[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsGwzUhidwRVU92BWublCftfDsx78igkhjzCbEUodr4c":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":110},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"e2376b19-70f7-41a1-a437-8925579bf52e","Trezor confirms crypto-stealing implants in three wallets, releases fix","trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix-d29629","Cryptocurrency hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers over cellular networks. [...]","Trezor has confirmed that three Safe 5 hardware wallets sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal recovery phrases. These implants, which consist of an additional circuit board, can capture sensitive information displayed on the wallet's screen and transmit it over cellular networks. Trezor has released firmware version 2.13.1 to block these implants and has significantly reduced its global reseller network due to these supply-chain attacks.","Trezor confirms crypto-stealing implants in three Safe 5 wallets sold by CryptoBilis.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fcryptocurrency\u002Ftrezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F07\u002FTrezor.jpg","2026-11-13T19:38:36+00:00","2026-11-13T20:00:13.401261+00:00",8,[17,20,23],{"name":18,"type":19},"Safe 5","product",{"name":21,"type":22},"Trezor","vendor",{"name":24,"type":22},"CryptoBilis","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":25,"icon":27,"name":28,"slug":29},null,"Supply Chain","supply-chain",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,18],{"controls":51,"vendors":109},[52,80],{"slug":53,"name":54,"problem":55,"products":56},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[57,64,72],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":59,"url":62,"description":63},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":81,"name":82,"problem":83,"products":84},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":111,"title":112,"body":113,"framework_refs":114,"framework_notes":120},"hardware-implants-in-reseller-wallets-highlight-supply-chain-risks","Hardware Implants in Reseller Wallets Highlight Supply Chain Risks","Three Trezor Safe 5 hardware wallets sold through a Southeast Asian reseller were found to contain malicious circuit boards capable of capturing recovery phrases and transmitting them over cellular networks — a sophisticated physical supply chain attack. The root cause is a failure to sufficiently vet and monitor third-party resellers who handle sensitive security hardware before it reaches end users. This matters because hardware-level implants are extremely difficult for consumers to detect and can silently compromise cryptographic secrets from the moment of first use. Trezor's response — releasing firmware 2.13.1 to block the implants and pruning its reseller network — demonstrates that supply chain integrity must be enforced proactively, not reactively.",[115,116,117,118,119],"NIS2 Article 21(2)(d)","NIST SP 800-53 SR-4: Provenance","NIST SP 800-53 SR-11: Component Authenticity","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","MITRE ATT&CK T1195.003: Supply Chain Compromise: Compromise Hardware Supply Chain",{"NIS2 Article 21(2)(d)":121,"NIST SP 800-53 SR-4: Provenance":122,"NIST SP 800-53 SR-11: Component Authenticity":123,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":124,"MITRE ATT&CK T1195.003: Supply Chain Compromise: Compromise Hardware Supply Chain":125},"This point explicitly requires organizations to implement security measures covering supply chain risks, including the security of relationships with direct suppliers and service providers — directly applicable to the failure to control reseller integrity here.","SR-4 requires organizations to document and validate the provenance of hardware components throughout the supply chain, which would have prompted scrutiny of reseller-handled devices before they reached customers.","SR-11 requires anti-counterfeit and anti-tamper measures for hardware components, directly addressing the type of physical implant attack discovered in these wallets.","This control requires that information security requirements be agreed with suppliers and their compliance monitored, which would have mandated reseller accountability for tamper-evident handling of security hardware.","This technique specifically describes adversaries physically implanting malicious hardware into devices during the supply chain before delivery — the exact attack vector confirmed in this incident."]