Trezor Hardware Implant Alert
Trezor issued an advisory on Oct 30, 2026 after discovering a suspected hardware implant in wallets sold by the reseller CryptoBilis. The implant is a small circuit board that sits between the main board and the display. When the device is powered, the board reads the screen output and transmits the recovery phrase over a cellular network.
Affected Devices and Timeline
- Models: All Trezor Safe 5 units purchased from CryptoBilis since March 2026.
- Purchase Channels: Direct CryptoBilis sales, third-party marketplaces, and any retailer that sourced from CryptoBilis.
- Discovery: An Indonesian customer reported the anomaly to Trezor. Trezor confirmed the presence of the board in a lab test and released a public advisory.
Evidence and Technical Details
Trezor’s investigation identified a discrete PCB measuring 2.5 cm by 1.8 cm. The board connects to the main processor via a serial interface and to the display via a standard I²C bus. Firmware analysis shows a custom microcontroller that captures the display buffer and forwards the data to a cellular module. The module is powered only when the wallet is connected to a USB host.
The implant does not alter the wallet’s cryptographic functions. It merely observes the recovery phrase displayed during seed generation or recovery. No evidence indicates that the implant can sign transactions or access private keys.
Current Impact
- Recovery Phrase Exposure: The primary risk is that the recovery phrase could be transmitted to an attacker’s server when the device is connected.
- No Fund Loss Reported: Trezor confirmed that no CryptoBilis buyer has reported a loss of funds. The customer who discovered the board had already moved assets before the anomaly was noticed.
- Future Users: New users who purchase affected devices may unknowingly expose their recovery phrase if they connect the wallet to a host.
Immediate Mitigation Steps
- Stop Using the Device: Disconnect the wallet from any host and do not use it for transactions.
- Move Funds: Transfer all assets to a new wallet that has not been sold by CryptoBilis. Generate a fresh recovery phrase.
- Contact Trezor: Reach out to Trezor support to request a replacement unit or a voucher. Provide proof of purchase and the serial number.
- Verify Replacement: When a replacement arrives, verify that the device contains only the standard Trezor PCB and no additional modules.
Long-Term Considerations
- Supply-Chain Audits: Manufacturers should enforce stricter controls on third-party resellers. Independent audits of reseller inventory can prevent tampering.
- Hardware Verification: Users may consider physically inspecting the device for unknown components before first use. A simple visual check can reveal anomalous boards.
- Firmware Updates: Trezor has released a firmware patch that logs any unexpected hardware connections. Users should update to the latest firmware to detect future anomalies.
What to Watch For
- New Reports: Monitor Trezor’s official channels for additional findings or confirmations from independent labs.
- Firmware Alerts: Keep an eye on firmware release notes for any changes related to hardware integrity checks.
- Reseller Policies: CryptoBilis may update its sales policies or issue a recall. Users should verify the status of their purchase.
FAQ
- What should I do if I own a Trezor sold by CryptoBilis? Move all funds to a new wallet, generate a new recovery phrase, and contact Trezor support for a replacement or voucher. Do not use the device until the replacement arrives.
- Is there a risk of immediate fund loss? No known incidents of fund loss have been reported. The implant appears to transmit recovery phrases only when the device is connected to a power source.