What happened
BleepingComputer reported today that hardware wallet maker Trezor has confirmed that three Trezor Safe 5 devices sold by the Southeast Asian (Indonesian) reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers over cellular networks. All three compromised devices were bought from CryptoBilis between August 20 and September 23, 2026. Trezor examined the original device in its lab and identified two more from owners' photographs; 48 CryptoBilis customers have contacted the company since its October warning. According to Trezor, the implant is an extra circuit board fitted between the Safe 5's main board and display that captures recovery words and passphrases shown on screen, encrypts them and transmits them over a mobile network to an attacker-controlled server, retrying until it succeeds. It does not modify the legitimate firmware or Secure Element. Trezor says it inspected devices from other resellers in the region and found no tampering, and no affected customers have reported losing funds. Firmware 2.13.1, released Nov 11, blocks the implants found so far but cannot protect phrases already captured, so anyone who bought a Trezor from CryptoBilis is advised to move funds to a new wallet with a new recovery phrase; Trezor is offering replacement devices to buyers from CryptoBilis since March 2026. The report notes this follows earlier confirmed implants in Ledger devices sold through CryptoBilis. The report does not say who installed the implants.
How the scam works
Crypto phishing and draining sites ask you to connect a wallet, sign a transaction, 'claim' a token, or paste a recovery phrase. Once you approve the request, the operator can empty the wallet. Address-poisoning works differently: the operator sends dust or zero-value transfers from a look-alike address so that, later, a hurried copy-paste from the transaction history goes to them instead of to the address you meant. Always check every character of an address, and never connect a wallet or enter a seed phrase on a site you reached from a message, a pop-up or a look-alike URL. Official wallet and exchange brands named in a lure are not involved.
Source
Source: https://www.bleepingcomputer.com/news/cryptocurrency/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix/
