Trezor cuts reseller network by 80% after more spy implants found
- Severity
- High
- Sources
- 1
What happened
Trezor says three Safe 5 units bought from Malaysian reseller CryptoBilis between August 20 and September 23 contained implants that trigger capture on a specific display command sequence, which it identifies as the seed phrase. A firmware update released on November 11 reorders display commands to defeat the trigger without visible screen changes, but Trezor warns that backups captured before the patch remain exposed, so affected users should migrate funds. Trezor has reduced its reseller network by 80%, with only 20% of vendors accepting new sourcing and custody controls, and offers free replacements. The story follows a separate $86M drain of Ledger wallets, in which Tether froze $10M and Ledger urged Asian vendors to halt sales.
For experienced traders · Written by AI from 1 source · Wrong?
What to do
- Check whether your Trezor Safe 5 was bought from CryptoBilis between August 20 and September 23.
- Trezor advises CryptoBilis customers to move their funds to a new wallet, as the update cannot protect a backup captured earlier.
- Trezor is offering a free replacement to customers who bought from CryptoBilis.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products