thehackernews.com
Nov 13, 2026
Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
AI-summarised brief · reviewed before publication
Trezor identified a hidden implant in three Safe 5 wallets purchased from the Southeast Asian reseller CryptoBilis. The implant, a covert circuit board, captures recovery phrases displayed on the wallet’s screen and transmits them via mobile network to an attacker‑controlled server. Firmware update 2.13.1 now blocks the implant’s activity on updated devices, though it cannot recover previously captured data. No funds have been reported lost, and Trezor has halted CryptoBilis from future sales while investigating the supply‑chain breach.
💡 Why It Matters
- · The discovery exposes a sophisticated supply‑chain attack that bypasses the core security of hardware wallets, undermining user trust in physical crypto protection.
- · It underscores the need for rigorous reseller vetting and real‑time firmware safeguards to prevent similar breaches.
