ENDLESSDOORS: The $30 Router That Turns Self-Custody Into a Shared Secret

Every 35 seconds, a packet leaves your home. You didn't send it. You didn't schedule it. And no firewall log you can actually read will ever show you what it contains. That's the rhythm of CVE-2026-66747 — the hardcoded 'skworker' init script that sleeps for 35 seconds, wakes, and phones home to an endpoint nobody named, over a channel nobody encrypted.

The code didn't hide. It was baked into the firmware as a root-owned init.d daemon — 'skworker' — sitting alongside the legitimate services, set to launch before your family ever finished unboxing the router. The trigger is a reserved string: 'rctlbash'. Type it — or have a remote attacker type it on your behalf — and you get a real-time root shell. No authentication. No token. No audit trail. Just a root shell on the device that carries every packet your wallet, your seed phrase, and your smart lock ever touched.

VulnCheck's CTO Jacob Baines found it. The CVE is 2026-66747. The CVSS score is 9.3 — Critical. The affected hardware is Zbtlink and Wiflyer branded routers, more than 20 models, manufactured by Shenzhen Zhibotong Electronics, sold to more than 100,000 households through Amazon, Walmart, and eBay. And if you are a crypto user, I need you to understand something immediately: that router was not just a router. It was the trust anchor for every private key decision your household made for years.

Context: The Trust Root You Never Audited

Let me frame this the way I frame a DAO treasury hack. In 2018, I spent four weeks reverse-engineering the EVM opcode differences that enabled The DAO reentrancy attack. The mainstream press called it a 'hack.' I called it a design flaw that the economic incentives made inevitable. The lesson I carried out of that exercise: you do not get to claim your protocols are secure because you audited the smart contract, if you never audited the node that signs the transactions.

The ENDLESSDOORS incident is that lesson, industrialized and shipped to 100,000 homes.

Zbtlink and Wiflyer are not exactly household names. They are the bottom of the Amazon router stack — aggressively priced boxes that promise plug-and-play setup, dual-band Wi-Fi, and enough ports to make a smart home work. They sit on shelves next to routers from companies that spend actual money on firmware security. Consumers pick the cheaper one. That's the business model.

The device category matters more than the brand. A router is the single most privileged piece of hardware in a modern home. It sits at the network boundary. It sees every DNS query, every HTTP session, every TLS handshake — even if it can't read the encrypted contents, it knows who you talk to, when you talk to them, and from which device. Install a root backdoor on that box, and you've effectively installed a listening post inside the most sensitive infrastructure the average person owns.

And here's the part that should make every crypto user's stomach drop: the modern self-custody setup — a hardware wallet, a laptop running a browser extension, a node relaying blocks, a Home Assistant instance executing local AI agents — all of it runs behind this unverified network appliance. The security industry has spent a decade convincing people to secure their keys. Nobody told them to secure the thing that sees the keys being typed.

Core: The Backdoor as a Smart Contract Audited by Nobody

Let me take you through the technical architecture the way I would walk through a suspicious contract's bytecode. Because the parallels are uncomfortable.

The Artifact

The backdoor is not a complex, multi-stage exploit chain. It's the opposite. It is the simplest possible implementation of persistent remote control:

• A shell script named 'skworker' lives in the router's init.d directory
• It runs at boot, with root privileges
• Every 35 seconds, it sends a status beacon to a hardcoded C2 endpoint
• The communication is unencrypted and unauthenticated
• A reserved string 'rctlbash' — likely accepted at the network gateway — returns a live interactive root shell

This is the equivalent of a smart contract with a hardcoded admin key that can withdraw everything, and where the 'admin' function is marked public and documented in the source.

From my audit experience: the first thing I look for in an unfamiliar contract is whether the owner can move funds without a timelock. The second is whether the owner key is a multi-sig. The third is whether the contract even tells you who the owner is. ENDLESSDOORS answers all three in the worst possible way. There is no timelock, there is no multi-sig, and the 'owner' is not disclosed — the backdoor is designed to be a silent, permanent, unrevocable master key.

The 35-Second Heartbeat

That 35-second interval is the tell. When I traced the Terra/Luna death spiral in May 2022, the metric that mattered was the cadence of UST depeg arbitrage — every few seconds, the market tested the peg mechanism, and each test failed. Here, the cadence is the backdoor's own stress test: 35 seconds is short enough to maintain a near-realtime command channel, long enough to be unnoticed in the noise of a busy home network.

Compare this to a legitimate 'after-sales support tool' — the justification Zbtlink reportedly gave. If you are a manufacturer who needs to debug a customer's router, you open a one-time SSH session. You don't embed a permanent, always-on heartbeat that calls home every 35 seconds, over plaintext, without authentication. The design pattern is not 'support.' The design pattern is 'inventory management.' This is the architecture of a device that is expected to be remotely controlled — a zombie asset, not a consumer product.

That heartbeat is the on-chain equivalent of a transaction every 35 seconds from a wallet you don't know, to a contract you can't see, with no event logs emitted. The blockchain would flag that as anomalous behavior. Your home router does not have a block explorer.

The Crypto-Specific Blast Radius

I deal with a lot of people who pitch me 'secure hardware.' They have secure enclaves, secure elements, secure boot chains. And every single one of them assumes the network underneath is trustworthy. ENDLESSDOORS inverts that assumption with the elegance of a classic exploit.

Consider what an attacker with a root shell on your router can do to a crypto user:

• DNS hijacking: Your wallet extension tries to connect to a node's API. The router rewrites the DNS response. You are now signing transactions against a malicious RPC endpoint. Your wallet shows the 'correct' balance until it doesn't.
• TLS interception: Your seed phrase is typed into a cloud backup service over HTTPS. The router can't read it from the TLS layer itself — but it can insert a malicious certificate if your device trusts the router's root CA. Many consumer devices do, implicitly.
• Traffic analysis: Even without decryption, the router sees the timing and destination of every transaction broadcast, every node sync, every exchange login. That metadata is enough to profile a whale.
• Direct infrastructure access: If you run a Lightning node, a validator, or an MEV bot on your home network, the backdoor gives an attacker a foothold inside your infrastructure. Code executes faster than lawsuits.
• Supply chain pivot: The router knows every other device on the network. Smart locks, cameras, Home Assistant — all of them inherit the router's compromised state. When the router falls, the whole estate falls.

I covered the BZx flash loan exploit in 2020 within minutes of the first failed transaction — the reentrancy vector ran through composability, through the joining of one protocol's assets with another's logic. ENDLESSDOORS is the physical-layer version of composability risk. Your smart lock's encryption is irrelevant if the router negotiating the handshake is hostile.

Wallet Clustering, But for Whales You Can't See

In early 2021, I spent weeks analyzing 500+ wallets connected to the top Bored Ape sellers, mapping a coordinated wash-trading scheme that inflated floor prices by 300%. The methodology was simple: look for wallets that moved in lockstep, shared funding sources, and transacted in suspiciously rhythmic patterns.

What ENDLESSDOORS creates is the same pattern, inverted. The 100,000+ affected homes are not a community. They're a botnet — a distributed infrastructure where every device moves in the same rhythm, sharing the same hardcoded C2, responding to the same triggers. From the attacker's perspective, these are not customers. They are wallets in a cluster, all controlled by the same hand.

Volume was a ghost. The whales were the same hand.

And because the backdoor communicates over unencrypted channels, there is no encrypted evidence trail for the victim to discover. The signals are there — periodic outbound connection attempts, repeated DNS queries to an unknown domain — but they look like router firmware doing what router firmware does. Unless you have professional network-level monitoring, you will never see it.

The Institutional Trace

In January 2024, I tracked the private key movement of 120,000 BTC from dormant Coinbase cold wallets to BlackRock's new custody addresses. The story was not where the coins went — it was who moved them, and how carefully they moved. Institutional actors leave traces; they just move slowly and deliberately.

This backdoor leaves a different kind of institutional trace. The code itself is the forensic evidence. 'skworker' was written by someone. The C2 address was chosen by someone. The decision to compile it into production firmware was approved by someone. The fact that it shipped to 20+ models across multiple retail channels means it survived the manufacturer's build process, QA process, and regulatory review. This is not a single rogue developer slipping malicious code through a CI pipeline. This is a systemic failure of the entire supply chain — or a deliberate, organized decision.

Which one it is matters less than the conclusion. The trust anchor of 100,000 homes was poisoned at manufacturing time, and nobody at any downstream point — not the brand owner, not Amazon, not the consumer — had the ability to detect it.

The Hidden Business Model

There is a theory that this is a 'state-sponsored' operation. I am skeptical. State actors don't need to sell routers on Amazon to achieve network access. State actors target specific systems. A backdoor in 20+ consumer router models, sold through mainstream retail, is not a targeted operation — it's a numbers game.

The numbers suggest a different motive. Consumer router margins are razor-thin. The lifetime value of a $30 router customer is... $30. But a device that phones home every 35 seconds, with root access to a household's network, is worth far more than $30. It's a remote-controlled asset. It can be a proxy for other attacks. It can be an entry point for ransomware. It can be a surveillance node. None of that has anything to do with the user's happiness — and everything to do with the user's data.

This is the 'ghost ARR' model that I've seen in the software world: recurring revenue that exists off the books. In this case, the recurring value is not a subscription. It's the ongoing extraction of a household's network trust. Zbtlink may claim this is a support tool, but in the cold light of unit economics, the backdoor is the only part of the product that generates recurring value — and it's value extracted from the customer, not delivered to them.

The Regulatory Bomb

The FCC has been signaling for years that consumer routers need a cybersecurity certification program — the Cyber Trust Mark. This is the incident that makes it inevitable. When a regulator says 'we need a labeling program,' they are always reacting to something. This is the something. Expect washing-machine-style energy labels, but for endpoint security.

And the data-privacy problem is global. The backdoor transmits data without encryption, without consent, to an endpoint that is not disclosed. Under GDPR, that is a fundamental violation of data minimization and informed consent principles. Under CCPA, same story. Add cross-border data transfer: a Chinese manufacturer's router sending unencrypted data out of a US home is a textbook violation of China's data export rules as well as the target country's laws. This is not a compliance incident. This is a multi-jurisdictional liability event.

Contrarian: Everyone Is Blaming the Wrong Layer

The emerging mainstream narrative is predictable: 'Chinese manufacturer sells backdoored routers, Western consumers should buy from trusted brands.' I find this narrative dangerously incomplete. Here is what it misses.

First, the backdoor is not a hack. It's a design decision. Zbtlink's own defense — that ENDLESSDOORS was an 'after-sales technical support tool' — is, if true, more damning than if it were espionage. A company that thinks an always-on, unencrypted, unauthenticated root backdoor is an acceptable support tool has no security culture whatsoever. Code is law, but logic is justice. And the logic here is that a support tool does not need a 35-second heartbeat.

Second, the Western 'good brands' are not as safe as the narrative implies. The difference between Zbtlink and a 'trusted' Western brand is a difference of degree, not of kind. The consumer IoT supply chain is global. The chips come from the same fabs. The firmware is often licensed from the same SDK providers. The only difference is which round of pennies were shaved off to hit the price point. Nobody — not one major router brand — has published a complete software bill of materials for every SKU they sell. Nobody can prove their firmware was built on a trusted build server with signed artifacts. The trust gap is not geographical. It's structural.

Third, the crypto community's response has been characteristically self-congratulatory. We pat ourselves on the back for self-custody, for hardware wallets, for 'not your keys, not your coins.' Then we plug those hardware wallets into a network that we have zero visibility into. The threat model was always asymmetric: you secure the key, I attack the network. The seed phrase is safe on its metal card. It's unsafe when the laptop behind the backdoored router is syncing it. We have spent years auditing smart contracts while ignoring the network layer that carries the signatures.

Fourth — and this is the one I expect to be proven correct in hindsight — the real collateral damage is not the 100,000 homes. It's the way this will be used to justify sweeping import restrictions on Chinese-made IoT hardware. The FCC's proposed rule to ban routers from 'adversarial countries' will now be argued for with this CVE in hand. A legitimate security finding will be weaponized into geopolitics. That should worry everyone who cares about a global, open market for technology — because the next backdoor might be a US-made router, and the political climate doesn't care which direction the traffic goes.

What the ENDLESSDOORS incident actually demonstrates is that we are all trusting a $30 commodity appliance to be the custodian of our digital lives, and that trust is unilluminable.

The Home Assistant Twist

There is a specific knock-on effect that deserves its own paragraph. The Home Assistant ecosystem — the local-first smart home AI movement — is building toward a future where AI agents run locally in your home, collecting data from every sensor, camera, and lock. That's the exact future that the iRobot narrative cautioned us about: when your AI platform can see your home, trust in the platform is a prerequisite.

Set an AI agent loose on a home network behind an ENDLESSDOORS-compromised router, and you have not built a smart home. You have built a compromised panopticon. A local AI's training data — your daily patterns, your family's schedules, your home's security posture — becomes a reward for whoever controls the router. The move toward local AI, which many in our industry see as the antidote to cloud surveillance, is undercut if the local hardware is owned by an unaccountable third party. It's not enough to be 'local-first.' You have to be 'trust-verified at the foundation.'

Takeaway: The Watchlist

In a sideways market, where every chart looks like a compressed spring and the only actionable signal is positioning, I find myself applying the same logic to infrastructure: the chop is where the best risk/reward setup hides. The 'position' for a security event like this is not shorting a router company. It's anticipating the structural shift that follows.

Watch three things over the next 12 months. First, the FCC Cyber Trust Mark — if ENDLESSDOORS accelerates its mandatory rollout, every router sold in the US will need a security label, and the cost of that compliance will reshape the low-end market. Second, the emergence of 'secure by design' router startups and open firmware projects — the gap between what consumers trust and what they should verify is about to become a funded category. Third, the next disclosure. This was one manufacturer, one backdoor, 100,000 homes. There are dozens of low-cost IoT vendors shipping the same way. The 35-second heartbeat is a rhythm, and rhythms repeat.

Truth is not mined; it is verified on-chain — and now, off-chain too. The router is part of your stack. Audit it like one.

I opened this article with the packet that leaves your home every 35 seconds, unseen and unencrypted. I'll close with a question that haunts me from my DAO post-mortem days: if you cannot see the infrastructure that carries your keys, can you genuinely claim to hold them?

Genesis block. Hardware wallet. Root shell.

Not your router. Not your node. Not your security.