Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases

Trezor confirmed that three of its Safe 5 hardware wallets purchased from the reseller CryptoBilis contain hidden malicious implants designed to steal recovery phrases. The implant, positioned between the main board and screen, captures the recovery phrase during setup or restoration and transmits it over mobile networks to attacker-controlled servers. Although no fund losses have been reported, Trezor advises users who bought from CryptoBilis since March to move funds to a new wallet with a new recovery phrase and warns against using or restoring backups on potentially compromised devices.

AI-extracted · verify before operational use