Markets
News
Analysis
User
24/7
Economic Calendar
Education
Data
- Names
- Latest
- Prev
Trending
Indices
US
Crypto
Forex
Commodities
Futures
SYMBOL
LAST
NET CHG.
%CHG.
BID
ASK
HIGH
LOW
SPREAD
- All
- Chatrooms
- Groups
- Friends
Connecting
.
.
.
US
VN
TW
- All
- Trump Trade
- Israel-Palestine Conflict
- Russia-Ukraine Conflict
Search
News
Trending Topics
Daily News
To quickly learn market dynamics and follow market focuses in 15 min.
Remarks of Officials
In the world of mankind, there will not be a statement without any position, nor a remark without any purpose.
Central Bank
Inflation, exchange rates, and the economy shape the policy decisions of central banks; the attitudes and words of central bank officials also influence the actions of market traders.
Forex
Money makes the world go round and currency is a permanent commodity. The forex market is full of surprises and expectations.
Latest Update
Risk Warning on Trading HK Stocks
Despite Hong Kong's robust legal and regulatory framework, its stock market still faces unique risks and challenges, such as currency fluctuations due to the Hong Kong dollar's peg to the US dollar and the impact of mainland China's policy changes and economic conditions on Hong Kong stocks.
HK Stock Trading Fees and Taxation
Trading costs in the Hong Kong stock market include transaction fees, stamp duty, settlement charges, and currency conversion fees for foreign investors. Additionally, taxes may apply based on local regulations.
HK Non-Essential Consumer Goods Industry
The Hong Kong stock market encompasses non-essential consumption sectors like automotive, education, tourism, catering, and apparel. Of the 643 listed companies, 35% are mainland Chinese, making up 65% of the total market capitalization. Thus, it's heavily influenced by the Chinese economy.
HK Real Estate Industry
In recent years, the real estate and construction sector's share in the Hong Kong stock index has notably decreased. Nevertheless, as of 2022, it retains around 10% market share, covering real estate development, construction engineering, investment, and property management.
Recent Searches
Top Searches
View All
No data
Search
Trezor discloses potential vulnerability in older Safe 3 crypto wallets following white hat research by rival Ledger
The Block
On March 5, hardware wallet provider Trezor disclosed a potential vulnerability in one of its older crypto wallet models. The attack is largely "theoretical" and would likely only affect users who purchased their device third-hand.
Trezor made the disclosure after its primary rival, Ledger, communicated the issue to the firm. On Wednesday, Ledger released additional insights into the exploit, exploring in greater detail how the extremely technical attack could be pulled off. Donjon, Ledger’s Paris-based security unit, reportedly reused a known "physical supply chain attack" and found that a particular Trezor model released in 2023, Safe 3, remains insecure.
"Ledger Donjon recently evaluated our Trezor Safe Family and successfully reused a previously known attack to demonstrate how some countermeasures against supply chain attacks in Trezor Safe 3 can be bypassed," Trezor said.
That said, the attack does not affect most of Trezor's wallets, including its most recent release, Trezor Safe 5, or its first two generations, Trezor Model One and Model T. Moreover, the attack depends on a specific set of circumstances and a high degree of expertise to pull off — making it impractical for widespread exploitation. For that reason, Trezor does not caution immediate action from Safe 3 users, especially if the device was purchased from official sources.
At some point, however, if a third party has physical access to a user's device, it may be at risk.
The attack
The attack demonstrated by Donjon exploits a weakness in Trezor Safe 3's microcontroller — a small, programmable computer chip that handles user inputs and signs transactions — using a technique called voltage glitching. If an attacker can physically access the device, desolder the microcontroller and apply precise voltage changes, he can trick the device into revealing its flash memory contents.
This enables the attacker to reprogram the microcontroller with malicious software, potentially allowing the attacker to reveal a wallet’s seed phrase and access the stored funds — whether the hacker currently has access to the device or manipulated it before a victim acquired it.
"While hardware wallets offer strong security, no system is entirely immune to physical attacks," Trezor writes. "Given enough time, expertise, and resources, a determined attacker could theoretically attempt to extract private keys from a stolen device."
To mitigate risks, newer Trezor models include a "passphrase," which is kept off the device as an extra layer of security for a wallet backup. It has also reinforced its multi-layered security, including firmware integrity checks. The Trezor Safe 5 also uses an upgraded STM32U5 microcontroller that is resistant to voltage glitching.
Staying safe
Both Trezor and Ledger suggest that users only purchase devices directly to ensure that a wallet has not been compromised. A third party, like an unauthorized reseller, could tamper with the device during the supply chain process and alter its hardware or software. In other words, users should be aware of a wallet's chain-of-custody, given that these attacks require physical possession, even briefly, of the hardware wallet.
Many newer hardware wallets contain a "Secure Element," a tamper-resistant physical chip in a device designed to protect sensitive information. The Secure Element locks a user's seed phrase behind a PIN, and includes a retry counter to prevent brute-force attacks. However, a weak PIN could still allow an attacker with physical access to unlock it. This is particularly true for Safe 3 devices, which remain vulnerable to microcontroller-based attacks. However, using a longer PIN can make exploitation more difficult.
Users can also check to ensure their wallets are running the correct firmware using the official Trezor Suite, which includes a verification step using a random challenge. Trezor notes users should update their devices to the latest firmware version as upgrades are released and, if there are signs of tampering, reset the device and restore it in a secure environment.
Perhaps most importantly, as Bybit recently learned after its $1.5 billion hack, users should always know whether they are interacting with the application or entity they think they are. This is difficult given the sophistication of certain exploits today, designed to conceal a malicious transaction by "spoofing" a wallet's UI. However, users can learn to use a separate, trusted device (like a clean computer) to avoid any hazards.
If these sound like technical solutions, it's worth noting again that these are highly sophisticated attacks. Unless North Korea's Lazarus Group can find a way to insert itself in the supply chain process between Trezor and an end user, it's unlikely to scale. Instead, if this attack is carried out, it'll likely be against a high-value target. However, that isn't to say users shouldn't be aware of this.
"At Ledger Donjon, our mission is to push the boundaries of security for the benefit of the whole crypto ecosystem," Ledger CTO Charles Guillemet said. "We appreciate Trezor’s responsiveness to this responsible security disclosure, and that Trezor addressed the vulnerabilities we found, showcasing the importance of continuous improvement and cooperation in the crypto space."
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
Risk Warnings and Disclaimers
You understand and acknowledge that there is a high degree of risk involved in trading. Following any strategies or investment methods may lead to potential losses. The content on the site is provided by our contributors and analysts for information purposes only. You are solely responsible for determining whether any trading assets, securities, strategy, or any other product is suitable for investing based on your own investment objectives and financial situation.
Copyright © 2025 FastBull Ltd
728 RM B 7/F GEE LOK IND BLDG NO 34 HUNG TO RD KWUN TONG KLN HONG KONG
Risk Disclosure
The risk of loss in trading financial instruments such as stocks, FX, commodities, futures, bonds, ETFs and crypto can be substantial. You may sustain a total loss of the funds that you deposit with your broker. Therefore, you should carefully consider whether such trading is suitable for you in light of your circumstances and financial resources.
No decision to invest should be made without thoroughly conducting due diligence by yourself or consulting with your financial advisors. Our web content might not suit you since we don't know your financial conditions and investment needs. Our financial information might have latency or contain inaccuracy, so you should be fully responsible for any of your trading and investment decisions. The company will not be responsible for your capital loss.
Without getting permission from the website, you are not allowed to copy the website's graphics, texts, or trademarks. Intellectual property rights in the content or data incorporated into this website belong to its providers and exchange merchants.