Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases

Trezor says three Trezor Safe 5 wallets bought from former reseller CryptoBilis contain a hidden implant — an extra circuit board between the main board and screen that copies the recovery phrase and any passphrase when they are shown or entered, encrypts the data, and sends it over the mobile network to a server controlled by the attackers. Firmware 2.13.1 blocks the implants found so far but cannot protect a backup already captured; Trezor urges anyone who bought from CryptoBilis since March to move funds to a new wallet with a new recovery phrase and offers affected buyers a replacement device.