[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXHiPboKwAZ2iRKEwoOS4WKcM1eIWSEESTNh2_0beafo":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":117},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"6da15a09-d135-45d0-9c72-a76cdd3402d5","Trezor warns of suspected crypto-theft implant in hardware wallet","trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet-4c919e","Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. [...]","Trezor received credible reports of a suspected crypto-theft implant in a Trezor Safe 5 hardware wallet purchased from reseller CryptoBilis in Southeast Asia. The implant—an extra circuit board with cellular module and antenna—reportedly can read screen information including recovery phrases and transmit data over mobile networks. Trezor has halted sales through CryptoBilis and advised users to move funds to safe wallets, mirroring a similar Ledger compromise involving the same reseller.","Trezor warns of suspected hardware implant in Safe 5 wallet sold by compromised reseller CryptoBilis.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ftrezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F13\u002FTrezor.jpg","2026-10-30T15:58:20+00:00","2026-10-30T16:00:16.063975+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Trezor","vendor",{"name":21,"type":22},"Trezor Safe 5","product",{"name":24,"type":19},"CryptoBilis",{"name":26,"type":19},"Ledger",{"name":28,"type":29},"Hardware wallet","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"malware","Hardware crypto-theft implant","Extra circuit board with cellular module and antenna found in Trezor Safe 5 devices; capable of intercepting screen data and recovery phrases",[18,24,26],{"controls":58,"vendors":116},[59,87],{"slug":60,"name":61,"problem":62,"products":63},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[64,72,79],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":74,"url":77,"description":78},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":88,"name":89,"problem":90,"products":91},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":118,"title":119,"body":120,"framework_refs":121,"framework_notes":129},"hardware-wallet-implant-highlights-reseller-supply-chain-risk","Hardware Wallet Implant Highlights Reseller Supply Chain Risk","A Trezor Safe 5 purchased through an unauthorized Southeast Asian reseller, CryptoBilis, was found to contain a hidden circuit board capable of reading and wirelessly transmitting seed phrases over cellular networks — a sophisticated hardware supply chain attack. The root cause is a failure to enforce authorized reseller controls and educate end-users on verifying device integrity before use. This matters enormously because hardware wallets are trusted as the last line of defense for cryptocurrency security; a compromised device silently undermines that trust entirely. Notably, the same reseller was linked to a prior Ledger compromise, indicating a persistent, targeted supply chain threat actor that went unaddressed.",[122,123,124,125,126,127,128],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 GV.SC: Cybersecurity Supply Chain Risk Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":130,"CIS Control 15: Service Provider Management":131,"CIS Control 17: Incident Response Management":132,"CIS Control 14: Security Awareness and Skills Training":133,"NIST CSF 2.0 GV.SC: Cybersecurity Supply Chain Risk Management":134,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":135,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":136},"NIS2 requires supply chain security measures including policies on secure hardware and software acquisition; Trezor's lack of reseller integrity controls and delayed response directly conflicts with this obligation for operators of critical digital infrastructure.","This control requires organizations to inventory, vet, and continuously monitor third-party service providers and resellers — applying it would have triggered earlier scrutiny and removal of CryptoBilis before compromised devices reached consumers.","A prior Ledger incident involving the same reseller should have triggered a documented incident response that proactively alerted Trezor and other vendors; a mature IR process would have contained this threat sooner.","End-users lacked awareness of how to verify hardware wallet authenticity and reseller legitimacy; targeted training would have prompted buyers to check official reseller lists before purchase.","This function explicitly requires organizations to identify, assess, and manage cybersecurity risks in their supply chains, including third-party resellers who handle physical products before delivery to end customers.","While typically applied to software, this control's supply chain dimension requires assessing supplier and reseller risk — a formal vulnerability assessment of CryptoBilis would have uncovered the recurring compromise pattern already seen with Ledger.","SI-7 mandates integrity verification mechanisms for hardware and firmware; cryptographic attestation on Trezor devices would have detected the unauthorized implant at device initialization."]