Trezor warns of suspected hardware crypto-theft implant
Trezor Safe 5
Hardware wallet maker Trezor received reports regarding a suspected physical crypto-theft implant found in a device sold by a regional reseller. Users are urged to inspect devices and source hardware directly.
why this severityConfirmed hardware implant report in the wild.
- fix status
- Patched
- affected
- Trezor Safe 5
- first report
- 30 Oct 2026
- last update
- 13 Nov 2026
What to do
Inspect hardware wallets purchased from third-party resellers for unauthorized extra circuit boards.
Timeline · 3
Sources · 3
News and write-ups
- 2026-10-30Trezor warns of suspected crypto-theft implant in hardware walletBleepingComputer · bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implan
- 2026-11-13Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery PhrasesThe Hacker News · thehackernews.com/2026/11/trezor-confirms-hidden-hardware.html
- 2026-11-13Trezor confirms crypto-stealing implants in three wallets, releases fixBleepingComputer · bleepingcomputer.com/news/cryptocurrency/trezor-confirms-crypto-stealing-implant
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Supply chain
- AI role
- No AI role
- categories
- General security
- severity
- 3 · Confirmed exploitation
- fix status
- Patched
- targets
- Not applicable
- owasp llm top 10
- no entry for these categories
- mitre atlas
- no technique for these categories
- dates
- happened 30 Oct 2026 · first reported 30 Oct 2026
- origin
- News & research feeds
- record
- confidence 0.90 · created 2026-10-30 18:43Z · updated 2026-11-13 20:22Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Trezor warns of suspected hardware crypto-theft implant https://gcdradar.vercel.app/incidents/trezor-warns-of-suspected-hardware-crypto-theft-implant · AIR-2026-1671 · live - Lane: Supply chain - Severity: 3 (Confirmed exploitation): Confirmed hardware implant report in the wild. - Fix status: Patched - First reported: 2026-10-30 - AI role: No AI role - Products: Trezor Safe 5 ## Summary Hardware wallet maker Trezor received reports regarding a suspected physical crypto-theft implant found in a device sold by a regional reseller. Users are urged to inspect devices and source hardware directly. ## What to do Inspect hardware wallets purchased from third-party resellers for unauthorized extra circuit boards. ## Affected and fixed versions - Affected: Trezor Safe 5 ## Latest updates - 2026-11-13: Vendor confirms three wallets contained malicious hardware implants and releases a fix. (https://bleepingcomputer.com/news/cryptocurrency/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix) - 2026-11-13: Trezor confirms hidden implants found in wallets sold by CryptoBilis that can steal recovery phrases (https://thehackernews.com/2026/11/trezor-confirms-hidden-hardware.html) - 2026-10-30: Trezor warns of suspected crypto-theft implant in hardware wallet (https://bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet) ## Sources - 2026-10-30 BleepingComputer: Trezor warns of suspected crypto-theft implant in hardware wallet https://bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet - 2026-11-13 The Hacker News: Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases https://thehackernews.com/2026/11/trezor-confirms-hidden-hardware.html - 2026-11-13 BleepingComputer: Trezor confirms crypto-stealing implants in three wallets, releases fix https://bleepingcomputer.com/news/cryptocurrency/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- liveDixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units
Patch now · Exploited · since 13 Nov 2026
- live8.6UnrealIRCd CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability
Patch now · Exploited · Partly patched · since 13 Nov 2026 · CVE-2026-114713
- liveCity of Osaka municipal systems City of Osaka suffers data breach impacting one million residents
Breaches & attacks · Real loss · since 13 Nov 2026
- liveUniversity of Texas at Arlington discloses data breach from cyberattack
Breaches & attacks · Exploited · since 13 Nov 2026
- livePDF viewers Genuine PDF Forgeries: Attacking Signature Verification via Human Factors
Research · since 13 Nov 2026
- liveAMD SEV-SNP Mior and Skyfall Attacks Target AMD SEV-SNP VMs
Research · since 13 Nov 2026