Trezor warns of suspected implant in Safe 5 sold by CryptoBilis
Trezor has not lab-tested the device but tells CryptoBilis buyers since March 2026 to move funds to a new recovery phrase.
74
Vendor
Ledger
- Mentions · 7d2
- Mentions · 30d12
- All mentions17
- First seenAug 18, 2026
- Last mentioned18h ago
Timeline
17 articles · newest firstTrezor warns of suspected implant in CryptoBilis wallet
One Indonesian Safe 5 buyer reported an extra board; Trezor has not lab-tested it and knows of no stolen funds.
64
Weekly recap: BeyondTrust zero-day, ConnectWise access, Ledger thefts
Armory Castle used CVE-2026-102764 for file operations, then planted SAWFLY and BARECLAW on a few victims.
78
Ledger implant linked to $93M theft; npm flaw hit 1,500 packages
The roundup also covers an exploited Windows Shell flaw and an Ivanti Connect Secure zero-day chain.
74
Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger halted Asia and Hong Kong reseller sales after tampered wallets stole seed phrases over LTE.
78
Who Is Planting Backdoors in Ledger Crypto Wallets?
Hardware implants in Ledger wallets sold by authorized resellers enabled theft of about $102 million.
80
Risky Bulletin: Spyware chip found in Ledger crypto-wallets
Spy chips in Ledger Nano X wallets sold via CryptoBilis stole seed phrases and over $86 million.
82
Trezor Wallets Also Compromised with Implants
Joe Grand found hardware implants in Trezor wallets from unauthorized sellers that used preset seed phrases to steal crypto.
58
Crypto thieves sell hardware wallets with secret eSIM
Tampered Ledger Nano X wallets with hidden LTE modems stole seed phrases, draining about $93 million.
74
Ledger confirms hardware wallet spy implant behind crypto thefts
Ledger confirmed spy implants in CryptoBilis-sold Nano X wallets captured seed phrases and drained users' cryptocurrency.
78
Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis
Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet linked to cryptocurrency theft.
70
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Ledger found a hardware implant in a CryptoBilis-sold wallet after reports of more than $86 million in stolen crypto.
76
Threat Actors Use Google Ads To Target Ledger Users
Attackers used malicious Google ads to phish Ledger users for cryptocurrency recovery phrases.
71
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
Hackers exploited an Elements bug to take ~4,000 BTC from Liquid Network, returned 3,400 BTC (~$265M), and still hold ~598.5 BTC (~$47M).
70
New CISO appointments 2026
Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.
14
Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
50
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
SafePal disclosed an order-tracking plug-in authorization flaw exposing names, emails, addresses and purchase details of 39,798 hardware wallet customers; no wallet credentials affected.
48
Related CVEs
by mentions- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
Appears with
- Cryptobilisorganization · 10
- Trezorvendor · 7
- Ledgerorganization · 5
- Tibane Labsorganization · 4
- Ledger Nano Xproduct · 4
- Trezor Safe 5product · 2
- Ledger Flexproduct · 2
- MediaMarktorganization · 2
- Microsoftvendor · 2
- Ledger hardware walletproduct · 2
- CryptoBilis customersvictim · 2
- Microsoftorganization · 2
- Ledgerproduct · 2
- Ahold Delhaizevictim · 2
- Donjonorganization · 1
- Keychainproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.