Trezor Finds Spy Implants in Wallets Sold by Reseller CryptoBilis
Trezor says three Safe 5 wallets bought from reseller CryptoBilis hid an extra circuit board that reads the recovery phrase and sends it over a cellular link.
⚡ Why it matters
Your recovery phrase is the key to all your funds; whoever has it can move your coins from anywhere. Buy hardware wallets only from the manufacturer or an authorized reseller.
Hardware wallet maker Trezor says three Trezor Safe 5 wallets sold through the reseller CryptoBilis contained an implant: an additional circuit board capable of capturing the device's recovery phrase.
According to the company, the implanted board reads the phrase from the wallet's screen and transmits it over a cellular network to a server controlled by the attackers. Trezor examined one of the devices in its lab and has released a fix.
How to protect yourself
- Buy hardware wallets only from the manufacturer's official store or a reseller on its authorized list.
- Inspect the packaging and seals on delivery, and update the firmware from the official app.
- If you bought a wallet from an unauthorized seller, generate a new recovery phrase on a trusted device and move your funds to it.
- Never photograph your recovery phrase or store it on your phone or in the cloud.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.