[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKRcUm0HsvFIWx5yAdHBZrkeA6eOiFohQhEQvlTBMusw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"d3ae82d8-e087-453a-a4f7-66d16163e4cf","hardware-implants-in-reseller-wallets-highlight-supply-chain-risks","e2376b19-70f7-41a1-a437-8925579bf52e","Hardware Implants in Reseller Wallets Highlight Supply Chain Risks","Three Trezor Safe 5 hardware wallets sold through a Southeast Asian reseller were found to contain malicious circuit boards capable of capturing recovery phrases and transmitting them over cellular networks — a sophisticated physical supply chain attack. The root cause is a failure to sufficiently vet and monitor third-party resellers who handle sensitive security hardware before it reaches end users. This matters because hardware-level implants are extremely difficult for consumers to detect and can silently compromise cryptographic secrets from the moment of first use. Trezor's response — releasing firmware 2.13.1 to block the implants and pruning its reseller network — demonstrates that supply chain integrity must be enforced proactively, not reactively.","**Immediate actions:**\n- Apply Trezor firmware update 2.13.1 immediately on any Safe 5 wallet, especially if purchased through a third-party reseller\n- Physically inspect hardware wallets for signs of tampering (unexpected weight, seam irregularities, or additional components) before first use\n\n**Long-term improvements:**\n- Restrict hardware wallet purchases to manufacturer-direct channels or rigorously audited, authorized resellers only\n- Implement formal reseller vetting programs including periodic security audits and tamper-evident packaging standards\n- Establish a hardware bill of materials (HBOM) verification process so end-users and distributors can cryptographically validate device integrity\n\n**Detection measures:**\n- Monitor firmware integrity checks and anomalous device behavior (unexpected RF emissions, power draw) at the point of distribution\n- Create a user-facing verification workflow — such as a device attestation check on first boot — to detect hardware modifications before sensitive keys are generated",[12,13,14,15,16],"NIS2 Article 21(2)(d)","NIST SP 800-53 SR-4: Provenance","NIST SP 800-53 SR-11: Component Authenticity","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","MITRE ATT&CK T1195.003: Supply Chain Compromise: Compromise Hardware Supply Chain",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 SR-4: Provenance":19,"NIST SP 800-53 SR-11: Component Authenticity":20,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":21,"MITRE ATT&CK T1195.003: Supply Chain Compromise: Compromise Hardware Supply Chain":22},"This point explicitly requires organizations to implement security measures covering supply chain risks, including the security of relationships with direct suppliers and service providers — directly applicable to the failure to control reseller integrity here.","SR-4 requires organizations to document and validate the provenance of hardware components throughout the supply chain, which would have prompted scrutiny of reseller-handled devices before they reached customers.","SR-11 requires anti-counterfeit and anti-tamper measures for hardware components, directly addressing the type of physical implant attack discovered in these wallets.","This control requires that information security requirements be agreed with suppliers and their compliance monitored, which would have mandated reseller accountability for tamper-evident handling of security hardware.","This technique specifically describes adversaries physically implanting malicious hardware into devices during the supply chain before delivery — the exact attack vector confirmed in this incident.","published","2026-11-13T20:20:40.246144+00:00","2026-11-13T20:20:40.226+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fcryptocurrency\u002Ftrezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix\u002F","trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix-d29629","Trezor confirms crypto-stealing implants in three wallets, releases fix",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49],{"slug":46,"name":47,"problem":48},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":50,"name":51,"problem":52},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]