Trezor finds recovery phrase stealing implants in Safe 5 wallets

Three Trezor Safe 5 wallets purchased from the Southeast Asia reseller CryptoBilis contain an implanted extra circuit board designed to copy recovery phrases. Trezor said the implant sits between the Safe 5’s main board and its screen and does not alter the device’s firmware or Secure Element.

The implant copies the recovery phrase when it appears on screen during backup creation, and again if someone types a recovery phrase to restore a wallet, or if a passphrase is shown on the screen; it then encrypts the data and transmits it to a server controlled by the attackers via the mobile network. The company examined one implant in its lab and identified the other two from photos sent by owners. It noted no reported loss of funds so far.

Firmware version 2.13.1, released earlier this week, stops the implants known to have been found so far from capturing data on wallets that run the update, but Trezor warned that the update “can’t protect a wallet backup that was captured before it.” The wallets were bought between 20 August and 23 September, and so far implants have been found only in Safe 5 wallets sold by CryptoBilis; none have been detected in other models or resellers.

In response to the incident, CryptoBilis was removed from Trezor’s authorised reseller list in October, with Trezor saying it has cut about 80% of its reseller network and will provide replacements to affected customers. Trezor has asked buyers to contact Support for replacements and to avoid handling rescued wallets or entering phrases on suspect devices, while it continues investigating and will publish updates if implants are found outside the reseller’s wallets or if funds are lost. The discovery comes after Ledger reported unauthorized implants in devices sold by the same reseller.