Here is the data: CVE-2026-66747. CVSS 9.3. Critical. Over 100,000 homes. A backdoor named ENDLESSDOORS sitting inside the init.d scripts of 20-plus router models sold under the Zbtlink and Wiflyer brands. The trigger: a hardcoded string — 'rctlbash' — typed into the network gateway. One string. Root shell. Complete network ownership.
VulnCheck's CTO Jacob Baines discovered it. Shenzhen Zhibotong Electronics manufactured it. Amazon, Walmart, and eBay distributed it. Zbtlink now calls it an "after-sales support tool." The company says it halted sales and is developing a firmware update.
Let's hold that claim while I run the arithmetic. The firmware ships with root-level unauthenticated access. It sends unencrypted beacon packets to an external endpoint every 35 seconds. This is not a hack. This is a supply chain built to fail on purpose. And for anyone holding private keys on a machine downstream of these routers — which includes most of crypto — the threat model just shifted in a way the market has not priced.
The Technical Baseline
ENDLESSDOORS runs as root. It boots through the skworker init.d script. Every 35 seconds, it sends a heartbeat to a hardcoded C2 endpoint. The communication is unencrypted and unauthenticated.
Read that again: unencrypted. Unauthenticated. Root privileges. Persistent beacon.
This is not advanced persistent threat sophistication. This is the equivalent of a startup developer pushing a private key to a public GitHub repo and calling it a "configuration management decision." The engineering baseline is not merely negligent. It is adversarial.
The consumer experience is "plug and play." The security experience is "plug and prey." Most buyers will never check firmware signatures. They will never inspect the boot chain. The router's security state is invisible to them by design. The manufacturer built its product around the assumption that the user's ignorance is a permanent architectural feature.
From a security architecture lens, this is a system optimized to be hostile to its owner: - Pre-installed root backdoor in the production firmware image - No authentication required to trigger the root shell - No encryption on the C2 channel - No external firewall bypass necessary — the backdoor already lives inside the perimeter - Backdoor enabled by default on every shipped device
The "diagnostic tool" claim fails the simplest engineering tests. If you need to service a router remotely, you open an authenticated, time-limited SSH session. You do not hardcode a universal trigger string into production firmware. You do not establish a 35-second persistent heartbeat to an external endpoint that functions as a standing data exfiltration channel. The design bears the unmistakable fingerprint of a permanent remote-access business model. Every deployed device is an asset. Every network is a lease. Every user is an income stream.
Call it a support tool. The code calls it a custodial key given away without a signature.
The Trust Root Problem Crypto Ignored
The crypto industry spent ten years building verifiable trust at the application layer. We audit smart contracts. We formalize zero-knowledge proofs. We argue about slasher conditions, withdrawal delays, sequencer decentralization. All of this is meaningful. None of it matters if the physical substrate is owned.
A router is the trust root of a digital life. It sits between the user and every remote service. Every exchange API request. Every MetaMask call to Infura. Every node's gossip traffic. Every session cookie from a cloud dashboard. All of it traverses the router. A compromised router does not need to break encryption. It needs to watch traffic, redirect DNS, and record credentials before encryption matters.
The smart lock on the front door? Its encryption is decorative if the router is compromised. The laptop's secure enclave? A ceremonial box when the network pipe is hostile. The hardware wallet? Safe for the private key — but utterly incapable of protecting the user from frontend manipulation, DNS redirection to a phishing exchange, or mempool surveillance by an attacker with network-level visibility.
Here's where I get personal. In early 2023, I allocated $30,000 to early EigenLayer restaking positions. I spent two weeks with ETH developers verifying slasher conditions, consensus-layer mechanics, and the economic security model. We interrogated the node operator set. We stress-tested re-org scenarios. I never once asked what router carried my signed transaction to the consensus layer. That is the industry-wide blind spot. We built a discipline called "don't trust, verify" — and then plugged the whole thing into a white-label router that pings an unknown server every 35 seconds.
In DeFi, we reject un-audited yield sources because the code can rug us. In physical infrastructure, we accept un-audited firmware with a literal root backdoor. The asymmetry is indefensible. A smart contract exploit costs you the balance in one contract. A compromised router costs you every credential, every session, every transaction that touches the network — for as long as the device sits in your home.
The Ghost Subscription: What the 35-Second Beacon Actually Is
Most coverage treats this as an IoT security story. It is not. It is an asset-ization story.
Every 35 seconds, each ENDLESSDOORS device sends a packet to a hardcoded endpoint. No authentication. No encryption. A persistent, one-way data channel that the controller can flip into a two-way root shell at any moment.
From an operating perspective, this is a standing botnet asset pool. 100,000 devices. 24 hours a day. Continuous beacons. Ready for DDoS-for-hire. Ready for residential proxy networks. Ready for password-spraying campaigns originating from hundreds of thousands of legitimate household IP addresses. Ready for the kind of credential-stuffing that gets retail exchange accounts drained — not because the exchange was breached, but because the user's network pipe was watching their session tokens.
The retail buyer believes they made a one-time hardware purchase. The controller believes they received a lifetime subscription to the buyer's home network. The manufacturer collected the hardware margin. The backdoor operator collects the recurring yield. The user collects the risk. This is the physical-world equivalent of "ghost ARR" — recurring revenue extracted from assets the user never knowingly surrendered. The product wasn't the router. The product was the home.
The conceptual bridge for crypto audiences is uncomfortable: this is what a malicious validator does. It stands up infrastructure, attracts delegation, and extracts value from a position of trust. The only difference is that this validator never asked for delegation. It shipped itself into 100,000 homes inside a cheap plastic case.
Attack Vectors: What a Rooted Router Does to a Crypto User
Let me enumerate the specific attacks, because the abstract language obscures the concrete danger. A backdoored router grants an attacker:
DNS hijacking. Modify responses for app.uniswap.org, app.aave.com, or your exchange's domain. The user types the right address. The browser loads a phishing clone. The transaction that gets signed is not the transaction the user intended. The hardware wallet signs it because it cannot verify the frontend. This is the most efficient wallet-drain vector that exists. No malware on the user's machine. No compromised seed phrase. Just a network pipe that lies.
Session token theft. Eavesdrop on exchange API sessions. Steal cookies from traffic the user assumed was protected by TLS. TLS protects content from intermediaries on the network path — but the router is not an intermediary. It is the endpoint of the physical path. In many real-world configurations, especially with older devices and misconfigured TLS termination, the router sees plaintext session headers.
Mempool surveillance. For node operators, a rooted router means the attacker sees broadcast transactions before they propagate. In a world where MEV extraction is a sophisticated industry, network-level visibility is the ultimate edge. You do not need to front-run a transaction you can observe before the network does.
Credential replay. Password managers, email clients, SSH keys, cloud dashboards — every credential that transits the network is visible. The attacker does not need to decrypt anything if they can harvest plaintext authentication tokens from misbehaving applications.
AI agent poisoning. This one gets overlooked. Local AI agents — trading bots, automation tools, Home Assistant instances — all consume data from the network. A compromised router can feed them false market data, modified smart contract responses, or poisoned API responses. The AI agent's decision logic is irrelevant if its inputs are controlled by an attacker. My own experience stress-testing an AI trading platform in late 2025 taught me that these agents fail in unpredictable ways — but a poisoned network makes their failure deterministic.
The common thread: every attack vector operates below the application layer. Below the wallet. Below the smart contract. Below the agent. At the level crypto users were told not to worry about.
The Retail vs. Smart Money Divergence
Let's talk about information asymmetry.
The retail crypto user believes security is a function of wallet choice. They upgrade to a hardware wallet. They feel sophisticated. Meanwhile, the router between their laptop and the exchange is a rooted node in an unknown botnet. They applied a security patch at the application layer and left the physical substrate owned by a stranger.
The smart-money attacker does not target the application layer. They target the substrate. A keylogger is noisy. A fake frontend requires the user to make a mistake. But a router that silently inspects traffic and exfiltrates session cookies does its job on a 35-second heartbeat that no user will ever notice. The asymmetry could not be more brutal: retail defends the application; smart money owns the infrastructure.
From running ETF flow arbitrage in 2024, I learned that institutional traders think in terms of where the structural inefficiency actually sits. The same logic applies to security. The structural inefficiency in crypto security is not the smart contract. It is the un-audited supply chain beneath it. The smart money exploits the substrate. The retail defends the signature. That is the edge.
The Wrong Lessons Being Learned
The predictable narrative will be geopolitical. Chinese-manufactured routers are spyware. This is lazy. The evidence suggests economic motivation, not state direction. A backdoor designed for remote management is a monetization channel — an IoT rug pull — not an intelligence operation. Conflating the two obscures the actual systemic failure.
The real systemic failure is the platform. Amazon, Walmart, and eBay sold these devices. They provided the trust halo. They collected the marketplace fees. They conducted zero supply-chain security verification. A retailer that would refuse to stock unlabelled food without a health inspection has no equivalent mechanism for router firmware. The platform economy externalizes the security cost while socializing the risk. That is the structural problem.
The second wrong lesson is victim-blaming. The claim that users should detect this with network-level monitoring is technically true and practically useless. Consumers cannot audit firmware. They cannot detect C2 beacons. They cannot read packet captures. The burden belongs on manufacturers, regulators, and the retail platforms that certified these devices by listing them. We do not ask consumers to test their food for salmonella; we have agencies for that. The network equipment market has no equivalent. This event is the evidence that it needs one.
Meanwhile, 71% of Americans already believe AI reduces their personal data security. They worry about the algorithm. They should worry about the router.
Where the Opportunity Sits
It would be easy to close pessimistically. I do not trade that way.
Doors close. Windows open. This event creates an information asymmetry with measurable value.
First, network-level security monitoring is now an evidenced need. If detecting this activity requires network-level monitoring most households do not have, that is a product gap, not a tragedy. Home network monitoring agents that flag anomalous DNS queries, unknown C2 beacons, and irregular heartbeat intervals would have exposed ENDLESSDOORS within minutes. The "security as a service" layer for the smart home just got its first real-world justification.
Second, security-first router positioning becomes a viable differentiation strategy. The flight from low-cost white-label hardware will accelerate. Brands that demonstrate signed firmware, hardware root of trust, and transparent supply chains will capture the fleeing demand. In crypto terms, this is a flight to quality during a stablecoin depeg — same behavior, different asset class.
Third, the hardware wallet argument strengthens. Cold storage was already the standard for self-custody. This event adds a requirement: hardware wallets must be used on networks you do not trust, because there is now direct evidence that the network cannot be trusted. The air gap expands from "private keys never touch the internet" to "the internet touches your home through a device you never audited."
Fourth, for node operators and power users, the calculus is clear. Run nodes on segmented networks. Use dedicated hardware. Never place a hot wallet on a network behind an un-audited consumer router. This is not paranoia. This is a 9.3 CVSS score telling you exactly where the risk sits.
Takeaway
Here is the forward reading.
Crypto's security narrative has been application-layer for a decade. Smart contract audits. Multi-sig vaults. Threshold signatures. Zero-knowledge proofs. All of it rides on physical infrastructure that nobody audits, manufactured by an industry with no accountability, and distributed by platforms that verify nothing.
ENDLESSDOORS is not a one-off. It is the canary. There are more of these. There are routers in active use with worse implementations, or the same backdoor on unsupported firmware. The only rational position is defense.
Treat every consumer router as a potential adversary. Assume the device connecting your home to the internet is not your property but a leased asset belonging to an unknown principal. Replace white-label hardware with verified firmware. Segment the network. Monitor for beacon patterns. And if you hold a hot wallet or run a node behind an un-audited router, assume the data that traversed it is compromised. Act accordingly.
The market is not pricing physical-infrastructure risk. That means the market is underpricing tail events. When an attacker decides to drain a thousand retail wallets through a compromised supply chain, the market will call it a black swan. It will not be. The evidence was in the CVE all along.
The question nobody is asking: if 100,000 home routers can be silently enrolled into a botnet with zero user interaction, what else in the supply chain is already listening?