The Backdoor That Wasn't a Hack: What ENDLESSDOORS Says About Trust in Decentralized Infrastructure

CVE-2026-66747. A CVSS score of 9.3. More than 100,000 households. And a root shell that answers to the hardcoded word "rctlbash" with zero authentication. Every 35 seconds, the infected routers ping a command-and-control endpoint the user never authorized, sending unencrypted traffic from inside networks that carry smart locks, cameras, and children's homework. This is ENDLESSDOORS, the backdoor that VulnCheck's Jacob Baines found baked into more than 20 models of Zbtlink and Wiflyer routers, sold through Amazon, Walmart, and eBay. And here is the sentence that should keep anyone who believes in verifiable systems awake at night: these devices were not hacked. They were born compromised. The trust model was poisoned at the factory, on a production line in Shenzhen, before a single user peeled back the shrink wrap. When I wrote my first Spanish-language guide to trustless collaboration for the Buenos Aires Hyperledger meetup in 2016, I believed a simple promise: that cryptographic verification could replace blind trust in intermediaries. Nearly a decade later, I still believe it. But ENDLESSDOORS is the starkest reminder yet that verification only works when the thing being verified is actually visible. A router, to the person who buys it, is not visible. And as long as that's true, no amount of upstream consensus can protect the people downstream. Let's unpack the mechanics, because the details matter more than the headline. The backdoor launches through an init.d script named "skworker," which means it starts automatically at boot. It runs with root privileges — no sandbox, no privilege separation, no attempt to hide beyond living inside ordinary firmware. A developer hardcoded the trigger phrase "rctlbash" into the gateway logic, so that anyone who knows the string — and now the entire internet knows it — obtains an interactive root shell on the device. From there, the router becomes property of whoever connects. The 35-second heartbeat ensures the operator always knows the device is alive. The communication is unencrypted, which is not a mistake: this is not a spy operation worried about packet inspection. The manufacturer, Shenzhen Zhibotong Electronics, responded the way every compromised vendor responds. It called ENDLESSDOORS an "after-sales technical support tool," stopped sales, and promised a firmware update. I have seen this maneuver up close. In 2022, when the Terra collapse shattered a DAO I was helping to mediate, the founders reached for the same vocabulary — calling catastrophic design failures "operational incidents" and asking the community to focus on "forward-looking fixes." But calling a persistent, preinstalled backdoor a "support tool" is like calling a wiretap a customer-feedback mechanism. The engineering tells a different story. If the goal were legitimate support, a single on-demand SSH channel would suffice. A 35-second heartbeat with a remote shell attached is not maintenance. It is ownership. And there is no evidence that this was the work of a sophisticated state-sponsored operation, which makes it more disturbing, not less. This looks like the ordinary output of a low-cost supply chain in which firmware is contracted out, security review is skipped as a cost-saving measure, and products ship because the price point clears an algorithmic bar. ENDLESSDOORS is not an anomaly. It is a feature of a market that externalizes trust. To the households affected — and to the thousands more who unknowingly bought similar devices — I want to say something direct: this is not your fault. You did not fail to secure your home. The failure happened upstream, in a firmware factory you never saw and could never have checked. If this news makes you feel violated, you are right to feel that way. Reset the device, watch for unusual network activity, and if you cannot verify the firmware, assume the worst and replace it. That is the practical equivalent of my rule for community education: connect first, transact second, always. But when the connection itself is a trap, the only responsible transaction is disconnection. Let's zoom out, because this is where I can add something you will not find in a standard vulnerability write-up. In six years as a protocol PM in decentralized systems, I have learned that the most useful question for any security incident is: where is the trust anchor, and who controls it? In a smart home, the router is the trust anchor. It sits in front of every device — the smart lock's encryption, the camera's video feed, the AI assistant controlling the thermostat. When the trust anchor is corrupted, every downstream security investment evaporates. The smart lock can have the best cryptography in the world and still be standing on a floor owned by someone else. This is structurally identical to DeFi. I have argued for years that Aave's interest-rate model is arbitrary — disconnected from real market supply and demand — but at least it is visible. I can read it on-chain, reason about it, and decide whether to participate. Zbtlink users have no equivalent. Their firmware is a proprietary blob. Their boot chain is invisible. Their only "audit" is a five-star review count that proves other people also bought the same blindfold. Verification asymmetry is the real vulnerability. The backdoor is just the symptom. When one side can inspect the entire risk surface and the other cannot, the trust model was never there to break. The second insight that most coverage misses is economic. A $30 router is a one-time purchase with zero recurring revenue. But ENDLESSDOORS converts each device into a perpetually monetizable zombie asset. Every 35 seconds, it asserts availability to a remote operator. That operator can resell the access, fold the device into a botnet, or harvest DNS traffic to profile the household. The device keeps generating value for someone, silently, indefinitely, off any legitimate balance sheet. I call this ghost ARR — recurring revenue that exists entirely in the gap between what users think they bought and what the vendor actually sold. It requires no onboarding, no payments, no retention strategy. Just a hardcoded string and a heartbeat. We in crypto believe we built the antidote. DePIN — decentralized physical infrastructure networks — promises to make hardware accountable through on-chain attestation and token incentives. In principle, I am a believer: if every device shipped with a signed firmware manifest and a public attestation log, a backdoor in an init.d script would be visible to anyone with a block explorer. But DePIN in practice is mostly token farming. Attention goes to emissions schedules, not to the unglamorous work of device-level verification. If we want hardware to follow the same logic, we should apply the same rule we use for communities: connect first, transact second, always. That means making the connection itself auditable before we ask users to trust it. Let me be honest about the third lesson, because it is the one our industry refuses to verbalize. This incident is the Tether problem, in physical form. We all know Tether dominates roughly 70% of the stablecoin market, and we all know its reserves have never had a truly independent audit. The industry pretends this problem does not exist. Retail marketplaces run the identical playbook. Amazon, Walmart, and eBay listed these routers, and their listings served as implied certifications of safety — yet no one at those platforms performed a firmware review, a code audit, or a security validation. The stores are the unaudited reserves of the physical world: structurally important, completely unverified. What could change this? The building blocks are not exotic. A secure boot chain that verifies firmware signatures at every startup. A public transparency log of signed firmware hashes, so that researchers and automated monitors can diff what was shipped against what was promised. Remote attestation, so a device must cryptographically prove its boot state before it joins a managed network. And a simple platform rule: no signed manifest, no listing. These are boring technologies. They do not need a token. They need enforcement. In 2021, when I partnered with Art Blocks to interview female digital artists, I saw how transparent ownership on-chain gave them financial autonomy the traditional market denied them. That experience cemented my conviction that transparency is justice. The reverse is equally true. The opacity that hides an unaudited circuit board is the same opacity that hides an unverified reserve. Two different industries, one pathology: pretending that trust can be inherited without being verified. Now I must argue with myself, because the data and my own scar tissue demand it. The decentralization true-believer's answer to ENDLESSDOORS is: run open-source firmware, build your own router, install Home Assistant, take back the stack. That advice is what I call the vegan-diet solution: technically correct, morally satisfying, and useless for the 100,000 families who bought a $30 router at Walmart because their old one broke. Self-sovereignty is a privilege for people with time, skills, and surplus attention. Everyone else needs guardrails, not choices. Here is the contradiction that keeps me humble: the most effective fixes for this incident are profoundly centralized. The FCC's Cyber Trust Mark, mandatory software bills of materials, import restrictions on unverifiable firmware, platform-level security audits — these are central authorities imposing order on a market that declined to self-correct. I advocate for decentralization because I have seen what opaque power does. But ENDLESSDOORS reminds me that pure market freedom, applied to physical supply chains without oversight, reliably produces poisoned trust anchors. The invisible hand built this backdoor as rationally as it builds anything else. Sometimes the alternative to a central authority is not liberty — it is a backdoor that pings a stranger every thirty-five seconds. We are in a bear market, and survival is the only metric that matters. But this story reframes survival: it is not about which protocol holds its TVL. It is about which infrastructures deserve any trust at all. The next wave of decentralized infrastructure will not be about tokens or emissions. It will be about proving, cryptographically, that the hardware beneath our feet has nothing to hide. A device that cannot attest to its own firmware should not be trusted with a single byte. And if we keep shipping products with hardcoded backdoors and unencrypted heartbeats, we will not be debating L2 wins or blob saturation — we will have lost the building before it was ever constructed. The industry spent a decade asking users to verify everything they touch. It is time we started verifying the things that touch users. Connect first, transact second, always. But in 2026, connecting is the transaction, and it is time we made it the serious, verifiable act it was always meant to be. The routers are listening. The only question is whether they listen for us, or for someone else.