Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Trezor warns of seed-stealing implant in CryptoBilis wallets

Original title: Trezor warns some of its wallets may hide a seed-stealing implant

Help Net Securityby Sinisa Markovic ()3 min read
Part of a story covered by 5 sourcesTrezor Warns of Suspected Spy Implant Stealing Recovery PhrasesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Trezor advises moving funds from CryptoBilis Safe 5 wallets after possible hardware implant discovered.

A Trezor Safe 5 sold by CryptoBilis may contain an extra board with cellular module that steals the recovery phrase. The device reads the screen and sends data over mobile network. Trezor issued the warning after a customer report and to match similar Ledger implants. Buyers should move funds to new wallets immediately. Trezor has cut ties with CryptoBilis as reseller.

Key facts
  • Implant reads screen and sends backup phrase
  • Works like Ledger tampered devices
  • Warning issued October 2026
  • Funds must be moved immediately
  • Trezor dropped CryptoBilis reseller
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

From the original article

3 min read at helpnetsecurity.com

A Trezor Safe 5 sold by CryptoBilis, the reseller linked to the recent Ledger wallet drains, may contain a hidden implant that steals the owner’s recovery phrase, Trezor has warned. Trezor is a Czech company and part of SatoshiLabs Group. It has made hardware wallets since 2014, and its current models are the Safe 3, Safe 5 and Safe 7.

Help Net Security

By Sinisa Markovic · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.