Trezor Finds Hidden Recovery-Phrase-Capturing Implants in Three CryptoBilis-Sold Wallets
Summary
Trezor confirmed implants in three CryptoBilis-sold Safe 5 wallets that capture recovery phrases and transmit them over mobile networks. Firmware 2.13.1 blocks the implants found so far; no owners have reported lost funds.
Key points
- Trezor says three Safe 5 wallets bought from CryptoBilis contained hidden circuit boards; it examined one in its lab and identified the other two from owner photos.
- The implants capture recovery phrases shown during wallet backup or restoration, as well as passphrases displayed on screen.
- Trezor says the implants encrypt captured data and send it over a mobile network to an attacker-controlled server, retrying if they cannot connect.
- Trezor found that the implant sits between the Safe 5 main board and screen and does not alter the wallet's firmware or Secure Element.
- Firmware version 2.13.1 blocks the implants found so far from capturing data on updated devices, but cannot protect backups captured earlier.
- No funds have been reported lost by the three owners. Trezor says 48 CryptoBilis customers have contacted it and inspections are ongoing.
- Trezor has not identified who installed the implants or where in the supply chain this occurred; so far it has found them only in CryptoBilis-sold Safe 5 wallets.
Article Details
- Victim Organization
- Trezor
- Incident Type
- Hardware supply-chain implant in Trezor Safe 5 wallets, capable of capturing and transmitting recovery phrases and passphrases
- Data Types Exposed
- Recovery phrases (the implant copies them when displayed during backup creation or restoration)
- Passphrases (copied if displayed on the wallet screen)
- Affected Records
- 3 wallets were found to contain implants; 1 was examined in Trezor's lab and 2 were identified from owner-submitted photos.
- Operational Impact
- The implant encrypts captured data and sends it to an attacker-controlled server over a mobile network, retrying if it cannot connect. Trezor reported no lost funds among the three owners. Firmware version 2.13.1 stops the identified implants from capturing data on updated wallets, but does not protect backups captured before the update.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Vendors
Ledgerthe company's wallets in Southeast Asia until October 9, when the company removed it. That was the day Ledger, another hardware wallet maker, began investigating losses of funds among the reseller's customers.TrezorThree Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday.
Products
Model TVersion 2.13.1 was released for the Safe 7, Safe 5, Safe 3 and Model T, according to the company's firmware changelog. The company will not publish technical details that could help attackers or put customers at risk,Safe 3Version 2.13.1 was released for the Safe 7, Safe 5, Safe 3 and Model T, according to the company's firmware changelog. The company will not publish technical details that could help attackers or put customers at risk,Safe 5Three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday.Safe 7Version 2.13.1 was released for the Safe 7, Safe 5, Safe 3 and Model T, according to the company's firmware changelog. The company will not publish technical details that could help attackers or put customers at risk,