Trezor has reduced its reseller network by 80% after uncovering additional spy implants in devices distributed by Malaysian vendor CryptoBilis. The hardware wallet manufacturer implemented new vendor requirements focused on device sourcing, storage, and access controls. Only 20% of existing resellers met the stricter standards.
The company stated that the removed resellers "were trustworthy and posed no immediate threat." Despite the widespread cuts, Trezor emphasized that the action was precautionary rather than indicative of vendor culpability.
Software Update Targets Implant Vulnerability
Trezor released an update on November 11 designed to disable the spy implants' functionality. According to a company spokesperson, the implant operated by monitoring communication between the device's microcontroller and display, triggering data capture when detecting a specific sequence corresponding to a wallet's seed phrase.
Trezor addressed the vulnerability by altering "the order of the commands sent to the display," preventing the trigger sequence from activating without affecting the device's visible operation.
Limited Impact, Precautionary Measures
Three Trezor Safe 5 devices were found with implants, purchased between August 20 and September 23. Trezor confirmed that no cryptocurrency was stolen from the affected devices.
The company advised CryptoBilis customers to transfer funds to new wallets, noting that the software update cannot protect cryptocurrency backed up before the compromise. Affected customers are eligible for free device replacements.
Broader Supply Chain Attack
The incident is connected to a larger coordinated operation involving Trezor rival Ledger. Ledger wallets sold through CryptoBilis were drained of over $86 million in an attack involving tampered devices. The investigation identified an organized crime group that constructed spyware infrastructure including logistics networks, data collection servers, and asset laundering capabilities.
Tether froze $10 million in stolen funds from the Ledger incident. Ledger subsequently requested that multiple wallet vendors across Asia cease sales.
