An update to my earlier post on Trezor’s first warning about a hidden board in a wallet bought from reseller CryptoBilis (linked below). Trezor has now examined a device in its lab and says three Trezor Safe 5 wallets from that reseller contain an implant: an extra circuit board that can copy a recovery phrase and send it out over the mobile network. The company identified the other two from photos the owners sent. It has had no reports of lost funds.
A firmware update, 2.13.1, is out for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says it stops the implants found so far from capturing anything on a wallet that is already running it, but “the update can’t protect a wallet backup that was captured before it.” The advice for anyone who bought a Trezor from CryptoBilis since March, including through that reseller’s Tokopedia and Shopee stores, has not changed: move funds to a new wallet with a new recovery phrase, don’t restore the old phrase onto another device, don’t set up an unused wallet from that reseller, and contact Trezor Support, which is offering a replacement. Don’t weigh or open the device to “check” it, the company says, because neither is a reliable test. And never share your recovery phrase. Trezor will not ask for it, and scammers may pretend they will.
CryptoBilis was an official reseller in Southeast Asia until Trezor removed it on October 9, the same day Ledger began looking at losses among that reseller’s customers. Trezor says the implants work the same way as the ones later confirmed in some Ledger devices, adapted to the Safe 5’s display. So far it has found them only in Safe 5 wallets from this reseller, not in other models or other resellers. After the first warning it asked buyers to get in touch, and 48 have done so. It has not said how many of those wallets it has checked, or who fitted the boards, or where in the supply chain that happened.
My take
If you bought from that reseller, treat the wallet as untrusted even if the new firmware is installed. Move the funds, use a new phrase, and talk to Trezor Support. For everybody else, this is still the same rule: buy direct from the maker, check the seals, and never type an existing seed into a device you don’t already trust.
God Bless, and May the Source Be with You!
