Trezor confirms hidden implants in wallets from reseller CryptoBilis
Trezor says wallets sold by CryptoBilis hid an implant that can copy recovery phrases. What happened, who should act and what Stackurity covers.
TL;DR: Trezor says three of its Trezor Safe 5 devices that came through the reseller CryptoBilis carried a hidden implant that can copy a wallet's recovery phrase. This is a hardware supply chain problem, and Stackurity does not cover it.
What happened
The Hacker News reports that Trezor has confirmed tampering in wallets bought through the reseller CryptoBilis. According to that report, the implant is an extra circuit board inside the device. It reads the recovery phrase off the screen and sends it over a mobile network to a server run by the attackers. Trezor examined one of the devices in its lab and checked the others.
A recovery phrase is the master secret of a wallet. Anyone who holds it can move the funds, whatever PIN the owner has set, which is why a device that leaks it is worse than one that simply fails.
What to take from it
The lesson is about where hardware comes from. A device bought from an unofficial reseller can be altered before it reaches you, and software checks on the host cannot see that. Organisations that hold crypto or any other hardware secrets should buy directly from the manufacturer or an authorised seller, and treat a recovery phrase created on a device of doubtful origin as exposed. If a wallet came from a third party reseller, move the funds to a new wallet from a trusted device and generate a fresh phrase.
Am I affected?
Only if you or your company bought a Trezor Safe 5 from CryptoBilis. Check the purchase record, then follow Trezor's own guidance for affected devices.
How to check with Stackurity
Stackurity does not cover this. It inventories software on servers, applications, repositories and images and matches it against vulnerability advisories and end-of-life dates, and it does not inspect hardware wallets or physical devices. What it can help with is the neighbouring risk of leaked secrets: it finds keys, tokens and passwords written in files. See the remediation documentation for how fixes are tracked.
Start a free trial of Stackurity to find secrets left in your servers and repositories.
Sources: The Hacker News.
