---
id: "01M4W2WRDRN4C8JMJJRHTGGQR7"
url: "https://factriot.app/r/01M4W2WRDRN4C8JMJJRHTGGQR7"
canonical_url: "https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants"
domain: "www.zetter-zeroday.com"
title: "Trezor Wallets Also Compromised with Implants"
state: ready
checked_at: "2026-10-14T02:15:42.736Z"
author_type: system
requested_by_type: agent
kind: page
subject: null
claim_count: 38
license: "ODbL-1.0"
alternates:
  html: "https://factriot.app/r/01M4W2WRDRN4C8JMJJRHTGGQR7"
  json: "https://factriot.app/r/01M4W2WRDRN4C8JMJJRHTGGQR7.json"
---

# Trezor Wallets Also Compromised with Implants

Source: https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants (www.zetter-zeroday.com)

## Claim 1 — Unverified

> I published a story this morning about implants that have been discovered in a number of Ledger crypto devices.

History:
- 2026-10-14T02:12:49.129Z unverified · initial · [system]

## Claim 2 — Unverified

> In initial had included in the story information about implants that were also discovered in devices made by Trezor – Ledger's main competitor.

- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — context — "The implants did not compromise the devices’ security chips or alter transactions, Ledger said."
- [www.bifu.co](https://www.bifu.co/news/detail/trezor-cuts-reseller-network-in-supply-chain-security-push) — context — "Trezor's letter to resellers being dropped made no mention of Ledger."

History:
- 2026-10-14T02:12:49.928Z unverified · initial · [system]

## Claim 3 — Unverified

> I removed this, however, before publishing the story because I didn't want to confuse matters.

History:
- 2026-10-14T02:12:50.723Z unverified · initial · [system]

## Claim 4 — Corroborated

> But a few hours ago Trezor announced on X that it would be reducing the number of merchants authorized to sell its devices out of an "abundance of caution."

- [www.bifu.co](https://www.bifu.co/news/detail/trezor-cuts-reseller-network-in-supply-chain-security-push) — supports — "Trezor, a major crypto hardware wallet provider, is shrinking the list of retailers authorized to sell its devices."
- [cryptorank.io](https://cryptorank.io/news/feed/eeaea-trezor-supply-chain-action-wallet-tampering) — supports — "After a Ledger reseller sold hardware wallets reportedly modified to steal recovery phrases, with suspected losses exceeding $93 million, Trezor is reducing its authorized reseller network and tightening supply-chain checks. … Trezor, a major crypto hardware wallet maker, is cutting the number of shops allowed to sell its devices."
- [trezor.io](https://trezor.io/blog/insights/lessons-from-the-coldcard-incident) — context — "First things first: Trezor devices are not affected."

History:
- 2026-10-14T02:12:51.528Z unverified · initial · [system]
- 2026-10-14T02:26:51.184Z unverified → corroborated · l3_supports · [system]

## Claim 5 — Not auto-checked

> Chief Commercial Officer Danny Sanders wrote that there was "not a single piece of evidence that Trezor devices have been compromised," and that this was reducing its list of authorized sellers simply as a "preventive step" to have better control over its supply chain.

Not auto-checked: this sentence names a private individual or small business, so no automated status is given. Evidence only.

History:
- 2026-10-14T02:12:52.331Z unverified · initial · [system]

## Claim 6 — Not auto-checked

> Famed hardware hacker Joe Grand found implants in two Trezor wallets recently.

Not auto-checked: this sentence names a private individual or small business, so no automated status is given. Evidence only.

History:
- 2026-10-14T02:12:53.119Z unverified · initial · [system]

## Claim 7 — Not auto-checked

> Famed hardware hacker Joe Grand notified the company about the implants in August.

Not auto-checked: this sentence names a private individual or small business, so no automated status is given. Evidence only.

History:
- 2026-10-14T02:13:51.760Z unverified · initial · [system]

## Claim 8 — Unverified

> I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents.

History:
- 2026-10-14T02:12:53.902Z unverified · initial · [system]

## Claim 9 — Corroborated

> The Ledger implants became news.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — supports — "Ledger Confirms LTE-Enabled Spy Implants in CryptoBilis Wallets"
- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — supports — "Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis"

History:
- 2026-10-14T02:12:54.674Z unverified · initial · [system]
- 2026-10-14T02:26:55.513Z unverified → corroborated · l3_supports · [system]

## Claim 10 — Corroborated

> The Ledger implants were sold in devices distributed by authorized resellers of Ledger devices.

- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — supports — "The incident surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines."
- [www.coindesk.com](https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen) — supports — "Ledger said every confirmed case involves devices sold by the Southeast Asian reseller, but critics say the hardware-wallet maker must answer for an authorized sales channel."

History:
- 2026-10-14T02:13:52.584Z unverified · initial · [system]
- 2026-10-14T02:26:57.621Z unverified → corroborated · l3_supports · [system]

## Claim 11 — Unverified

> The Ledger implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "Ledger's Donjon security team says the implant captures 24-word recovery phrases from wallet screens and transmits them over LTE networks, while onchain investigator Specter traced more than $86 million in suspected thefts linked to the compromised devices."

History:
- 2026-10-14T02:13:53.358Z unverified · initial · [system]

## Claim 12 — Unverified

> The Ledger implants became news because the implants were sold in devices distributed by authorized resellers of Ledger devices and were subsequently used to steal $100 million in crypto from the owners of compromised devices.

- [cryptorank.io](https://cryptorank.io/news/feed/eeaea-trezor-supply-chain-action-wallet-tampering) — context — "After a Ledger reseller sold hardware wallets reportedly modified to steal recovery phrases, with suspected losses exceeding $93 million, Trezor is reducing its authorized reseller network and tightening supply-chain checks. Trezor says there is no evidence its devices were compromised; affected resellers can sell existing stock through the holiday season before losing authorization on January 1, 2027."

History:
- 2026-10-14T02:13:54.136Z unverified · initial · [system]

## Claim 13 — Unverified

> But as I noted in the Ledger story, Grand had initially found implants in four Ledger devices that were sold online by unauthorized Ledger merchants.

- [www.cryptobreaking.com](https://www.cryptobreaking.com/ledger-traces-lte-spy-implants) — context — "Ledger says it has identified the method behind malicious implants found in some hardware wallets sold through reseller CryptoBilis. … Earlier coverage from Cointelegraph noted that losses were associated with Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia, and the Philippines."
- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "Ledger's Donjon security team says wallets sold by CryptoBilis contained an unauthorized component that reads the screen and decodes the recovery phrase when it appears."
- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — context — "Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis"

History:
- 2026-10-14T02:12:55.451Z unverified · initial · [system]

## Claim 14 — Unverified

> These merchants appeared to be fly-by-night sellers who popped up in online marketplaces only to disappear after days or weeks.

History:
- 2026-10-14T02:12:56.224Z unverified · initial · [system]

## Claim 15 — Unverified

> So the provenance of the compromised devices was already sketchy, as opposed to the later implants that were sold by reputable and authorized sellers.

- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — context — "The incident surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines."
- [www.coindesk.com](https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen) — context — "Ledger said every confirmed case involves devices sold by the Southeast Asian reseller, but critics say the hardware-wallet maker must answer for an authorized sales channel."

History:
- 2026-10-14T02:12:57.013Z unverified · initial · [system]

## Claim 16 — Unverified

> The implants Grand found in Trezor One and Trezor Model T devices were also sold by third-party nonauthorized sellers – not by reputable authorized sellers.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not an authorized reseller."
- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — context — "Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected."
- [www.cryptobreaking.com](https://www.cryptobreaking.com/ledger-traces-lte-spy-implants) — context — "Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected."

History:
- 2026-10-14T02:12:57.796Z unverified · initial · [system]

## Claim 17 — Unverified

> No real surprise there, since both Ledger and Trezor have warned customers for years to purchase directly from their own web sites or from authorized merchants.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "Ledger and Trezor have each warned buyers against unauthorized sellers."

History:
- 2026-10-14T02:12:58.574Z unverified · initial · [system]

## Claim 18 — Unverified

> Especially because three years ago, researchers at Kaspersky Lab had also found an implant in a Trezor wallet sold on a popular Russian marketplace.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not an authorized reseller."
- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — context — "Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected."

History:
- 2026-10-14T02:12:59.347Z unverified · initial · [system]

## Claim 19 — Not auto-checked

> Grand found an implant in a Trezor Model T wallet.

Not auto-checked: this sentence names a private individual or small business, so no automated status is given. Evidence only.

History:
- 2026-10-14T02:13:00.135Z unverified · initial · [system]

## Claim 20 — Unverified

> Someone had purchased the Trezor Model T wallet via Facebook Marketplace in Canada some time in 2025.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller."

History:
- 2026-10-14T02:13:54.912Z unverified · initial · [system]

## Claim 21 — Unverified

> Grand found another implant in a Trezor One device.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "Trezor Ends Reseller Network After Ledger Finds Spy Implant in Crypto Wallets"

History:
- 2026-10-14T02:13:55.677Z unverified · initial · [system]

## Claim 22 — Unverified

> Someone had obtained the Trezor One device from a TikTok shop in August.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "Trezor's advice then was to buy only from its official shop or an authorized reseller."
- [gigazine.net](https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet) — context — "Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''"

History:
- 2026-10-14T02:13:56.453Z unverified · initial · [system]

## Claim 23 — Unverified

> The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "Trezor Ends Reseller Network After Ledger Finds Spy Implant in Crypto Wallets"
- [github.com](https://github.com/trezor/trezor-firmware/issues/965) — context — "WebUSB transport is disabled: libusb-1.0.so: cannot open shared object file: No such file or directory Features (159 bytes) { bootloader_hash: 32 bytes 0xf7fa165be6d780f3e1af00abc07df8b3076bcdad72d70da22a63d8896b6391d8, capabilities: [ Bitcoin (1), Bitcoin_like (2), Crypto (5), Ethereum (7), Lisk (8), NEM (10), Stellar (12), U2F (14), ], device_id: '9FD6BFDEACA691184AEFA0F1', imported: True, initialized: True, language: 'english', major_version: 1, minor_version: 8, model: '1', needs_backup: False, no_backup: False, passphrase_cached: False, passphrase_protection: False, patch_version: 3, pin_cached: False, pin_protection: False, revision: 20 bytes 0xdf0963ec48f01f3d07ffca556e21ff0070cab099, unfinished_backup: False, vendor: 'trezor.io', }"
- [www.bifu.co](https://www.bifu.co/news/detail/trezor-cuts-reseller-network-in-supply-chain-security-push) — context — "Trezor, a major crypto hardware wallet provider, is shrinking the list of retailers authorized to sell its devices."

History:
- 2026-10-14T02:13:00.922Z unverified · initial · [system]

## Claim 24 — Unverified

> The Trezor One is a discontinued device.

- [gigazine.net](https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet) — context — "Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''"

History:
- 2026-10-14T02:13:01.716Z unverified · initial · [system]

## Claim 25 — Unverified

> The Trezor Model T is a discontinued device.

- [gigazine.net](https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet) — context — "Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''"
- [github.com](https://github.com/trezor/trezor-firmware/issues/965) — context — "WebUSB transport is disabled: libusb-1.0.so: cannot open shared object file: No such file or directory Features (159 bytes) { bootloader_hash: 32 bytes 0xf7fa165be6d780f3e1af00abc07df8b3076bcdad72d70da22a63d8896b6391d8, capabilities: [ Bitcoin (1), Bitcoin_like (2), Crypto (5), Ethereum (7), Lisk (8), NEM (10), Stellar (12), U2F (14), ], device_id: '9FD6BFDEACA691184AEFA0F1', imported: True, initialized: True, language: 'english', major_version: 1, minor_version: 8, model: '1', needs_backup: False, no_backup: False, passphrase_cached: False, passphrase_protection: False, patch_version: 3, pin_cached: False, pin_protection: False, revision: 20 bytes 0xdf0963ec48f01f3d07ffca556e21ff0070cab099, unfinished_backup: False, vendor: 'trezor.io', }"

History:
- 2026-10-14T02:16:49.706Z unverified · initial · [system]

## Claim 26 — Unverified

> Trezor still supports the Trezor One and Trezor Model T.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller."
- [gigazine.net](https://gigazine.net/gsc_news/en/20230516-fake-trezor-cryptowallet) — context — "Kaspersky points out that ``Trezor Model T theoretically has a mechanism to reliably protect the device from attackers.''"
- [github.com](https://github.com/trezor/trezor-firmware/issues/965) — context — "WebUSB transport is disabled: libusb-1.0.so: cannot open shared object file: No such file or directory Features (159 bytes) { bootloader_hash: 32 bytes 0xf7fa165be6d780f3e1af00abc07df8b3076bcdad72d70da22a63d8896b6391d8, capabilities: [ Bitcoin (1), Bitcoin_like (2), Crypto (5), Ethereum (7), Lisk (8), NEM (10), Stellar (12), U2F (14), ], device_id: '9FD6BFDEACA691184AEFA0F1', imported: True, initialized: True, language: 'english', major_version: 1, minor_version: 8, model: '1', needs_backup: False, no_backup: False, passphrase_cached: False, passphrase_protection: False, patch_version: 3, pin_cached: False, pin_protection: False, revision: 20 bytes 0xdf0963ec48f01f3d07ffca556e21ff0070cab099, unfinished_backup: False, vendor: 'trezor.io', }"

History:
- 2026-10-14T02:16:50.597Z unverified · initial · [system]

## Claim 27 — Unverified

> As noted in the product photo at top, Trezor will continue to distribute software updates for the Trezor One and Trezor Model T until 2031.

- [en.bitcoin.it](https://en.bitcoin.it/wiki/Trezor) — context — "More information is on the Trezor Model One product page."
- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller."

History:
- 2026-10-14T02:16:51.478Z unverified · initial · [system]

## Claim 28 — Unverified

> As noted in the product photo at top, Trezor will continue to distribute security updates for the Trezor One and Trezor Model T until 2036.

- [cryptorecoversllc.com](https://cryptorecoversllc.com/blog/trezor-scam) — context — "Security researchers at Kaspersky analysed a counterfeit Trezor Model T that looked genuine from the outside, holographic seals included, but was rebuilt inside to steal funds."
- [www.kaspersky.com](https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155) — context — "The Trezor Model T vendor has undertaken a wide range security measures that, in theory, should reliably protect the device from attackers."
- [en.bitcoin.it](https://en.bitcoin.it/wiki/Trezor) — context — "More information is on the Trezor Model One product page."

History:
- 2026-10-14T02:16:52.366Z unverified · initial · [system]

## Claim 29 — Unverified

> Customers still buy the Trezor One and Trezor Model T from third-party sellers.

- [tech-insider.org](https://tech-insider.org/trezor-shipmonk-breach-67000-us-customers-2026) — context — "Trezor, one of the oldest names in cryptocurrency hardware wallets, has confirmed that a data breach at a third-party shipping partner is far bigger than first disclosed."
- [www.kaspersky.com](https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155) — context — "Confirming the third-party intruder’s modification of the device described in the post, Trezor officials noted the following:"
- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "Trezor's advice then was to buy only from its official shop or an authorized reseller."

History:
- 2026-10-14T02:16:53.258Z unverified · initial · [system]

## Claim 30 — Unverified

> In both wallets, the attackers had replaced the microcontroller on the devices so that instead of generating random recovery seed phrases, the controllers generated one of a dozen or so pre-determined seed phrases the attackers had coded into the controllers, allowing them to guess the recovery seeds for the crypto accounts.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "The devices had been opened, resealed, and fitted with replaced internal components, and the recovery phrases they generated were predictable or predefined."
- [trezor.io](https://trezor.io/blog/insights/lessons-from-the-coldcard-incident) — context — "On affected devices, the recovery seed was created without using a hardware random number generator."

History:
- 2026-10-14T02:13:02.508Z unverified · initial · [system]

## Claim 31 — Unverified

> Grand says the legitimate microcontrollers used in the Trezor devices have code-protection features that are meant to prevent someone from accessing and changing the code.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "The company described the move as a preventive step, stating there is no evidence Trezor devices have been compromised."

History:
- 2026-10-14T02:13:03.290Z unverified · initial · [system]

## Claim 32 — Unverified

> But because the Trezor code is open source, it was easy for the attackers to obtain the code, modify it, and program it into a new, unsecured device by just replacing the legitimate chip with their own chip.

History:
- 2026-10-14T02:13:04.071Z unverified · initial · [system]

## Claim 33 — Not auto-checked

> Grand says he wrote to Trezor about the Model T implant on August 10 this year and got a very cordial response three days later:

Not auto-checked: this sentence names a private individual or small business, so no automated status is given. Evidence only.

History:
- 2026-10-14T02:13:04.853Z unverified · initial · [system]

## Claim 34 — Unverified

> Based on your description, the unit has very similar characteristics to the counterfeit or modified Model T devices that were discovered on Russian marketplaces in 2022–2023.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller."

History:
- 2026-10-14T02:13:05.660Z unverified · initial · [system]

## Claim 35 — Unverified

> The use of a replaced MCU and modified firmware, together with an external microSD card containing legitimate firmware for the integrity check, is a particularly interesting variation on those earlier devices.

History:
- 2026-10-14T02:13:06.470Z unverified · initial · [system]

## Claim 36 — Unverified

> Does Trezor Suite recognize or flag the device as counterfeit or otherwise indicate that something is wrong?

History:
- 2026-10-14T02:13:07.266Z unverified · initial · [system]

## Claim 37 — Unverified

> Although we have discontinued sales of the Model T, we continue to improve the checks in Trezor Suite that are intended to identify counterfeit and modified devices.

- [www.gate.com](https://www.gate.com/news/detail/trezor-ends-reseller-network-after-ledger-finds-spy-implant-in-crypto-24933430) — context — "The company described the move as a preventive step, stating there is no evidence Trezor devices have been compromised."
- [cointelegraph.com](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) — context — "Although confirmed losses have so far involved devices sold by CryptoBilis, Ledger said it is examining reports beyond the reseller."

History:
- 2026-10-14T02:13:08.062Z unverified · initial · [system]

## Claim 38 — Unverified

> Notably, in his last communication from Trezor in early September, the company copied their pr manager on the email and told Grand, "If you’re planning to publish something, we’d appreciate a heads-up so we can review it and, if appropriate, provide a public comment in advance as well."

History:
- 2026-10-14T02:13:08.846Z unverified · initial · [system]