Trezor Confirms Hardware Implants in Wallets Sold Through Reseller CryptoBilis

What Happened

Hardware wallet maker Trezor said it found hidden implants inside three Trezor Safe 5 devices bought from the reseller CryptoBilis. An implant is an extra circuit board. According to Trezor, the implant reads the recovery phrase shown on the wallet's screen and sends it over the mobile network to an attacker-controlled server. Trezor examined one unit in its lab and identified the implant in the other two.

Why It Matters

A recovery phrase is the secret that controls the funds a wallet protects. If an implant can copy it, an attacker can drain the wallet. The source describes tampered units sold through the reseller CryptoBilis, not a flaw in Trezor's firmware or design. Anyone who bought a Trezor device from a third-party reseller rather than directly from Trezor or an authorized retailer should treat the device as untrusted until it is verified.

What Defenders Should Watch For

• Treat any hardware wallet bought from a non-official channel as possibly tampered. Inspect it for extra components, altered seals, or signs the case was opened and resealed.
• Verify device authenticity using Trezor's own genuine-check tooling before setting up a seed on a new device.
• Do not enter or display a recovery phrase on a device of uncertain origin. Generate a new seed on a verified device and treat any phrase that touched a suspect unit as burned.
• For teams managing hardware wallets at scale, buy only through official or authorized resellers, and track chain of custody from purchase to setup.
• Consider flagging unexpected cellular or mobile-network connectivity from devices that have no legitimate need for it.

Developing Story

This is a new report and the investigation is ongoing. Details about the full scope, the reseller's other inventory, and the attacker infrastructure may change. For the original reporting, see The Hacker News.