident underscores the financial and reputational risks of supply chain vulnerabilities, forcing companies to re-evaluate procurement policies and vendor trust.