Ethical Hacking News
Trezor has confirmed that certain wallets sold by CryptoBilis contain hidden implants that can steal recovery phrases from users. The implants are designed to work the same way as those found in Ledger devices, and users are advised to move their funds to a new wallet and contact Trezor Support for a new wallet. The company has cut its reseller network and will post an update if it confirms an implant outside the reseller's wallets or receives a report of lost funds linked to the implants.
Trezor wallets sold by CryptoBilis have a security vulnerability that allows attackers to steal the recovery phrase. The vulnerability is caused by an implant, a small circuit board that copies the recovery phrase and sends it to a server. The implants are only found in Safe 5 wallets sold by CryptoBilis, and not in other Trezor models or from other resellers. Users are advised to move their funds to a new wallet and not to type their recovery phrase into an unused wallet. Trezor has released a firmware update to prevent the implants from capturing recovery phrases. The company has received reports of no lost funds from users who bought affected wallets.
Swati Khandelwal of The Hacker News has recently published an article about a serious security vulnerability discovered in certain Trezor wallets sold by CryptoBilis, a reseller of hardware wallets. According to the article, Trezor has confirmed that certain wallets sold by CryptoBilis contain an implant, an extra circuit board designed to copy the recovery phrase of the wallet. This implant is capable of reading the recovery phrase from the wallet's screen and sending it over the mobile network to a server controlled by attackers.
The company examined one of the wallets in its lab, identified the other two from photos their owners sent, and has had no reports of lost funds. However, the implants found so far cannot be stopped by a recent firmware update, version 2.13.1, which is designed to prevent implants from capturing recovery phrases on wallets that run it. The company has not changed its advice to anyone who bought a Trezor from CryptoBilis since March, including from the reseller's stores on Tokopedia and Shopee.
The company advises users to move their funds to a new wallet with a new recovery phrase, not to set up an unused wallet from the reseller, and never to type an existing recovery phrase into one. They also advise users to keep the wallet and contact Trezor Support, which offers a new Trezor wallet to anyone who bought from the reseller since March. Furthermore, the company advises users not to weigh or open the wallet to check it, as neither is a reliable test. Users are also advised not to share their recovery phrase, as scammers may pose as the company to offer replacements or refunds.
The firmware update, version 2.13.1, has been released for the Safe 7, Safe 5, Safe 3, and Model T, according to the company's firmware changelog. The company will not publish technical details that could help attackers or put customers at risk, it said in an investigation update.
The implant sits between the Safe 5's main board and its screen and changes nothing on the wallet itself, including its firmware and Secure Element, the company found. The implant copies the recovery phrase when the wallet shows it during backup creation, and when someone types it in to restore an existing wallet to the device. It also copies a passphrase if one appears on the screen. The implant encrypts the data before sending it, and if it cannot connect, it keeps the data and tries again until it succeeds.
The company first warned of a suspected implant on October 30, two days after a buyer reported it and before its lab had seen the wallet. CryptoBilis served as an official reseller for the company's wallets in Southeast Asia until October 9, when the company removed it. That was the day Ledger, another hardware wallet maker, began investigating losses of funds among the reseller's customers.
Ledger later confirmed an unauthorized implant in a wallet the reseller sold. Attackers had fitted genuine Ledger devices with hidden components designed to capture the recovery phrase during setup, then drained wallets in a single coordinated operation, Ledger said in an incident statement.
Trezor says the implants in its wallets work the same way as those found in Ledger devices, adapted to the Safe 5's display. It has not said who fitted the implants or where in the supply chain that happened. The three wallets were bought between August 20 and September 23. So far the company has found implants only in Safe 5 wallets sold by the reseller, and none in wallets from its other resellers or in its other models.
The company asks people who bought a Trezor from CryptoBilis to get in touch, and 48 have done so. It is checking their wallets in its lab or from photos of the insides, and has not said how many it has checked so far. The company says none of the three owners has lost funds. Trezor wallets are self-custodial, so it cannot see anyone's balance.
The company has cut its reseller network by about 80%, dropping trustworthy partners that posed no immediate threat but did not fit its stricter new rules. It first announced the reduction on October 13 in a post on X, more than two weeks before the first report of an implant in one of its own wallets.
The company will not publish technical details that could help attackers or put customers at risk, it said in an investigation update. It will post an update if it confirms an implant outside the reseller's wallets or the Safe 5, receives a report of lost funds linked to the implants, or releases new protections.
Related Information:
https://www.ethicalhackingnews.com/articles/Trezor-Confirms-Hidden-Implants-in-CryptoBilis-Sold-Wallets-Can-Steal-Recovery-Phrases-ehn.shtml
https://thehackernews.com/2026/11/trezor-confirms-hidden-hardware.html
Published: Fri Nov 13 11:15:56 2026 by llama3.2 3B Q4_K_M
