Trezor Cuts 80% of Resellers After Safe 5 Breach
After tampered Safe 5 wallets were found through CryptoBilis, Trezor is tightening distribution; only resellers that meet stricter requirements will remain.
Key Takeaways
- Trezor has cut 80% of its reseller network after spy implants were found again in Safe 5 devices sold through the Malaysian reseller CryptoBilis.
- Three affected devices have been confirmed; the implant chip could intercept recovery phrases during communication between the main circuit and the display.
- Trezor released a firmware update that makes the chip unusable and is advising buyers to still move their funds to a new wallet.
Trezor has cut 80% of its reseller network after spy implants were found again in Safe 5 devices sold through the Malaysian reseller CryptoBilis. The company said on November 12 that three implanted devices have now been confirmed. The case once again shows how vulnerable hardware wallets can be if devices are tampered with along the way.
Three Devices Confirmed
The affected devices were bought between August 20 and September 23. According to Trezor, the implant chip listens in on communication between the main circuit and the display. Once the chip recognizes a specific sequence, it starts capturing data. That means the recovery phrase of a wallet can be intercepted without the user seeing anything.
Trezor says these new findings follow the investigation the company announced on October 30. Back then, spyware was already found in one Safe 5 unit from CryptoBilis's inventory. So the hardware itself is not only a target after purchase, but also during distribution.
Firmware Fix Makes Chip Unusable
The company released a firmware update on November 11 that, according to Trezor, makes the implants unusable. In the process, the order of the commands sent to the display was changed, without the user noticing anything on the screen. The chip is still physically inside the affected devices, but it can no longer recognize the trigger.
Anyone who bought a Safe 5 through CryptoBilis should still move funds to a new wallet, according to Trezor. The update cannot recover a recovery phrase that was intercepted before November 11. Once the seed has left the wallet, attackers already have it. Buyers through CryptoBilis are being offered a free replacement wallet.
Stricter Control Over Distribution
Trezor has also tightened the requirements for purchasing, storing, and accessing devices. Only 20% of trading partners met those new conditions. The rest are being removed from the network. According to the company, those resellers were trustworthy and did not pose a direct threat, but Trezor wants tighter control over the channel.
For European crypto users, this is especially relevant because hardware wallets are often seen as the safest way to store crypto yourself. The incidents show that not only software, but also the physical chain around a device can create risk. Earlier reports involving Ledger through the same reseller had already made it clear that supply chain attacks in this area are taken seriously.