Trezor Wallet Found With Secret Spy Chip Inside

A customer found a hidden spy chip inside a new Trezor hardware wallet, designed to steal crypto recovery phrases over the air.

Hardware wallet maker Trezor has issued a critical security warning after a customer reported finding a physical implant inside a brand-new device. According to The Hacker News, a user who purchased a Trezor Safe 5 wallet from a third-party reseller called CryptoBilis discovered an unauthorized circuit board had been added to the device. This malicious hardware is suspected of being able to capture the wallet’s secret recovery phrase and transmit it over a mobile network. While Trezor has not yet physically inspected the compromised device, the company is taking the threat seriously. It has publicly advised anyone who purchased a Trezor wallet from CryptoBilis since March 2024 to immediately cease using the device and transfer their assets to a new, secure wallet.

This incident represents a sophisticated supply chain attack, a type of threat where a product is tampered with between the factory and the end user. Unlike a software virus or a phishing scam, this attack involves physically altering the hardware itself. The extra circuit board acts as a spy, silently waiting for the user to generate their recovery phrase during the initial setup. Once the phrase is created, the implant captures it and uses its own mobile connectivity to send it to the attacker. This method is particularly dangerous because it bypasses all of the software and firmware protections built into the Trezor wallet. The device could appear to function normally, giving the user no indication that their most critical secret has already been stolen. The attacker can then wait for the user to deposit funds before draining the wallet at their leisure.

While hardware tampering has long been a theoretical concern in the security community, confirmed real-world examples targeting consumer products are rare and highly significant. The entire purpose of a hardware wallet is to provide “cold storage,” keeping a user’s private keys completely offline and isolated from internet-connected computers that could be infected with malware. A physical implant that can exfiltrate data over a cellular network completely shatters this security model. This attack vector is far more difficult for an average user to detect than a software vulnerability. It requires either a keen eye for physical inconsistencies or a complete teardown of the device, something most owners would never do. The incident severely damages trust not just in the specific reseller, but in the entire third-party distribution channel for sensitive security hardware.

For businesses, developers, and security teams, this event is a stark reminder that security is a multi-layered problem that includes physical procurement. The immediate action for those directly affected is clear: migrate all assets immediately. For everyone else, the key takeaway is to scrutinize hardware purchasing policies. Whenever possible, high-security devices like hardware wallets, security keys, or network appliances should be purchased directly from the manufacturer. Buying from official sources minimizes the number of hands the device passes through, reducing the opportunity for malicious interception and tampering. Teams should also implement procedures for inspecting new hardware upon arrival, checking for signs of tampering like broken holographic seals, unusual weight or rattling, or discrepancies in the packaging. This incident proves that even the most robust digital defenses can be rendered useless if the physical integrity of the hardware itself cannot be trusted.

This is a rare, real-world example of a hardware supply chain attack on a consumer device. It proves that physical tampering can completely bypass sophisticated software security, undermining the core trust model of "cold storage" for high-value digital assets.

This incident creates a significant trust and liability issue for hardware manufacturers and their reseller networks. Businesses using hardware wallets for treasury management must now re-evaluate their procurement policies, potentially restricting purchases to direct-from-manufacturer channels to mitigate this physical threat.