Trezor, a leading hardware wallet manufacturer, has confirmed that three of its Safe 5 wallets purchased from the reseller CryptoBilis contain hidden implants. These implants, consisting of additional circuitry, are capable of intercepting recovery phrases, posing serious security threats to users.
Details of the Security Breach
The discovered implant can capture recovery phrases from the wallet’s display and transmit this sensitive information over mobile networks to a server managed by attackers. Trezor’s examination of one affected wallet in their laboratory confirmed the presence of this exploit, while two others were identified through photographs submitted by concerned customers. Fortunately, there have been no reported cases of lost funds so far.
To mitigate this issue, Trezor released firmware update version 2.13.1, designed to prevent these implants from extracting information from wallets running the updated software. However, the update cannot retroactively protect any recovery phrase that may have been compromised before its installation.
Recommended Actions for Affected Users
Trezor advises customers who purchased their wallets from CryptoBilis since March to immediately transfer their assets to a new wallet with a fresh recovery phrase. Simply restoring the compromised recovery phrase on a different device will not rectify the issue. Users are urged not to deploy any unused wallets from the reseller and are advised to refrain from entering existing recovery phrases into them.
Customers are encouraged to retain their current wallets and reach out to Trezor Support, which is offering replacements to affected individuals. Importantly, users should avoid physically tampering with their wallets in an attempt to detect the implants, as such actions are unreliable. Furthermore, sharing recovery phrases is strongly discouraged, as Trezor will never request this information.
Ongoing Investigations and Future Measures
According to Trezor’s investigation, the implant sits between the Safe 5’s main board and its display, allowing it to capture recovery phrases and passphrases during backup creation or restoration processes. The data is encrypted for transmission, ensuring persistence in the event of connectivity issues.
Trezor initially flagged the potential implant on October 30, shortly after a buyer’s report and prior to lab confirmation. The reseller, CryptoBilis, was an official distributor for Trezor in Southeast Asia until October 9, when Trezor severed ties due to security concerns. A similar security breach was identified by Ledger, another hardware wallet provider, revealing a coordinated attack through modified devices.
Trezor’s internal review has led to a significant reduction of its reseller network, aiming to enhance security by adhering to stricter partnership criteria. This strategic move was announced on October 13, prior to the first confirmed implant report.
The company continues its investigation and pledges to inform the public should further evidence of implants emerge beyond the identified wallets, or if any funds are reported lost due to these security vulnerabilities. Customers are advised to stay informed and follow recommended security practices to protect their assets.
