Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases

The implants, which are extra circuit boards, read the recovery phrase from the wallet's screen and transmit it to an attacker-controlled server via mobile network. Trezor examined one wallet in its lab and identified the other two based on photos provided by owners.

A firmware update released earlier this week, version 2.13.1, prevents the discovered implants from capturing data on updated wallets. However, the company noted that "the update can't protect a wallet backup that was captured before it."

Customer Response

Trezor has maintained its advice to customers who purchased wallets from CryptoBilis since March: move funds to a new wallet with a new recovery phrase, avoid setting up unused wallets from the reseller, and keep the original wallet while contacting Trezor Support. The company offers a replacement wallet to affected customers.

Technical Details

The implant sits between the Safe 5's main board and its screen without altering the wallet's firmware or Secure Element. It captures recovery phrases during backup creation or wallet restoration, as well as any passphrases displayed on screen. The data is encrypted before transmission and stored if mobile connection fails.

Supply Chain Concern

CryptoBilis was an official Trezor reseller in Southeast Asia until October 9, when the company removed it following similar implant discoveries in Ledger wallets sold by the same reseller. The three affected Trezor wallets were purchased between August 20 and September 23.

Trezor has not disclosed who implanted the devices or where in the supply chain the tampering occurred. The company has received contact from 48 customers who bought from CryptoBilis and is checking their wallets, though it hasn't specified how many have been examined so far.