TheNostr Observer

Supply Chain Compromise: Ledger Confirms Hardware Implant Stole Recovery Phrases from Nano X

A custom cellular sub-board intercepted 24-word recovery phrases directly off the screen at setup while passing cryptographic authenticity checks; the disclosure intensifies debate over cold storage security and physical custody.

In a revelation sending shockwaves through the hardware custody ecosystem, hardware wallet manufacturer Ledger confirmed that a customer whose device was drained had fallen victim to a sophisticated physical supply-chain implant. According to reporting from Coincards.com, Ledger confirmed today a drained customer's Nano X had a hardware implant. Rather than a software exploit or firmware compromise, the device contained an unauthorized miniature board soldered inside the casing: A tiny board with its own SIM reads your 24 words off the screen at setup and sends them out. Crucially for the victim, The genuine check still passes.

The revelation highlights a long-standing vulnerability in physical hardware distribution channels: intercepting devices between the factory and the consumer. When hardware is purchased through secondary resellers or compromised shipping pathways, cryptographically signed firmware checks verify genuine factory microcontrollers but fail to detect rogue peripherals tapping the display lines. Coincards issued an unambiguous warning to anyone who acquired hardware outside direct manufacturer channels: Bought from a reseller? New device, new seed.

The disclosure sparked immediate soul-searching among Bitcoiners evaluating their operational security posture. V3spering reflected the exasperation of many in the network: At this point why even bother with cold storage devices … 🤷🏻‍♂️ [s233]. The incident comes against a backdrop of escalating physical threats to self-custodians. In France, where violent home invasions have targeted Bitcoin holders, legislative authorities have proposed compelling holders of more than €100,000 in self-custody to register their addresses with the tax office under threat of heavy fines—the very agency where an employee was recently indicted for selling investor addresses to criminal gangs [s150]. As Jeff Booth observed, the resilience of privacy systems depends on removing single points of failure: Building in a hostile environment to freedom tech only makes freedom tech stronger. [s129].

DEED Outpaces NAK Sixteen-Fold in 53-Benchmark CLI Sweep

Zig-based client implementation delivers 64x faster startup, 35x lower memory consumption, and 8x smaller binary footprint while adding disk-persisted relay and offline thread traversal.

For command-line power users and relay operators wrestling with client overhead, developer September published a comprehensive 53-test benchmark sweep evaluating DEED, a Nostr command-line utility implemented in Zig. The results revealed an overwhelming performance delta across every measured axis: DEED is about 16 times faster or smaller than NAK on average. According to the author's testing, DEED beats NAK on all 53 benchmark comparisons.

The architectural advantages of native systems code were especially visible in runtime footprint and startup latency. September noted that DEED demonstrated 64x faster on Startup alongside a footprint 35x smaller on Memory at startup and 8x smaller on Binary size. In batch cryptographic throughput, DEED clocked 62x faster on Verifying 10,000 events while completing 10,000 draft signatures forty-four times faster. Beyond raw speed, the utility covers almost the entire NAK command surface while introducing offline reads, whole-thread stitching, mnemonic key handling, a disk-persisting local relay, and native proxy routing.

Routstr Deploys Enclave-Free Confidential Inference Proxy

Decentralized AI inference took a significant leap forward this weekend as Juraj Bednar published Routstr's confidential routing architecture, eliminating reliance on proprietary hardware enclaves (TEEs). Explaining the breakthrough, Bednar noted that Routstr has a confidential mode where client and node cooperatively establish TLS 1.3 sessions with upstream providers. Under the protocol, Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can't change a single byte of the response, tool calls included.

Furthermore, Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. Adoption proved immediate: within 24 hours of release, developer service Graspable went live with Routstr confidential inference. Reflected Bednar: This exponential is something that is very hard to grasp (pun intended) for me.