Trezor cut its reseller network by 80% after discovering more spy implants in devices sold by the Malaysian vendor CryptoBilis. The company implemented stricter rules for vendors to protect its supply chain, focusing on how devices are sourced, stored, and who has access to them. Only 20% of vendors could abide by these new requirements. Trezor stressed that the dropped resellers were trustworthy and posed no immediate threat.
Technical Fixes And Affected Devices
Trezor released an update on November 11 that stops the implants from recording data and renders them useless. A spokesperson explained that the implant listens to communication between the MCU and the display and triggers capture when it sees a specific sequence. To stop this trigger, which is the wallet’s seed phrase, Trezor changed the order of commands sent to the display without any effect on the displayed screen. Three Trezor Safe 5 models have been found implanted with the spyware, purchased between August 20 and September 23. No crypto was stolen from the affected devices, and Trezor offered free replacements to those who bought wallets from CryptoBilis.
The update cannot protect a wallet backup that was captured before it, so Trezor warned CryptoBilis customers to move their funds to a new wallet immediately. This limitation means users must verify their backups were secure before relying on the software fix alone. The incident follows a separate attack where Ledger wallet users suffered an $86 million theft last month, also involving tampered wallets sold by CryptoBilis. Tether froze $10 million in stolen funds, and Ledger asked multiple wallet vendors across Asia to halt sales. Ledger’s investigation uncovered an organized crime group spending millions to build spyware infrastructure that involved logistics, seed collector servers, and draining or laundering infrastructure. It took several weeks before Trezor revealed it had discovered an implant in one of its devices. I view the rapid reduction of the reseller network as the most effective step here because it removes the vector entirely rather than just patching the symptom. The fact that only 20% of vendors met the new standards shows how difficult it is to maintain strict control over third-party distribution channels in the crypto hardware space.
