# Trezor Warns of Compromised Hardware Wallets Following Ledger Security Breach Malicious hardware implants discovered in devices sold through a former authorized reseller. - **Source:** [Bitcoin News](https://brifing.si/source/d8aeaf1e-9839-4dad-9d25-7a6bf3fbeef8) - **Published:** 2026-10-30 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a3f92866-da35-48c3-bd54-b40f05f1ade9 ## Malicious Hardware Implant Discovery Trezor identified a suspected malicious hardware implant within a Safe 5 wallet model. The device was purchased through CryptoBilis, a former authorized reseller based in Southeast Asia. The report, received on October 28, 2026, involves an unauthorized circuit board modification designed to capture sensitive user recovery phrases via cellular transmission. ## Sophisticated Supply Chain Attack The compromised hardware features an additional circuit board installed between the main board and the screen. Equipped with a cellular module and antenna, the implant captures displayed data and transmits it over mobile networks when powered. This sophisticated physical modification mirrors recent supply chain attacks targeting the broader cryptocurrency hardware market. ## Connection to Ledger Scandal This incident follows a massive security breach involving Ledger, where compromised devices distributed via CryptoBilis led to estimated losses of $93 million. Ledger confirmed that a highly organized criminal group orchestrated the attack. Trezor is currently investigating whether the same perpetrators are responsible for the suspected compromise of its own devices. ## Reseller Network Risk Mitigation Trezor revoked CryptoBilis' authorization on October 9, 2026, following the initial Ledger reports. The company plans to significantly reduce its global authorized reseller network starting January 1, 2027. This strategic shift aims to regain control over the distribution chain and prevent further unauthorized physical tampering with consumer-facing hardware wallet products. ## Urgent User Security Protocols Trezor advises all customers who purchased devices from CryptoBilis since March 2026 to immediately transfer funds to new wallets. Users must generate fresh recovery phrases, as restoring existing phrases on new devices will not mitigate the risk. Those who have not yet initialized their devices are strongly cautioned against doing so. ## Investigation and Verification Status While Trezor has reviewed photographs and conducted customer interviews, it has not yet physically examined the compromised unit. The company treats the report as credible while awaiting laboratory verification. No funds have been reported stolen from Trezor customers thus far, and no similar reports have emerged from other authorized reseller channels. ## Replacement and Support Policy Affected buyers are eligible for a replacement device shipped directly from the company or a voucher covering the cost of a new wallet. Trezor emphasized that this warning applies to all models purchased through CryptoBilis, despite the specific implant report being limited to a single Safe 5 device unit. ## Broader Industry Security Implications The incident highlights critical vulnerabilities in hardware supply chains, where physical access to devices allows for sophisticated espionage. As manufacturers coordinate with security researchers, the focus remains on verifying the extent of the breach. This event underscores the necessity for rigorous distribution oversight to protect users from advanced, hardware-level criminal operations. ## Sources covering this story - https://news.bitcoin.com/security/trezor-warns-compromised-hardware-wallet-93m-ledger-security-scare/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._