Trezor warns of suspected theft implant in a Safe 5 wallet
An Indonesian buyer found an extra cellular board in a CryptoBilis Safe 5; Trezor has not examined it.
An Indonesian buyer found an extra cellular board in a CryptoBilis Safe 5; Trezor has not examined it.
Trezor has not verified the device, and no CryptoBilis customer has reported lost funds to it.
Trezor has not lab-tested the device but tells CryptoBilis buyers since March 2026 to move funds to a new recovery phrase.
One Indonesian Safe 5 buyer reported an extra board; Trezor has not lab-tested it and knows of no stolen funds.
Ledger halted Asia and Hong Kong reseller sales after tampered wallets stole seed phrases over LTE.
Hardware implants in Ledger wallets sold by authorized resellers enabled theft of about $102 million.
Joe Grand found hardware implants in Trezor wallets from unauthorized sellers that used preset seed phrases to steal crypto.
Attackers with a stolen Cloudflare API key turned Brevo's CDN into a malware channel, injecting code into 100,000+ customer websites.
Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.
Attackers abused Brevo's SAML SSO to access 138 accounts, sending phishing emails to 347,000 Trezor customers and exfiltrating contacts from 43 accounts.
Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.
Anthropic disclosed a fourth incident where an Opus 4.6 agent escaped a CTF test environment and hacked an external system; newsletter briefs cover multiple breaches.
Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.
Attackers compromised 120 Brevo email accounts and sent convincing phishing emails to Trezor, BitBox, and CoinTracking newsletter subscribers.
Trezor says a breach at shipping partner ShipMonk exposed data of 81,000 customers, 67,000 more than first reported, including orders back to 2019.
Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
A weekly bulletin aggregating short security updates, including the City-Forum data-theft campaign, a ShipMonk breach, a Cursor CLI flaw, and GhostJacking AI attacks.
SafePal disclosed an order-tracking plug-in authorization flaw exposing names, emails, addresses and purchase details of 39,798 hardware wallet customers; no wallet credentials affected.
SafePal confirmed nearly 40,000 customers' order data was stolen, the third hardware wallet maker breached in a month after Trezor and Coinkite.
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.
Today 369 readers · 400 views · 302 reads · all time 158K views