Saw this on Trezor’s official account: A Safe 5 sold by CryptoBilis, a former authorized reseller in Southeast Asia, was reported by a user through responsible disclosure as a suspected hardware implant. A circuit board with a cellular module had been added between the mainboard and screen. It allegedly could read the recovery phrase displayed on the screen and transmit it over a mobile network once plugged in.

Key facts: The report was received on 10/28, and the device was purchased through Tokopedia in August. Trezor has yet to receive the actual device for laboratory testing, but considers the report credible based on the description and video interview. It is urging anyone who has bought any model from CryptoBilis since March to move their assets to a new wallet with a new recovery phrase as soon as possible, and not to reuse their old backup. No buyers have reported losing funds so far. Affected customers can contact support to exchange their device for a new one or receive a voucher. A supply-chain implant involving the same reseller had previously been reported on the Ledger side, and Trezor dropped the reseller on 10/9.

Another layer has been peeled back in the hardware wallet supply chain.

#硬件钱包 #安全 #Trezor