Trezor confirmed that 3 units of Safe 5 were compromised by hardware implants, and the dealer network was reduced by about 80%

According to Trezor's monitoring, Trezor confirmed on November 12 that three Safe 5 devices had hardware implants, which were sold by the Malaysian distributor CryptoBilis between August 20 and September 23. The implant is a circuit board sandwiched between the screen and the motherboard, which only copies the screen content (including the mnemonic phrase) and sends it encrypted to the attacker's server via mobile network. Since the implant does not alter the firmware and security components, it is difficult to detect through regular checks.

The firmware version 2.13.1 released on November 11 has rendered these implants ineffective, but it cannot protect backups made before the upgrade; users who purchased devices through this channel still need to migrate to wallets using new mnemonic phrases. Trezor will reduce its distributor network by about 80% and stated that this move is not due to the partners' breach of trust. Users who purchased devices through this channel since March can apply for replacements. As of now, no customers have reported losses. The same distributor is also involved in the Ledger device tampering case, which resulted in over $86 million in theft.