Trezor warns of suspected crypto-theft implant in hardware wallet
Trezor warns of suspected hardware implant in Safe 5 wallet sold by compromised reseller CryptoBilis.
Trezor received credible reports of a suspected crypto-theft implant in a Trezor Safe 5 hardware wallet purchased from reseller CryptoBilis in Southeast Asia. The implant—an extra circuit board with cellular module and antenna—reportedly can read screen information including recovery phrases and transmit data over mobile networks. Trezor has halted sales through CryptoBilis and advised users to move funds to safe wallets, mirroring a similar Ledger compromise involving the same reseller.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Trezor?
Get an email when a new story names Trezor, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Trezor Safe 5 purchased through an unauthorized Southeast Asian reseller, CryptoBilis, was found to contain a hidden circuit board capable of reading and wirelessly transmitting seed phrases over cellular networks — a sophisticated hardware supply chain attack. The root cause is a failure to enforce authorized reseller controls and educate end-users on verifying device integrity before use. This matters enormously because hardware wallets are trusted as the last line of defense for cryptocurrency security; a compromised device silently undermines that trust entirely. Notably, the same reseller was linked to a prior Ledger compromise, indicating a persistent, targeted supply chain threat actor that went unaddressed.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Hardware crypto-theft implant