Hardware Implants found in Trezor safe 5

[Wind_FURY]

According to Prabu, that agreement expired on October 19. Details regarding thefts from Ledger wallets surfaced on October 9—about ten days prior to that. To me, that timing is significant. So, it's very much possible that everything was planned in advance by the new Chinese owner. 

I've read that, still such a weird timing. I wonder what would happen if the CEO or anyone bound by the NDA actually speak up about it before though. Assuming the new owner is the scammer, will they go forward or will they sue and get the money from the previous owner instead? On the other hand it sounds like an easy excuse to be free from responsibility when someone found out that some of your products were tampered with. Not like we can be sure when the first tampering actually happened.

I believe the NDA would end in November or was it during October when it ended. BUT because of the current situation, the former owners from Malaysia have already started cooperating with the Malaysian government, no?

Anyone have any new information about the Trezor Safe 5 with the implant? I'm afraid that the attackers may have released thousands if these implanted Trezors around the world.

[OmegaStarScream]

-snip-
Anyone have any new information about the Trezor Safe 5 with the implant? I'm afraid that the attackers may have released thousands if these implanted Trezors around the world.

Trezor just released an article about their investigation: https://x.com/Trezor/status/2120880182173073421

And apparently, the latest firmware they released should protect the device from the implants (at least the ones they found and analyzed):

Our latest firmware update 2.13.1, released on November 11th, includes a protection that stops the implants we’ve found from capturing anything on devices that run it, making the current batch of implants useless
-snip-

Although I'm not sure which one of the mentioned changes is supposed to be the fix here?

https://github.com/trezor/trezor-firmware/blob/main/core/CHANGELOG.T3T1.md

[greysonz]

Trezor just released an article about their investigation: https://x.com/Trezor/status/2120880182173073421

Now Trazer cuts 80% of resellers after spy chip incident:

We have also cut our reseller network by about 80%, and every remaining reseller will have to follow much stricter rules.

Resellers will also be subject to strict controls. Ultimately, only three devices with chips were found, including the one found in October. No injuries were identified. Anyone who purchased from CryptoBilis since March 2026 can receive a replacement device.

[Pmalek]

Trezor just released an article about their investigation: https://x.com/Trezor/status/2120880182173073421

And apparently, the latest firmware they released should protect the device from the implants (at least the ones they found and analyzed):

Those implants are very similar to the ones we saw in Ledger devices. If I remember correctly, the people from Ledger said that this attack vector isn't something that can easily be fixed. Trezor, on the other hand, claims they already fixed it within a few weeks. Ledger is incompetent in many areas but I have always thought that their Ledger Donjon security team is very good. I wonder what they will say in the future and how/if they will be able to fix the problem with Ledger implants.

I guess scammers are only getting started with Trezor. Only a few Safe 5 models were discovered with installed implants. Many more could appear in the near future.

[dkbit98]

Trezor just released an article about their investigation: https://x.com/Trezor/status/2120880182173073421

And apparently, the latest firmware they released should protect the device from the implants (at least the ones they found and analyzed)

Until the next scam implant gets injected  
I am seriously getting pissed on this resellers selling crap like this, and I think we need to see major changes in selling all hardware wallets.
I can't even imagine what scammers will be able to do next with faster AI tools and future quantum computers, but it's not going to be pretty.
And if we think that Chinese only use woman and sex for spying, we are wrong about that...

[BitMaxz]

Until the next scam implant was injected  
I am seriously getting pissed on this resellers selling crap like this, and I think we need to see major changes in selling all hardware wallets.
I can't even imagine what scammers will be able to do next with faster AI tools and future quantum computers, but it's not going to be pretty.
And if we think that Chinese only use woman and sex for spying, we are wrong about that...

I believe these resellers and authorized 3rd party distributors are going to improve too, where the implanted chips, SIM card, and signal terminals can't able to see easily with our own eyes. They might implant a component, a very small IC that includes all things needed to make it work, just like the iSim that was developed years ago, but I believe it already exists in a few hardware wallets. We aren't just able to see it with our eyes because it looks like just a chip controller.

That's why I don't trust buying a hardware wallet from someone else; it's always safer to directly buy them from the manufacturer.

[RGBTC]

Now Trazer cuts 80% of resellers after spy chip incident:

Does the list of resellers shown as of today reflect the 80% reduction? I checked several months ago, and although I don’t know the exact number on the list, it didn’t seem like there had been any reduction.

https://trezor.io/id/resellers

[Coiner.de]

Although I'm not sure which one of the mentioned changes is supposed to be the fix here?

https://github.com/trezor/trezor-firmware/blob/main/core/CHANGELOG.T3T1.md

If that is the fix it isn't mentioned:

Code:

fix(core): issue RASET before CASET in set_window
- Swap the CASET/RASET order in display_panel_set_window(); the panel
  doesn't care, but it breaks bus sniffers syncing on 2A/2B/2C.

[no changelog]

Nice hack.

[ABCbits]

Now Trazer cuts 80% of resellers after spy chip incident:

Does the list of resellers shown as of today reflect the 80% reduction? I checked several months ago, and although I don’t know the exact number on the list, it didn’t seem like there had been any reduction.

https://trezor.io/id/resellers

Hard to say. I tried looking at web archive (such as https://web.archive.org/web/20260129014057/https://trezor.io/resellers), but the reseller/country list wasn't archived properly to make comparison with today's list. Although few country (such as Malaysia) no longer shown on list of countries with resellers.