Trezor confirms hidden hardware implants in CryptoBilis-sold Safe 5 wallets stealing recovery phrases
Trezor announced that three Safe 5 hardware wallets purchased from reseller CryptoBilis contained a hidden implant — an additional circuit board that intercepts and exfiltrates recovery phrases displayed during wallet backup or entered during restoration. The implant captures passphrases, encrypts the data, and sends it via mobile networks to attacker-controlled servers. Trezor released firmware version 2.13.1 to block these implants on Safe 7, Safe 5, Safe 3, and Model T devices, but this update cannot protect recovery phrases already compromised. So far, no losses have been reported among affected users. Trezor advises customers who bought devices from CryptoBilis since March not to use them, to move funds to new wallets with new recovery phrases, and to contact Trezor Support for replacement devices. This incident follows a similar implant discovery in Ledger wallets sold by the same reseller. Trezor is investigating the point in the supply chain where implants were introduced and has removed CryptoBilis as an authorized reseller. The implants do not alter the wallets’ Secure Element or firmware but reside between the mainboard and display to silently capture secrets.
Linha do tempo
-
Trezor confirms hidden hardware implants in CryptoBilis-sold Safe 5 wallets stealing recovery phrases
ler a análise desta fonte ocultar
Trezor announced that three Safe 5 hardware wallets purchased from reseller CryptoBilis contained a hidden implant — an additional circuit board that intercepts and exfiltrates recovery phrases displayed during wallet backup or entered during restoration. The implant captures passphrases, encrypts the data, and sends it via mobile networks to attacker-controlled servers. Trezor released firmware version 2.13.1 to block these implants on Safe 7, Safe 5, Safe 3, and Model T devices, but this update cannot protect recovery phrases already compromised. So far, no losses have been reported among affected users. Trezor advises customers who bought devices from CryptoBilis since March not to use them, to move funds to new wallets with new recovery phrases, and to contact Trezor Support for replacement devices. This incident follows a similar implant discovery in Ledger wallets sold by the same reseller. Trezor is investigating the point in the supply chain where implants were introduced and has removed CryptoBilis as an authorized reseller. The implants do not alter the wallets’ Secure Element or firmware but reside between the mainboard and display to silently capture secrets.