Trezor Safe 5 Wallets From CryptoBilis Found With Hidden Recovery Phrase Implants
Owners of wallets bought from CryptoBilis since March are advised to move their funds to a new wallet with a new recovery phrase.
Trezor has confirmed that three Safe 5 hardware wallets bought from the Southeast Asian reseller CryptoBilis carry an added circuit board that can read recovery phrases off the screen and send them to attackers over a mobile network. The company found one implant in its lab and identified the other two from photos their owners supplied, with no lost funds reported so far. Firmware 2.13.1, released November 11, blocks the implants found to date from capturing data, but it cannot protect a phrase captured earlier, so buyers since March are urged to move funds to a new wallet and to contact Trezor for a replacement. Trezor has also cut its reseller network by about 80% and says it will publish an update if the implants turn up elsewhere.
Why it matters
The case shows that a hardware wallet is only as trustworthy as the supply chain it passes through, since a device bought from an unofficial reseller can carry hardware that captures the recovery phrase. Buyers who got wallets through that channel now have to decide whether to treat any phrase shown on those devices as compromised. Trezor's cut of about 80% in its reseller network signals that it sees the sales channel, not only the device design, as where the risk entered.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.