Trezor confirms hidden implants in wallets sold by reseller

Trezor, a cryptocurrency hardware wallet manufacturer, confirmed the existence of hidden implants in three units of the Safe 5 model purchased from a reseller named CryptoBilis. These devices contain an additional circuit capable of capturing and transmitting wallet recovery phrases to attacker-controlled servers.

According to the company, the implant reads the phrase directly from the wallet screen during the backup or restoration process and sends the data via a cellular network. Trezor analyzed one of the units in its laboratory and identified the other two through photos submitted by their owners. To date, there are no reports of loss of funds associated with these specific devices.

Attack mechanism and firmware update

A firmware update, version 2.13.1, released this week, prevents the implants found so far from capturing new information on wallets running it. However, Trezor warns that the update does not protect backups that were previously compromised. The implant is positioned between the main board and the display of the Safe 5, without altering the original firmware or the device's Secure Element.

The malicious component copies the recovery phrase when it is displayed on the screen for backup creation or when the user types it to restore the wallet. If a passphrase appears, it is also copied. The data is encrypted before transmission; if there is no connection, the implant stores the information and retries until successful.

Incident context and relationship with Ledger

Trezor issued an initial alert on October 30, two days after a buyer reported a suspected implant. The company removed CryptoBilis from its official reseller network on October 9, the same date that Ledger, an industry competitor, began investigations into losses of funds among clients of the same reseller.

Ledger subsequently confirmed that it found unauthorized implants in wallets sold by CryptoBilis, which drained funds in a coordinated operation. Trezor states that the implants in its devices function similarly to those found in Ledger wallets, adapted specifically for the Safe 5 display. The three affected wallets were purchased between August 20 and September 23.

What to do if you bought from CryptoBilis

For anyone who purchased a Trezor wallet from CryptoBilis since March, including on the Tokopedia and Shopee stores, the official recommendation is clear: move funds to a new wallet with a new recovery phrase. Restoring the old phrase on another device does not solve the problem, as the phrase may already be compromised.

• Do not set up an unused wallet coming from the reseller and never enter an existing recovery phrase into it.

• Contact Trezor support, which is offering a new wallet to anyone who bought from the reseller since March.

• Do not weigh or open the wallet to check for the presence of the implant, as none of these tests are reliable.

• Never share your recovery phrase; Trezor will never request this information.

The company reduced its reseller network by about 80% to adopt stricter security rules. The investigation is ongoing, and Trezor promises updates if it confirms implants in other models or resellers, or if there are reports of financial losses linked to the devices.

Frequently asked questions