Trezor Denies Compromise as Hacker Reveals Implants in Discontinued Wallets

Key points

• Trezor denies any device compromise but is reducing authorized resellers as a preventive measure.
• Hardware hacker Joe Grand found implants in two discontinued Trezor models (One and Model T) sold by unauthorized sellers.
• The Trezor implants use modified firmware to generate fake seed phrases, unlike Ledger's passive screen-reading implants.
• Ledger confirmed a supply chain attack via reseller CryptoBilis, resulting in over $86M-$102M in thefts.
• Trezor had been notified by Grand in August 2026 but publicly denied knowledge of compromised devices in October.

Background

This story follows the recent Ledger breach, where unauthorized hardware implants in devices sold by reseller CryptoBilis led to the theft of approximately $100 million in cryptocurrency. Ledger confirmed the implants captured seed phrases and transmitted them via LTE, prompting the company to pause sales through affected resellers and advise users to move assets to new devices. The current Trezor controversy mirrors these supply chain concerns but involves different technical methods and unauthorized third-party sellers.

How outlets are covering it

The Verge and CoinDesk focus on the Ledger breach, citing $86M-$93.2M in losses and detailing the cellular implant mechanism used by CryptoBilis. Zero Day highlights the Trezor angle, noting that while Ledger's implants passively read screens, Trezor's implants use modified firmware to generate fake seeds. Zero Day emphasizes that Trezor's denial of compromise contradicts Joe Grand's August report, whereas other outlets focus on Ledger's confirmed losses and reseller suspensions.

Why it matters

The discovery of implants in Trezor devices, even if from unauthorized sellers, suggests that hardware wallet supply chain attacks may be broader than initially thought. It raises concerns about the security of discontinued devices and the potential for such attacks to spread to authorized resellers, impacting the trust in hardware wallet ecosystems.

What to watch

Trezor is expected to continue investigating the implants found by Joe Grand and may further restrict its reseller network. Ledger will continue its investigation into the CryptoBilis breach and review its reseller controls. Users are advised to purchase hardware wallets directly from manufacturers or authorized resellers and to verify device integrity.