Supply-chain attack · high
Trezor confirms hidden implants in wallets sold by CryptoBilis reseller
Tier D · Background noise – Good to know
Who’s exposed: Buyers of Trezor Safe 5 wallets from reseller CryptoBilis
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Full takeover · Supply chain
What to do
- Check whether your Trezor Safe 5 was bought from CryptoBilis.
- Follow Trezor's guidance for affected devices before storing funds on a wallet from this reseller.
The Brief
- Trezor confirmed that three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain a hidden implant.
- The implant is an extra circuit board that can copy the wallet's recovery phrase.
- According to the report, the implant reads the phrase from the wallet's screen and sends it onward.
Why it matters
Anyone holding funds on a Trezor Safe 5 bought from CryptoBilis could have their recovery phrase copied, which would let someone else take control of the funds.
The checklist behind the tier
Checklist · 2 of 10 yes
| No | Hits tech teams | Judgment: Trezor hardware wallets are consumer crypto devices, not tools developers or ops teams run. |
| No | Core infrastructure | Judgment: a single vendor's hardware wallet is not core infrastructure nearly every team runs. |
| No | Popular tool | Judgment: a niche consumer hardware wallet, not a widely used framework, tool, platform or package. |
| No | Exploited in the wild | The Hacker News: implant can copy recovery phrases; sources report no observed thefts using it. |
| No | Public exploit | The Hacker News: no published exploit code or PoC is mentioned; only the implant is described. |
| No | Remote, no login | The Hacker News: the implant is a physical extra circuit board inside the wallet, not a remote flaw. |
| Yes | Full takeover | The Hacker News: implant can copy wallet recovery phrases, enabling full takeover of the wallet's funds. |
| No | Secrets exposed | The Hacker News: implant can copy recovery phrases; no source says phrases were actually stolen or exposed. |
| Yes | Supply chain | The Hacker News: wallets tampered with implants were sold through reseller CryptoBilis, a supply chain compromise. |
| No | No fix yet | The Hacker News snippet does not mention any patch or fix status for the implanted wallets. |
Timeline
Trezor confirmed hidden implants in Trezor Safe 5 wallets sold by reseller CryptoBilis
The Hacker News
Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
Source
Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases ↗ The Hacker News · 4h ago
First seen · 1 source · Full story page · How tiers are decided