Trezor has issued a warning to customers who purchased its hardware wallets through the former authorized reseller, CryptoBilis, advising them to transfer their funds as a precaution. This advisory follows alarming reports regarding potential tampering with certain devices, particularly the Trezor Safe 5 model.
On October 1, Trezor announced that a customer in Indonesia reported finding a fraudulent circuit board inside a Trezor Safe 5 wallet bought from Tokopedia in August. The suspected implant can reportedly capture sensitive information displayed on the wallet’s screen, including recovery phrases, and could transmit this data using a mobile network.
Danny Saunders, Trezor’s Chief Commercial Officer, emphasized the company’s commitment to user safety: “While we have not yet installed this device in our lab, we are treating the report as reliable. We would rather warn people now than wait for confirmation and find out that someone has lost their funds in the meantime.” Despite the seriousness of the claim, Trezor has yet to conduct tests on the device and has not received communication regarding any thefts tied to this incident.
A Trezor spokesperson confirmed that sales through CryptoBilis have been minimal but refrained from sharing specific figures. The company has yet to determine how the alleged tampering occurred and is currently reviewing its hardware security measures, recognizing that its existing protections, such as seals and packaging, may not be sufficient.
Connection to Recent Ledger Incidents
This warning comes in the wake of reports concerning Ledger wallets obtained via CryptoBilis, where it was confirmed that malicious hardware had been embedded in at least one device. Security researcher Joe Grand previously informed Trezor of potential compromises affecting Trezor One and Model T wallets sold by unauthorized sources on platforms like TikTok and Facebook. In response, Trezor clarified that previous statements regarding device integrity only applied to wallets sold through authorized channels.
Trezor reiterated that while their setup checks are designed to identify counterfeit devices and modified firmware, the malicious hardware discovered in Ledger devices had the capability to read the screen output without altering the firmware. Such a breach could allow unauthorized users to recover the wallet on different devices, leading to potential theft.
In light of these developments, Trezor has announced plans to streamline its reseller network, aiming to enhance customer protection and minimize risks associated with unauthorized sales.
Recommendations for Users
- Users of Trezor wallets purchased through CryptoBilis are urged to transfer their cryptocurrency assets to secure wallets without delay.
- Stay informed about updates and findings from Trezor as they conduct a thorough review of their hardware security measures.
- Consider sourcing hardware wallets only from authorized resellers to mitigate risk.
Furthermore, as the landscape of cryptocurrency security continues to evolve, remaining vigilant and informed is essential for all users of digital wallet technology.
