Hardware implants reported in Trezor and Ledger wallets

Joe Grand and others reported hardware implants in Trezor and Ledger wallets, with Ledger-linked losses of about $102 million.

Hardware researcher Joe Grand found malicious implants in a Trezor Model T purchased on Facebook Marketplace in Canada and a Trezor One from a TikTok shop. Attackers replaced the microcontroller so the open-source firmware produced one of roughly a dozen predetermined recovery seeds, and the Trezor One buyer lost about $50; both models are discontinued but still supported. Trezor told Grand the Model T resembled modified devices seen on Russian marketplaces in 2022–2023, yet publicly said it has no evidence of compromise while shrinking its authorized-reseller list as a precaution. Separately, Ledger said implants in wallets sold by Malaysian reseller CryptoBilis enabled theft now valued at about $102 million from roughly 315 accounts, according to Bitquery, covering Bitcoin, Ethereum, and Tron. Users and researchers also reported implants in Ledger Nano X, Flex, and Stax devices, including two Nano X units bought at German MediaMarkt stores, and Grand had notified Ledger of similar Nano X implants in March. Ledger said there is no indication its own infrastructure was compromised and instructed resellers not to restock returned devices.

• Joe Grand found hardware implants in a Trezor Model T bought on Facebook Marketplace in Canada and a Trezor One from a TikTok shop.
• Replaced microcontrollers made the Trezor firmware produce one of roughly a dozen preset recovery seeds; a Trezor One buyer lost about $50.
• Both Trezor models are discontinued but still supported. Trezor told Grand the Model T resembled devices modified on Russian marketplaces in 2022–2023, while publicly saying it has no evidence of compromise and cutting authorized resellers…
• Ledger said implants in wallets sold by Malaysian reseller CryptoBilis enabled theft now valued at about $102 million from roughly 315 accounts, according to Bitquery, including Bitcoin, Ethereum, and Tron.
• Implants were also reported in Ledger Nano X, Flex, and Stax devices, including two Nano X units bought in person at MediaMarkt stores in Germany.
• Joe Grand notified Ledger of similar Nano X implants in March. Ledger said its own infrastructure shows no sign of compromise and told resellers not to restock returned devices.