{"receipt":{"id":"01M4W2WRDRN4C8JMJJRHTGGQR7","canonicalUrl":"https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants","submittedUrl":"https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants","domain":"www.zetter-zeroday.com","title":"Trezor Wallets Also Compromised with Implants","description":"Despite claims by Trezor today that none of its devices have been compromised -- unlike the devices of its competitor, Ledger -- hardware hacker Joe Grand says he found implants in two Trezor devices and reported this to the company in August.","ogImageUrl":"https://storage.ghost.io/c/77/50/77508a24-24ec-49e5-99f8-d3dadb30a5ac/content/images/size/w1200/2026/10/Screenshot-2026-10-13-at-4.01.25---PM.png","linkType":"other","state":"ready","failReason":null,"hazardQuarantined":false,"textHash":"598153efe12b9f35f5428381bbbf15f30b40a3304f3edf886a33e294894ac263","fetchedAt":"2026-10-14T02:15:42.736Z","version":1,"requestedByType":"agent","kind":"page","subjectType":null,"subjectId":null,"createdAt":"2026-10-14T02:12:05.803Z","updatedAt":"2026-10-14T02:27:25.557Z","requestedByHandle":"house_tech"},"claims":[{"id":"01M4W2Y215QRSS19VC1ZW44KMN","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":0,"text":"I published a story this morning about implants that have been discovered in a number of Ledger crypto devices.","sourceText":"I published a story this morning about implants that have been discovered in a number of Ledger crypto devices.","derivedFrom":"span","context":"I published a story this morning about implants that have been discovered in a number of Ledger crypto devices. In initial had included in the story information about implants that were also discovered in devices made by Trezor – Ledger's main competitor. I removed this, however, before publishing the story because I didn't want to confuse matters.","spanStart":0,"spanEnd":111,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:31.917Z","evidence":[],"history":[{"id":"01M4W2Y2VJQ43R15648K2V13PY","claimId":"01M4W2Y215QRSS19VC1ZW44KMN","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:49.129Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMP","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":1,"text":"In initial had included in the story information about implants that were also discovered in devices made by Trezor – Ledger's main competitor.","sourceText":"In initial had included in the story information about implants that were also discovered in devices made by Trezor – Ledger's main competitor.","derivedFrom":"span","context":"I published a story this morning about implants that have been discovered in a number of Ledger crypto devices. In initial had included in the story information about implants that were also discovered in devices made by Trezor – Ledger's main competitor. I removed this, however, before publishing the story because I didn't want to confuse matters.","spanStart":112,"spanEnd":255,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:31.368Z","evidence":[{"id":"01M4W3B23WCADB3473426MFHRT","claimId":"01M4W2Y215QRSS19VC1ZW44KMP","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"The implants did not compromise the devices’ security chips or alter transactions, Ledger said.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:19:54.612Z"},{"id":"01M4W3FFVA0DQY9VY17PKYXTQE","claimId":"01M4W2Y215QRSS19VC1ZW44KMP","url":"https://www.bifu.co/news/detail/trezor-cuts-reseller-network-in-supply-chain-security-push","domain":"www.bifu.co","quotedSpan":"Trezor's letter to resellers being dropped made no mention of Ledger.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:22:19.738Z"}],"history":[{"id":"01M4W2Y3MW53SFAFNKA9CX16PM","claimId":"01M4W2Y215QRSS19VC1ZW44KMP","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:49.928Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMQ","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":2,"text":"I removed this, however, before publishing the story because I didn't want to confuse matters.","sourceText":"I removed this, however, before publishing the story because I didn't want to confuse matters.","derivedFrom":"span","context":"I published a story this morning about implants that have been discovered in a number of Ledger crypto devices. In initial had included in the story information about implants that were also discovered in devices made by Trezor – Ledger's main competitor. I removed this, however, before publishing the story because I didn't want to confuse matters.","spanStart":256,"spanEnd":350,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:30.820Z","evidence":[],"history":[{"id":"01M4W2Y4E2X3J4DXAVDQMDJ8NP","claimId":"01M4W2Y215QRSS19VC1ZW44KMQ","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:50.723Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMR","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":3,"text":"But a few hours ago Trezor announced on X that it would be reducing the number of merchants authorized to sell its devices out of an \"abundance of caution.\"","sourceText":"But a few hours ago Trezor announced on X that it would be reducing the number of merchants authorized to sell its devices out of an \"abundance of caution.\"","derivedFrom":"span","context":"But a few hours ago Trezor announced on X that it would be reducing the number of merchants authorized to sell its devices out of an \"abundance of caution.\" Chief Commercial Officer Danny Sanders wrote that there was \"not a single piece of evidence that Trezor devices have been compromised,\" and that this was reducing its list of authorized sellers simply as a \"preventive step\" to have better control over its supply chain.","spanStart":0,"spanEnd":156,"status":"corroborated","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:51.184Z","evidence":[{"id":"01M4W3DCYZRDP1XP037S0JBQD8","claimId":"01M4W2Y215QRSS19VC1ZW44KMR","url":"https://www.bifu.co/news/detail/trezor-cuts-reseller-network-in-supply-chain-security-push","domain":"www.bifu.co","quotedSpan":"Trezor, a major crypto hardware wallet provider, is shrinking the list of retailers authorized to sell its devices.","spanVerified":true,"stance":"supports","independent":true,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:11.264Z"},{"id":"01M4W3HM953V6NBTPSG9D00FAA","claimId":"01M4W2Y215QRSS19VC1ZW44KMR","url":"https://cryptorank.io/news/feed/eeaea-trezor-supply-chain-action-wallet-tampering","domain":"cryptorank.io","quotedSpan":"After a Ledger reseller sold hardware wallets reportedly modified to steal recovery phrases, with suspected losses exceeding $93 million, Trezor is reducing its authorized reseller network and tightening supply-chain checks. … Trezor, a major crypto hardware wallet maker, is cutting the number of shops allowed to sell its devices.","spanVerified":true,"stance":"supports","independent":true,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:29.810Z"},{"id":"01M4W3NN9QCYGHATXYV2M94T5E","claimId":"01M4W2Y215QRSS19VC1ZW44KMR","url":"https://trezor.io/blog/insights/lessons-from-the-coldcard-incident","domain":"trezor.io","quotedSpan":"First things first: Trezor devices are not affected.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:25:41.940Z"}],"history":[{"id":"01M4W2Y5758YYMR6HX9FG9FRTM","claimId":"01M4W2Y215QRSS19VC1ZW44KMR","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:51.528Z"},{"id":"01M4W3QS843A93GYZFWRZJK76C","claimId":"01M4W2Y215QRSS19VC1ZW44KMR","fromStatus":"unverified","toStatus":"corroborated","reason":"l3_supports","actorType":"system","createdAt":"2026-10-14T02:26:51.184Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMS","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":4,"text":"Chief Commercial Officer Danny Sanders wrote that there was \"not a single piece of evidence that Trezor devices have been compromised,\" and that this was reducing its list of authorized sellers simply as a \"preventive step\" to have better control over its supply chain.","sourceText":"Chief Commercial Officer Danny Sanders wrote that there was \"not a single piece of evidence that Trezor devices have been compromised,\" and that this was reducing its list of authorized sellers simply as a \"preventive step\" to have better control over its supply chain.","derivedFrom":"span","context":"But a few hours ago Trezor announced on X that it would be reducing the number of merchants authorized to sell its devices out of an \"abundance of caution.\" Chief Commercial Officer Danny Sanders wrote that there was \"not a single piece of evidence that Trezor devices have been compromised,\" and that this was reducing its list of authorized sellers simply as a \"preventive step\" to have better control over its supply chain.","spanStart":157,"spanEnd":426,"status":"unverified","notAutoChecked":"private_party","namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":false,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:14:17.729Z","evidence":[],"history":[{"id":"01M4W2Y5ZQVY1XNRZT7E2VSXRW","claimId":"01M4W2Y215QRSS19VC1ZW44KMS","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:52.331Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMT","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":5,"text":"Famed hardware hacker Joe Grand found implants in two Trezor wallets recently.","sourceText":"Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August.","derivedFrom":"split","context":"But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","spanStart":29,"spanEnd":153,"status":"unverified","notAutoChecked":"private_party","namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":false,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:18:20.947Z","evidence":[],"history":[{"id":"01M4W2Y6RB54KYGRGQ417VRXW8","claimId":"01M4W2Y215QRSS19VC1ZW44KMT","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:53.119Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2ZZ84Z9X6QX91PQ3CTANY","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":6,"text":"Famed hardware hacker Joe Grand notified the company about the implants in August.","sourceText":"Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August.","derivedFrom":"split","context":"But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","spanStart":29,"spanEnd":153,"status":"unverified","notAutoChecked":"private_party","namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":false,"createdAt":"2026-10-14T02:13:51.256Z","updatedAt":"2026-10-14T02:18:22.376Z","evidence":[],"history":[{"id":"01M4W30026N572EAJSNFHTMJKC","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTANY","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:51.760Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMV","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":7,"text":"I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents.","sourceText":"I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents.","derivedFrom":"span","context":"But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","spanStart":154,"spanEnd":262,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:35.220Z","evidence":[],"history":[{"id":"01M4W2Y7GHAWVKBHTSKF5P30TH","claimId":"01M4W2Y215QRSS19VC1ZW44KMV","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:53.902Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMW","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":8,"text":"The Ledger implants became news.","sourceText":"The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","derivedFrom":"split","context":"But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","spanStart":263,"spanEnd":518,"status":"corroborated","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:55.513Z","evidence":[{"id":"01M4W3EKBYG02RCR21M3EXWDYQ","claimId":"01M4W2Y215QRSS19VC1ZW44KMW","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Ledger Confirms LTE-Enabled Spy Implants in CryptoBilis Wallets","spanVerified":true,"stance":"supports","independent":true,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:50.572Z"},{"id":"01M4W3JP7ZQ26Y79VPMY7EECP1","claimId":"01M4W2Y215QRSS19VC1ZW44KMW","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis","spanVerified":true,"stance":"supports","independent":true,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:04.596Z"}],"history":[{"id":"01M4W2Y88V18TTQFMFH3WS307K","claimId":"01M4W2Y215QRSS19VC1ZW44KMW","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:54.674Z"},{"id":"01M4W3QXEM6M6G1C4R0AYSTP5V","claimId":"01M4W2Y215QRSS19VC1ZW44KMW","fromStatus":"unverified","toStatus":"corroborated","reason":"l3_supports","actorType":"system","createdAt":"2026-10-14T02:26:55.513Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2ZZ84Z9X6QX91PQ3CTANZ","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":9,"text":"The Ledger implants were sold in devices distributed by authorized resellers of Ledger devices.","sourceText":"The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","derivedFrom":"split","context":"But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","spanStart":263,"spanEnd":518,"status":"corroborated","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:13:51.256Z","updatedAt":"2026-10-14T02:26:57.621Z","evidence":[{"id":"01M4W3CBYP6J9447GJ336XD9XP","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTANZ","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"The incident surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines.","spanVerified":true,"stance":"supports","independent":true,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:20:37.440Z"},{"id":"01M4W3GKX282WXHA4WVF2B18B1","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTANZ","url":"https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen","domain":"www.coindesk.com","quotedSpan":"Ledger said every confirmed case involves devices sold by the Southeast Asian reseller, but critics say the hardware-wallet maker must answer for an authorized sales channel.","spanVerified":true,"stance":"supports","independent":true,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:22:56.657Z"}],"history":[{"id":"01M4W300TAYR0YAQ93TP3KQN45","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTANZ","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:52.584Z"},{"id":"01M4W3QZH8KQHY5R6KSV47P9ZZ","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTANZ","fromStatus":"unverified","toStatus":"corroborated","reason":"l3_supports","actorType":"system","createdAt":"2026-10-14T02:26:57.621Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2ZZ84Z9X6QX91PQ3CTAP0","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":10,"text":"The Ledger implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","sourceText":"The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","derivedFrom":"split","context":"But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","spanStart":263,"spanEnd":518,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:13:51.256Z","updatedAt":"2026-10-14T02:26:38.515Z","evidence":[{"id":"01M4W3CYNEJMY80MXR2AS360FQ","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP0","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Ledger's Donjon security team says the implant captures 24-word recovery phrases from wallet screens and transmits them over LTE networks, while onchain investigator Specter traced more than $86 million in suspected thefts linked to the compromised devices.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:20:56.618Z"}],"history":[{"id":"01M4W301JJY50FCED8EPTNVCEE","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP0","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:53.358Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2ZZ84Z9X6QX91PQ3CTAP1","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":11,"text":"The Ledger implants became news because the implants were sold in devices distributed by authorized resellers of Ledger devices and were subsequently used to steal $100 million in crypto from the owners of compromised devices.","sourceText":"The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","derivedFrom":"split","context":"But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.","spanStart":263,"spanEnd":518,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:13:51.256Z","updatedAt":"2026-10-14T02:26:37.969Z","evidence":[{"id":"01M4W3N247R5AJWF076KQMQ6NZ","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP1","url":"https://cryptorank.io/news/feed/eeaea-trezor-supply-chain-action-wallet-tampering","domain":"cryptorank.io","quotedSpan":"After a Ledger reseller sold hardware wallets reportedly modified to steal recovery phrases, with suspected losses exceeding $93 million, Trezor is reducing its authorized reseller network and tightening supply-chain checks. Trezor says there is no evidence its devices were compromised; affected resellers can sell existing stock through the holiday season before losing authorization on January 1, 2027.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:25:22.297Z"}],"history":[{"id":"01M4W302AVC2M3NGHPBQPKDRMN","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP1","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:54.136Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMX","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":12,"text":"But as I noted in the Ledger story, Grand had initially found implants in four Ledger devices that were sold online by unauthorized Ledger merchants.","sourceText":"But as I noted in the Ledger story, Grand had initially found implants in four Ledger devices that were sold online by unauthorized Ledger merchants.","derivedFrom":"span","context":"But as I noted in the Ledger story, Grand had initially found implants in four Ledger devices that were sold online by unauthorized Ledger merchants. These merchants appeared to be fly-by-night sellers who popped up in online marketplaces only to disappear after days or weeks. So the provenance of the compromised devices was already sketchy, as opposed to the later implants that were sold by reputable and authorized sellers.","spanStart":0,"spanEnd":149,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:46.245Z","evidence":[{"id":"01M4W3F2536VXSV25ETNFR4T0B","claimId":"01M4W2Y215QRSS19VC1ZW44KMX","url":"https://www.cryptobreaking.com/ledger-traces-lte-spy-implants","domain":"www.cryptobreaking.com","quotedSpan":"Ledger says it has identified the method behind malicious implants found in some hardware wallets sold through reseller CryptoBilis. … Earlier coverage from Cointelegraph noted that losses were associated with Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia, and the Philippines.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:22:05.726Z"},{"id":"01M4W3K539MQV7ESTCWDQ15VGN","claimId":"01M4W2Y215QRSS19VC1ZW44KMX","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Ledger's Donjon security team says wallets sold by CryptoBilis contained an unauthorized component that reads the screen and decodes the recovery phrase when it appears.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:19.808Z"},{"id":"01M4W3Q3Z937344FX17SJXSE4X","claimId":"01M4W2Y215QRSS19VC1ZW44KMX","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:26:29.736Z"}],"history":[{"id":"01M4W2Y90YANZZTWS3S16PXMS5","claimId":"01M4W2Y215QRSS19VC1ZW44KMX","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:55.451Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMY","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":13,"text":"These merchants appeared to be fly-by-night sellers who popped up in online marketplaces only to disappear after days or weeks.","sourceText":"These merchants appeared to be fly-by-night sellers who popped up in online marketplaces only to disappear after days or weeks.","derivedFrom":"span","context":"But as I noted in the Ledger story, Grand had initially found implants in four Ledger devices that were sold online by unauthorized Ledger merchants. These merchants appeared to be fly-by-night sellers who popped up in online marketplaces only to disappear after days or weeks. So the provenance of the compromised devices was already sketchy, as opposed to the later implants that were sold by reputable and authorized sellers.","spanStart":150,"spanEnd":277,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:41.800Z","evidence":[],"history":[{"id":"01M4W2Y9SJVHS90G3MY2H83342","claimId":"01M4W2Y215QRSS19VC1ZW44KMY","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:56.224Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KMZ","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":14,"text":"So the provenance of the compromised devices was already sketchy, as opposed to the later implants that were sold by reputable and authorized sellers.","sourceText":"So the provenance of the compromised devices was already sketchy, as opposed to the later implants that were sold by reputable and authorized sellers.","derivedFrom":"span","context":"But as I noted in the Ledger story, Grand had initially found implants in four Ledger devices that were sold online by unauthorized Ledger merchants. These merchants appeared to be fly-by-night sellers who popped up in online marketplaces only to disappear after days or weeks. So the provenance of the compromised devices was already sketchy, as opposed to the later implants that were sold by reputable and authorized sellers.","spanStart":278,"spanEnd":428,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:41.253Z","evidence":[{"id":"01M4W3DPS5AXHTDZGT26RP2MP4","claimId":"01M4W2Y215QRSS19VC1ZW44KMZ","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"The incident surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:21.298Z"},{"id":"01M4W3HY3FTQG8NY1X4V69S5K4","claimId":"01M4W2Y215QRSS19VC1ZW44KMZ","url":"https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen","domain":"www.coindesk.com","quotedSpan":"Ledger said every confirmed case involves devices sold by the Southeast Asian reseller, but critics say the hardware-wallet maker must answer for an authorized sales channel.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:39.871Z"}],"history":[{"id":"01M4W2YAHW4VEM9CB1V8GPBT6W","claimId":"01M4W2Y215QRSS19VC1ZW44KMZ","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:57.013Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN0","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":15,"text":"The implants Grand found in Trezor One and Trezor Model T devices were also sold by third-party nonauthorized sellers – not by reputable authorized sellers.","sourceText":"The implants Grand found in Trezor One and Trezor Model T devices were also sold by third-party nonauthorized sellers – not by reputable authorized sellers.","derivedFrom":"span","context":"The implants Grand found in Trezor One and Trezor Model T devices were also sold by third-party nonauthorized sellers – not by reputable authorized sellers. No real surprise there, since both Ledger and Trezor have warned customers for years to purchase directly from their own web sites or from authorized merchants. Therefore the information that Grand found Trezor wallets compromised by implants didn't seem newsworthy. Especially because three years ago, researchers at Kaspersky Lab had also found an implant in a Trezor wallet sold on a popular Russian marketplace.","spanStart":0,"spanEnd":156,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:34.093Z","evidence":[{"id":"01M4W3BS9Q4T1C8935QM0HFTX6","claimId":"01M4W2Y215QRSS19VC1ZW44KN0","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not an authorized reseller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:20:18.339Z"},{"id":"01M4W3G1XE3VCQF7CECK7Z3KE2","claimId":"01M4W2Y215QRSS19VC1ZW44KN0","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:22:38.238Z"},{"id":"01M4W3M13FGPY5S2BVSQJFZMFP","claimId":"01M4W2Y215QRSS19VC1ZW44KN0","url":"https://www.cryptobreaking.com/ledger-traces-lte-spy-implants","domain":"www.cryptobreaking.com","quotedSpan":"Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:48.483Z"}],"history":[{"id":"01M4W2YBAC0WDYQTJKV1NNEXVN","claimId":"01M4W2Y215QRSS19VC1ZW44KN0","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:57.796Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN1","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":16,"text":"No real surprise there, since both Ledger and Trezor have warned customers for years to purchase directly from their own web sites or from authorized merchants.","sourceText":"No real surprise there, since both Ledger and Trezor have warned customers for years to purchase directly from their own web sites or from authorized merchants.","derivedFrom":"span","context":"The implants Grand found in Trezor One and Trezor Model T devices were also sold by third-party nonauthorized sellers – not by reputable authorized sellers. No real surprise there, since both Ledger and Trezor have warned customers for years to purchase directly from their own web sites or from authorized merchants. Therefore the information that Grand found Trezor wallets compromised by implants didn't seem newsworthy. Especially because three years ago, researchers at Kaspersky Lab had also found an implant in a Trezor wallet sold on a popular Russian marketplace.","spanStart":157,"spanEnd":317,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:35.758Z","evidence":[{"id":"01M4W3C71STJN7J71B19F8QWVB","claimId":"01M4W2Y215QRSS19VC1ZW44KN1","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Ledger and Trezor have each warned buyers against unauthorized sellers.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:20:32.433Z"}],"history":[{"id":"01M4W2YC2J79NJ8AMK3QXC0615","claimId":"01M4W2Y215QRSS19VC1ZW44KN1","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:58.574Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN2","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":17,"text":"Especially because three years ago, researchers at Kaspersky Lab had also found an implant in a Trezor wallet sold on a popular Russian marketplace.","sourceText":"Especially because three years ago, researchers at Kaspersky Lab had also found an implant in a Trezor wallet sold on a popular Russian marketplace.","derivedFrom":"span","context":"No real surprise there, since both Ledger and Trezor have warned customers for years to purchase directly from their own web sites or from authorized merchants. Therefore the information that Grand found Trezor wallets compromised by implants didn't seem newsworthy. Especially because three years ago, researchers at Kaspersky Lab had also found an implant in a Trezor wallet sold on a popular Russian marketplace. In its report, Kaspersky called it a fake wallet, but it was a real Trezor wallet that had been compromised.","spanStart":267,"spanEnd":415,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:39.061Z","evidence":[{"id":"01M4W3D3KVCKNXT6KPPTT9P92G","claimId":"01M4W2Y215QRSS19VC1ZW44KN2","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not an authorized reseller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:01.679Z"},{"id":"01M4W3NBEY267ADBKYMCEBBSKG","claimId":"01M4W2Y215QRSS19VC1ZW44KN2","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:25:31.863Z"}],"history":[{"id":"01M4W2YCV3FKRCS6M7QQE9P83D","claimId":"01M4W2Y215QRSS19VC1ZW44KN2","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:12:59.347Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN3","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":18,"text":"Grand found an implant in a Trezor Model T wallet.","sourceText":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August.","derivedFrom":"split","context":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August. The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account.","spanStart":0,"spanEnd":224,"status":"unverified","notAutoChecked":"private_party","namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":false,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:18:38.536Z","evidence":[],"history":[{"id":"01M4W2YDKPHESY65TN623HJRNS","claimId":"01M4W2Y215QRSS19VC1ZW44KN3","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:00.135Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2ZZ84Z9X6QX91PQ3CTAP2","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":19,"text":"Someone had purchased the Trezor Model T wallet via Facebook Marketplace in Canada some time in 2025.","sourceText":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August.","derivedFrom":"split","context":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August. The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account.","spanStart":0,"spanEnd":224,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:13:51.256Z","updatedAt":"2026-10-14T02:26:39.608Z","evidence":[{"id":"01M4W3NGCT98WVG2HGD78TQ0Z9","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP2","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:25:36.908Z"}],"history":[{"id":"01M4W3032X3MWQS8199BGV0K9J","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP2","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:54.912Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2ZZ84Z9X6QX91PQ3CTAP3","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":20,"text":"Grand found another implant in a Trezor One device.","sourceText":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August.","derivedFrom":"split","context":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August. The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account.","spanStart":0,"spanEnd":224,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:13:51.256Z","updatedAt":"2026-10-14T02:26:33.547Z","evidence":[{"id":"01M4W3KW5B4SVPJTBXVDYXD9X6","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP3","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Trezor Ends Reseller Network After Ledger Finds Spy Implant in Crypto Wallets","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:43.436Z"}],"history":[{"id":"01M4W303TZB9B89JF7MWJYABCG","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP3","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:55.677Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2ZZ84Z9X6QX91PQ3CTAP4","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":21,"text":"Someone had obtained the Trezor One device from a TikTok shop in August.","sourceText":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August.","derivedFrom":"split","context":"Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August. The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account.","spanStart":0,"spanEnd":224,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:13:51.256Z","updatedAt":"2026-10-14T02:26:37.404Z","evidence":[{"id":"01M4W3GXQ9VRKYCTF8G66Z44XA","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP4","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Trezor's advice then was to buy only from its official shop or an authorized reseller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:06.717Z"},{"id":"01M4W3MX79R02117CM7PCPR0HC","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP4","url":"https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet","domain":"gigazine.net","quotedSpan":"Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:25:17.285Z"}],"history":[{"id":"01M4W304K8YZTA06F5WZXM08JJ","claimId":"01M4W2ZZ84Z9X6QX91PQ3CTAP4","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:56.453Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN4","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":22,"text":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account.","sourceText":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account.","derivedFrom":"span","context":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","spanStart":0,"spanEnd":103,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:36.845Z","evidence":[{"id":"01M4W3CGX60XBT87T2RCM4MM81","claimId":"01M4W2Y215QRSS19VC1ZW44KN4","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Trezor Ends Reseller Network After Ledger Finds Spy Implant in Crypto Wallets","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:20:42.524Z"},{"id":"01M4W3GRT6BWBNHKX049SQBCTF","claimId":"01M4W2Y215QRSS19VC1ZW44KN4","url":"https://github.com/trezor/trezor-firmware/issues/965","domain":"github.com","quotedSpan":"WebUSB transport is disabled: libusb-1.0.so: cannot open shared object file: No such file or directory Features (159 bytes) { bootloader_hash: 32 bytes 0xf7fa165be6d780f3e1af00abc07df8b3076bcdad72d70da22a63d8896b6391d8, capabilities: [ Bitcoin (1), Bitcoin_like (2), Crypto (5), Ethereum (7), Lisk (8), NEM (10), Stellar (12), U2F (14), ], device_id: '9FD6BFDEACA691184AEFA0F1', imported: True, initialized: True, language: 'english', major_version: 1, minor_version: 8, model: '1', needs_backup: False, no_backup: False, passphrase_cached: False, passphrase_protection: False, patch_version: 3, pin_cached: False, pin_protection: False, revision: 20 bytes 0xdf0963ec48f01f3d07ffca556e21ff0070cab099, unfinished_backup: False, vendor: 'trezor.io', }","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:01.695Z"},{"id":"01M4W3MRA70RAY52APNSVXD5RM","claimId":"01M4W2Y215QRSS19VC1ZW44KN4","url":"https://www.bifu.co/news/detail/trezor-cuts-reseller-network-in-supply-chain-security-push","domain":"www.bifu.co","quotedSpan":"Trezor, a major crypto hardware wallet provider, is shrinking the list of retailers authorized to sell its devices.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:25:12.245Z"}],"history":[{"id":"01M4W2YECFEP23SJFNA8H0ETTT","claimId":"01M4W2Y215QRSS19VC1ZW44KN4","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:00.922Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN5","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":23,"text":"The Trezor One is a discontinued device.","sourceText":"Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","derivedFrom":"split","context":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","spanStart":104,"spanEnd":394,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:42.366Z","evidence":[{"id":"01M4W3J31F9T8Y1RZ91HM697XJ","claimId":"01M4W2Y215QRSS19VC1ZW44KN5","url":"https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet","domain":"gigazine.net","quotedSpan":"Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:44.944Z"}],"history":[{"id":"01M4W2YF4YQVFDD8V9W2ZA58P9","claimId":"01M4W2Y215QRSS19VC1ZW44KN5","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:01.716Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W35CZZTBY81CJA18B02T8P","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":24,"text":"The Trezor Model T is a discontinued device.","sourceText":"Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","derivedFrom":"split","context":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","spanStart":104,"spanEnd":394,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:16:49.131Z","updatedAt":"2026-10-14T02:26:40.725Z","evidence":[{"id":"01M4W3DHX2RABTCTHEEQ4Q44E4","claimId":"01M4W35CZZTBY81CJA18B02T8P","url":"https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet","domain":"gigazine.net","quotedSpan":"Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:16.310Z"},{"id":"01M4W3HS6GP4S6SGV3PGHV8S03","claimId":"01M4W35CZZTBY81CJA18B02T8P","url":"https://github.com/trezor/trezor-firmware/issues/965","domain":"github.com","quotedSpan":"WebUSB transport is disabled: libusb-1.0.so: cannot open shared object file: No such file or directory Features (159 bytes) { bootloader_hash: 32 bytes 0xf7fa165be6d780f3e1af00abc07df8b3076bcdad72d70da22a63d8896b6391d8, capabilities: [ Bitcoin (1), Bitcoin_like (2), Crypto (5), Ethereum (7), Lisk (8), NEM (10), Stellar (12), U2F (14), ], device_id: '9FD6BFDEACA691184AEFA0F1', imported: True, initialized: True, language: 'english', major_version: 1, minor_version: 8, model: '1', needs_backup: False, no_backup: False, passphrase_cached: False, passphrase_protection: False, patch_version: 3, pin_cached: False, pin_protection: False, revision: 20 bytes 0xdf0963ec48f01f3d07ffca556e21ff0070cab099, unfinished_backup: False, vendor: 'trezor.io', }","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:34.859Z"}],"history":[{"id":"01M4W35DVVVFHHPDH2R8ZV68J4","claimId":"01M4W35CZZTBY81CJA18B02T8P","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:16:49.706Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W35CZZTBY81CJA18B02T8Q","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":25,"text":"Trezor still supports the Trezor One and Trezor Model T.","sourceText":"Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","derivedFrom":"split","context":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","spanStart":104,"spanEnd":394,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:16:49.131Z","updatedAt":"2026-10-14T02:26:45.122Z","evidence":[{"id":"01M4W3ER7ZAWE1D05D0SHJRSJ6","claimId":"01M4W35CZZTBY81CJA18B02T8Q","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:55.580Z"},{"id":"01M4W3JV55FAJF50K136E81X2H","claimId":"01M4W35CZZTBY81CJA18B02T8Q","url":"https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet","domain":"gigazine.net","quotedSpan":"Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:09.623Z"},{"id":"01M4W3PT3P1CAWEPQVRPPBBVE7","claimId":"01M4W35CZZTBY81CJA18B02T8Q","url":"https://github.com/trezor/trezor-firmware/issues/965","domain":"github.com","quotedSpan":"WebUSB transport is disabled: libusb-1.0.so: cannot open shared object file: No such file or directory Features (159 bytes) { bootloader_hash: 32 bytes 0xf7fa165be6d780f3e1af00abc07df8b3076bcdad72d70da22a63d8896b6391d8, capabilities: [ Bitcoin (1), Bitcoin_like (2), Crypto (5), Ethereum (7), Lisk (8), NEM (10), Stellar (12), U2F (14), ], device_id: '9FD6BFDEACA691184AEFA0F1', imported: True, initialized: True, language: 'english', major_version: 1, minor_version: 8, model: '1', needs_backup: False, no_backup: False, passphrase_cached: False, passphrase_protection: False, patch_version: 3, pin_cached: False, pin_protection: False, revision: 20 bytes 0xdf0963ec48f01f3d07ffca556e21ff0070cab099, unfinished_backup: False, vendor: 'trezor.io', }","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:26:19.635Z"}],"history":[{"id":"01M4W35EQJ87BFYV1EQGTQW2F0","claimId":"01M4W35CZZTBY81CJA18B02T8Q","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:16:50.597Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W35CZZTBY81CJA18B02T8R","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":26,"text":"As noted in the product photo at top, Trezor will continue to distribute software updates for the Trezor One and Trezor Model T until 2031.","sourceText":"Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","derivedFrom":"split","context":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","spanStart":104,"spanEnd":394,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:16:49.131Z","updatedAt":"2026-10-14T02:26:43.485Z","evidence":[{"id":"01M4W3E9DRRQZVW4FBWHB5EJVK","claimId":"01M4W35CZZTBY81CJA18B02T8R","url":"https://en.bitcoin.it/wiki/Trezor","domain":"en.bitcoin.it","quotedSpan":"More information is on the Trezor Model One product page.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:40.403Z"},{"id":"01M4W3PCBJ62RMQBYGMECBHWE3","claimId":"01M4W35CZZTBY81CJA18B02T8R","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:26:05.546Z"}],"history":[{"id":"01M4W35FK8DGE3M7Y4PDHHD0Y2","claimId":"01M4W35CZZTBY81CJA18B02T8R","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:16:51.478Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W35CZZTBY81CJA18B02T8S","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":27,"text":"As noted in the product photo at top, Trezor will continue to distribute security updates for the Trezor One and Trezor Model T until 2036.","sourceText":"Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","derivedFrom":"split","context":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","spanStart":104,"spanEnd":394,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:16:49.131Z","updatedAt":"2026-10-14T02:26:42.920Z","evidence":[{"id":"01M4W3E4F8NCRSJQW93CFYXZKH","claimId":"01M4W35CZZTBY81CJA18B02T8S","url":"https://cryptorecoversllc.com/blog/trezor-scam","domain":"cryptorecoversllc.com","quotedSpan":"Security researchers at Kaspersky analysed a counterfeit Trezor Model T that looked genuine from the outside, holographic seals included, but was rebuilt inside to steal funds.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:35.325Z"},{"id":"01M4W3J7Z05GGNT4KZW75R1NN1","claimId":"01M4W35CZZTBY81CJA18B02T8S","url":"https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155","domain":"www.kaspersky.com","quotedSpan":"The Trezor Model T vendor has undertaken a wide range security measures that, in theory, should reliably protect the device from attackers.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:49.978Z"},{"id":"01M4W3P7E3GZTCFAQXMFDX2VDY","claimId":"01M4W35CZZTBY81CJA18B02T8S","url":"https://en.bitcoin.it/wiki/Trezor","domain":"en.bitcoin.it","quotedSpan":"More information is on the Trezor Model One product page.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:26:00.513Z"}],"history":[{"id":"01M4W35GF187BSPPZHJN4Z08EB","claimId":"01M4W35CZZTBY81CJA18B02T8S","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:16:52.366Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W35CZZTBY81CJA18B02T8T","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":28,"text":"Customers still buy the Trezor One and Trezor Model T from third-party sellers.","sourceText":"Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","derivedFrom":"split","context":"The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers.","spanStart":104,"spanEnd":394,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:16:49.131Z","updatedAt":"2026-10-14T02:26:45.682Z","evidence":[{"id":"01M4W3EX7PK1XQ3W6F7AJXYMKG","claimId":"01M4W35CZZTBY81CJA18B02T8T","url":"https://tech-insider.org/trezor-shipmonk-breach-67000-us-customers-2026","domain":"tech-insider.org","quotedSpan":"Trezor, one of the oldest names in cryptocurrency hardware wallets, has confirmed that a data breach at a third-party shipping partner is far bigger than first disclosed.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:22:00.651Z"},{"id":"01M4W3K05RD34JTNPM88P70T7C","claimId":"01M4W35CZZTBY81CJA18B02T8T","url":"https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155","domain":"www.kaspersky.com","quotedSpan":"Confirming the third-party intruder’s modification of the device described in the post, Trezor officials noted the following:","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:14.751Z"},{"id":"01M4W3PZ1FCMGF5KR0B9WEVKZ6","claimId":"01M4W35CZZTBY81CJA18B02T8T","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"Trezor's advice then was to buy only from its official shop or an authorized reseller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:26:24.675Z"}],"history":[{"id":"01M4W35HAX689MNFASFVRQAJDD","claimId":"01M4W35CZZTBY81CJA18B02T8T","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:16:53.258Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN6","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":29,"text":"In both wallets, the attackers had replaced the microcontroller on the devices so that instead of generating random recovery seed phrases, the controllers generated one of a dozen or so pre-determined seed phrases the attackers had coded into the controllers, allowing them to guess the recovery seeds for the crypto accounts.","sourceText":"In both wallets, the attackers had replaced the microcontroller on the devices so that instead of generating random recovery seed phrases, the controllers generated one of a dozen or so pre-determined seed phrases the attackers had coded into the controllers, allowing them to guess the recovery seeds for the crypto accounts.","derivedFrom":"span","context":"In both wallets, the attackers had replaced the microcontroller on the devices so that instead of generating random recovery seed phrases, the controllers generated one of a dozen or so pre-determined seed phrases the attackers had coded into the controllers, allowing them to guess the recovery seeds for the crypto accounts.","spanStart":0,"spanEnd":326,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"high","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:30.273Z","evidence":[{"id":"01M4W3ARTEYSQV35PRF3N0R4XE","claimId":"01M4W2Y215QRSS19VC1ZW44KN6","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"The devices had been opened, resealed, and fitted with replaced internal components, and the recovery phrases they generated were predictable or predefined.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:19:45.086Z"},{"id":"01M4W3KA14CCAQ4J0VJC2NN0YC","claimId":"01M4W2Y215QRSS19VC1ZW44KN6","url":"https://trezor.io/blog/insights/lessons-from-the-coldcard-incident","domain":"trezor.io","quotedSpan":"On affected devices, the recovery seed was created without using a hardware random number generator.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:24.865Z"}],"history":[{"id":"01M4W2YFXNWWW67ASPDVB3XRKN","claimId":"01M4W2Y215QRSS19VC1ZW44KN6","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:02.508Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN7","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":30,"text":"Grand says the legitimate microcontrollers used in the Trezor devices have code-protection features that are meant to prevent someone from accessing and changing the code.","sourceText":"Grand says the legitimate microcontrollers used in the Trezor devices have code-protection features that are meant to prevent someone from accessing and changing the code.","derivedFrom":"span","context":"Grand says the legitimate microcontrollers used in the Trezor devices have code-protection features that are meant to prevent someone from accessing and changing the code. But because the Trezor code is open source, it was easy for the attackers to obtain the code, modify it, and program it into a new, unsecured device by just replacing the legitimate chip with their own chip.","spanStart":0,"spanEnd":171,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:34.646Z","evidence":[{"id":"01M4W3M61TPGH73B6GRCZT7ZS5","claimId":"01M4W2Y215QRSS19VC1ZW44KN7","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"The company described the move as a preventive step, stating there is no evidence Trezor devices have been compromised.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:24:53.547Z"}],"history":[{"id":"01M4W2YGP34XBHPMZC5A7GJ9QE","claimId":"01M4W2Y215QRSS19VC1ZW44KN7","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:03.290Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN8","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":31,"text":"But because the Trezor code is open source, it was easy for the attackers to obtain the code, modify it, and program it into a new, unsecured device by just replacing the legitimate chip with their own chip.","sourceText":"But because the Trezor code is open source, it was easy for the attackers to obtain the code, modify it, and program it into a new, unsecured device by just replacing the legitimate chip with their own chip.","derivedFrom":"span","context":"Grand says the legitimate microcontrollers used in the Trezor devices have code-protection features that are meant to prevent someone from accessing and changing the code. But because the Trezor code is open source, it was easy for the attackers to obtain the code, modify it, and program it into a new, unsecured device by just replacing the legitimate chip with their own chip.","spanStart":172,"spanEnd":379,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:32.480Z","evidence":[],"history":[{"id":"01M4W2YHEEZ6ZQMSFNYYC73977","claimId":"01M4W2Y215QRSS19VC1ZW44KN8","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:04.071Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KN9","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":32,"text":"Grand says he wrote to Trezor about the Model T implant on August 10 this year and got a very cordial response three days later:","sourceText":"Grand says he wrote to Trezor about the Model T implant on August 10 this year and got a very cordial response three days later:","derivedFrom":"span","context":"Grand says he wrote to Trezor about the Model T implant on August 10 this year and got a very cordial response three days later:","spanStart":0,"spanEnd":128,"status":"unverified","notAutoChecked":"private_party","namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":false,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:17:42.410Z","evidence":[],"history":[{"id":"01M4W2YJ7M88289NNCFE2ZFEC1","claimId":"01M4W2Y215QRSS19VC1ZW44KN9","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:04.853Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KNA","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":33,"text":"Based on your description, the unit has very similar characteristics to the counterfeit or modified Model T devices that were discovered on Russian marketplaces in 2022–2023.","sourceText":"Based on your description, the unit has very similar characteristics to the counterfeit or modified Model T devices that were discovered on Russian marketplaces in 2022–2023.","derivedFrom":"span","context":"This is very interesting, and we appreciate the work you have put into investigating the device. Based on your description, the unit has very similar characteristics to the counterfeit or modified Model T devices that were discovered on Russian marketplaces in 2022–2023. The use of a replaced MCU and modified firmware, together with an external microSD card containing legitimate firmware for the integrity check, is a particularly interesting variation on those earlier devices. We would definitely be interested in examining the binary you extracted from the STM32F427.","spanStart":97,"spanEnd":271,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:33.008Z","evidence":[{"id":"01M4W3BFX7C64WBJ73GD4CS2C6","claimId":"01M4W2Y215QRSS19VC1ZW44KNA","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:20:08.736Z"}],"history":[{"id":"01M4W2YK0JS1DG6Y5GG5AF64W4","claimId":"01M4W2Y215QRSS19VC1ZW44KNA","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:05.660Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KNB","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":34,"text":"The use of a replaced MCU and modified firmware, together with an external microSD card containing legitimate firmware for the integrity check, is a particularly interesting variation on those earlier devices.","sourceText":"The use of a replaced MCU and modified firmware, together with an external microSD card containing legitimate firmware for the integrity check, is a particularly interesting variation on those earlier devices.","derivedFrom":"span","context":"Based on your description, the unit has very similar characteristics to the counterfeit or modified Model T devices that were discovered on Russian marketplaces in 2022–2023. The use of a replaced MCU and modified firmware, together with an external microSD card containing legitimate firmware for the integrity check, is a particularly interesting variation on those earlier devices. We would definitely be interested in examining the binary you extracted from the STM32F427. If you are able to share it with us, please send it over.","spanStart":175,"spanEnd":384,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":true,"demotedReason":"not_checkable","l3Attempted":false,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:17:51.979Z","evidence":[],"history":[{"id":"01M4W2YKSWTVX62H99EKP5P8Q7","claimId":"01M4W2Y215QRSS19VC1ZW44KNB","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:06.470Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KNC","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":35,"text":"Does Trezor Suite recognize or flag the device as counterfeit or otherwise indicate that something is wrong?","sourceText":"Does Trezor Suite recognize or flag the device as counterfeit or otherwise indicate that something is wrong?","derivedFrom":"span","context":"If you are able to share it with us, please send it over. We would also be very interested to know how the latest version of Trezor Suite behaves when this device is connected. Does Trezor Suite recognize or flag the device as counterfeit or otherwise indicate that something is wrong? Although we have discontinued sales of the Model T, we continue to improve the checks in Trezor Suite that are intended to identify counterfeit and modified devices. Any information you can provide about how the current version of Trezor Suite treats this particular unit would therefore be very helpful.","spanStart":177,"spanEnd":285,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":true,"demotedReason":"not_checkable","l3Attempted":false,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:17:56.683Z","evidence":[],"history":[{"id":"01M4W2YMJN6709N73JKNCJ5RTD","claimId":"01M4W2Y215QRSS19VC1ZW44KNC","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:07.266Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KND","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":36,"text":"Although we have discontinued sales of the Model T, we continue to improve the checks in Trezor Suite that are intended to identify counterfeit and modified devices.","sourceText":"Although we have discontinued sales of the Model T, we continue to improve the checks in Trezor Suite that are intended to identify counterfeit and modified devices.","derivedFrom":"span","context":"Does Trezor Suite recognize or flag the device as counterfeit or otherwise indicate that something is wrong? Although we have discontinued sales of the Model T, we continue to improve the checks in Trezor Suite that are intended to identify counterfeit and modified devices. Any information you can provide about how the current version of Trezor Suite treats this particular unit would therefore be very helpful. Thank you again for bringing this to our attention and for sharing the technical details of your investigation.","spanStart":109,"spanEnd":274,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:44.019Z","evidence":[{"id":"01M4W3EEEVYW2AW0V6SP2WGKGC","claimId":"01M4W2Y215QRSS19VC1ZW44KND","url":"https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430","domain":"www.gate.com","quotedSpan":"The company described the move as a preventive step, stating there is no evidence Trezor devices have been compromised.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:21:45.550Z"},{"id":"01M4W3JH8C57B5JATCSY5AGE6Q","claimId":"01M4W2Y215QRSS19VC1ZW44KND","url":"https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis","domain":"cointelegraph.com","quotedSpan":"Although confirmed losses have so far involved devices sold by CryptoBilis, Ledger said it is examining reports beyond the reseller.","spanVerified":true,"stance":"context","independent":false,"sourceKind":"retrieval","submitterType":"system","correctionId":null,"createdAt":"2026-10-14T02:23:59.502Z"}],"history":[{"id":"01M4W2YNB8JTYY2M43F0RE9HJE","claimId":"01M4W2Y215QRSS19VC1ZW44KND","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:08.062Z"}],"corrections":[],"editorial":[],"endorsements":[]},{"id":"01M4W2Y215QRSS19VC1ZW44KNE","receiptId":"01M4W2WRDRN4C8JMJJRHTGGQR7","ord":37,"text":"Notably, in his last communication from Trezor in early September, the company copied their pr manager on the email and told Grand, \"If you’re planning to publish something, we’d appreciate a heads-up so we can review it and, if appropriate, provide a public comment in advance as well.\"","sourceText":"Notably, in his last communication from Trezor in early September, the company copied their pr manager on the email and told Grand, \"If you’re planning to publish something, we’d appreciate a heads-up so we can review it and, if appropriate, provide a public comment in advance as well.\"","derivedFrom":"span","context":"Notably, in his last communication from Trezor in early September, the company copied their pr manager on the email and told Grand, \"If you’re planning to publish something, we’d appreciate a heads-up so we can review it and, if appropriate, provide a public comment in advance as well.\"","spanStart":0,"spanEnd":287,"status":"unverified","notAutoChecked":null,"namedPersonAllegation":false,"checkableBand":"medium","demoted":false,"demotedReason":null,"l3Attempted":true,"createdAt":"2026-10-14T02:12:48.436Z","updatedAt":"2026-10-14T02:26:46.775Z","evidence":[],"history":[{"id":"01M4W2YP3NHP31P6712HAD8RRN","claimId":"01M4W2Y215QRSS19VC1ZW44KNE","fromStatus":null,"toStatus":"unverified","reason":"initial","actorType":"system","createdAt":"2026-10-14T02:13:08.846Z"}],"corrections":[],"editorial":[],"endorsements":[]}],"now":1792129682104}