Hardware Implants found in Trezor safe 5

[Wind_FURY]

According to Prabu, that agreement expired on October 19. Details regarding thefts from Ledger wallets surfaced on October 9—about ten days prior to that. To me, that timing is significant. So, it's very much possible that everything was planned in advance by the new Chinese owner. 

I've read that, still such a weird timing. I wonder what would happen if the CEO or anyone bound by the NDA actually speak up about it before though. Assuming the new owner is the scammer, will they go forward or will they sue and get the money from the previous owner instead? On the other hand it sounds like an easy excuse to be free from responsibility when someone found out that some of your products were tampered with. Not like we can be sure when the first tampering actually happened.

I believe the NDA would end in November or was it during October when it ended. BUT because of the current situation, the former owners from Malaysia have already started cooperating with the Malaysian government, no?

Anyone have any new information about the Trezor Safe 5 with the implant? I'm afraid that the attackers may have released thousands if these implanted Trezors around the world.

[OmegaStarScream]

-snip-
Anyone have any new information about the Trezor Safe 5 with the implant? I'm afraid that the attackers may have released thousands if these implanted Trezors around the world.

Trezor just released an article about their investigation: https://x.com/Trezor/status/2120880182173073421

And apparently, the latest firmware they released should protect the device from the implants (at least the ones they found and analyzed):

Our latest firmware update 2.13.1, released on November 11th, includes a protection that stops the implants we’ve found from capturing anything on devices that run it, making the current batch of implants useless
-snip-

Although I'm not sure which one of the mentioned changes is supposed to be the fix here?

https://github.com/trezor/trezor-firmware/blob/main/core/CHANGELOG.T3T1.md

[greysonz]

Trezor just released an article about their investigation: https://x.com/Trezor/status/2120880182173073421

Now Trazer cuts 80% of resellers after spy chip incident:

We have also cut our reseller network by about 80%, and every remaining reseller will have to follow much stricter rules.

Resellers will also be subject to strict controls. Ultimately, only three devices with chips were found, including the one found in October. No injuries were identified. Anyone who purchased from CryptoBilis since March 2026 can receive a replacement device.

[Pmalek]

Trezor just released an article about their investigation: https://x.com/Trezor/status/2120880182173073421

And apparently, the latest firmware they released should protect the device from the implants (at least the ones they found and analyzed):

Those implants are very similar to the ones we saw in Ledger devices. If I remember correctly, the people from Ledger said that this attack vector isn't something that can easily be fixed. Trezor, on the other hand, claims they already fixed it within a few weeks. Ledger is incompetent in many areas but I have always thought that their Ledger Donjon security team is very good. I wonder what they will say in the future and how/if they will be able to fix the problem with Ledger implants.

I guess scammers are only getting started with Trezor. Only a few Safe 5 models were discovered with installed implants. Many more could appear in the near future.