Emerging ThreatsSupply Chain Attacks

Trezor Uncovers Crypto-Stealing Implants in Hardware Wallets

Analyst 207||Source: BleepingComputer
Disassembled hardware wallet with exposed internal components and unauthorized implant circuit board on a laboratory bench.

Trezor has reduced its global reseller network by approximately 80% after investigators confirmed hardware implants in three Safe 5 wallets sold by a single Southeast Asian reseller, CryptoBilis.

Three compromised Safe 5 devices purchased from CryptoBilis

Trezor examined one Safe 5 device in its laboratory after a customer first reported an unauthorized circuit board in October. The company subsequently identified two additional compromised wallets using photographs supplied by their owners. All three compromised devices were purchased from CryptoBilis between August 20 and September 23, 2026. So far, Trezor says no affected customers have reported losing funds.

The implant: an extra board that watches the screen and phones home

Trezor engineers analyzed the malicious hardware and its firmware and concluded the implant is an additional circuit board installed between the Safe 5’s main board and its display. That placement allows the implant to monitor screen activity without modifying the device’s legitimate firmware or the Secure Element. When wallet recovery words — whether during creation of a new backup or while restoring a wallet — appear on the screen, the implant collects them. It can also capture passphrases displayed on the screen, encrypt the stolen information, and transmit it over a mobile network to an attacker-controlled server. If a mobile connection is unavailable, the implant retains captured data and repeatedly attempts transmission until successful.

Firmware 2.13.1: protections and limits

On November 11, Trezor released firmware version 2.13.1. According to the company, the update “includes a protection that stops the implants we’ve found from capturing anything on devices that run it, making the current batch of implants useless.” The company cautioned, however, that the update cannot recover or protect wallet recovery phrases that may already have been captured before users installed the update. Trezor advises customers who purchased devices from CryptoBilis to transfer their cryptocurrency to a newly created wallet using a new recovery phrase.

Trezor’s reseller policy change and replacement offer

Supply-chain concerns prompted Trezor to cut its global reseller network by roughly 80%, a measure the company said narrows the number of third-party resellers and imposes stricter controls on how devices are sourced, stored, and accessed. Trezor characterized the removed resellers as trustworthy but not meeting the new, tighter supply-chain security requirements. The company is offering replacement devices to anyone who purchased a Trezor wallet from CryptoBilis since March 2026, including customers whose devices have not been confirmed as compromised.

How CryptoBilis customers, technologists, and resellers are responding

  • CryptoBilis customers: At least 48 customers contacted Trezor after the company’s October warning; their devices are being examined in Trezor’s laboratory or assessed from photographs of internal components. Trezor’s advice to these customers is to transfer funds to a new wallet with a new recovery phrase.
  • Technologists and security teams: Trezor’s analysis shows implants can operate without altering device firmware or the Secure Element, which means physical inspection of internal components and firmware protections are both part of remediation. Trezor says it has inspected devices from other resellers in the region and found no evidence of tampering.
  • Resellers and procurement teams: With Trezor narrowing its reseller network and imposing tighter sourcing and storage controls, resellers that remain must conform to stricter supply-chain requirements; Trezor is proactively offering replacements for purchases from CryptoBilis since March 2026.

The confirmed implants mirror earlier discoveries in other vendors’ devices sold through CryptoBilis, which had previously been linked to cryptocurrency thefts, and they expose the dual pathways by which attackers can exploit physical supply chains and cellular connectivity. Trezor’s firmware update neutralizes the implants discovered so far, and the company has instituted both a reduced reseller footprint and a replacement program for buyers from the implicated reseller. Key factual open points remain in the record: whether any recovery phrases were captured and exploited before owners installed firmware 2.13.1, and how many additional CryptoBilis purchasers — beyond the 48 who have reached out — will seek examination or replacements.

Source: Bleeping Computer — Trezor confirms crypto-stealing implants in three wallets, releases fix

Emerging ThreatsSoutheast AsiaSupply ChainCrypto TheftHardware WalletsTrezorCryptobilisHardware ImplantsSafe 5
Related Intelligence

Continue Reading

Technicians work on a drone in a workshop with tools and industrial controls nearby.

Cyberattack Targets German Military Drone Maker Quantum Systems

German military drone maker Quantum Systems was hit by a cyberattack when a malicious update was delivered to customers through its QBase software, highlighting the growing threat to the European defense industry. The breach is part of a larger trend of targeted attacks on companies supporting Ukraine's security efforts.

Analyst 207
Server rack in a data center with fluorescent lighting and a technician's workbench in the background.

Rogue Cloud Hosts Exploit AMD SEV-SNP Flaws to Steal VM Secrets

Malicious cloud hosts are exploiting flaws in AMD's SEV-SNP security feature to siphon off sensitive data from virtual machines, with researchers uncovering two alarming techniques that allow attackers to read - and even modify - protected data. This breakthrough enables rogue hosts to breach SEV-SNP defenses, putting VM secrets at risk.

Analyst 207
People walk down a city street, some checking phones with concerned expressions.

Microsoft Outage Losses Mount as Global Disruptions Persist

Microsoft reports encouraging recovery progress, but the economic toll of its recent outage is staggering, with estimated global productivity losses reaching as high as $7 billion. The massive disruption has sparked concerns about the far-reaching impact on the global economy.

Analyst 207
Technicians work in background near network equipment racks.

Check Point Gateways Targeted in PHP2Shell Attacks Deploying ESXi Wiper

Hackers are exploiting two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, to breach Check Point Security Gateways and deploy a destructive VMware ESXi wiper in some attacks. The vulnerabilities were patched on October 21, but exploitation attempts began just four days earlier.

Analyst 207