Trezor says it has removed 80% of its reseller network after tightening supply-chain controls in response to spyware implants discovered in devices sold by Malaysian vendor CryptoBilis. According to the company, only 20% of vendors met new requirements covering sourcing, storage, and access.
The hardware wallet maker said the affected resellers were considered trustworthy and did not present an immediate threat. The changes follow the discovery of additional implanted devices and a software update that Trezor says now neutralizes the spyware’s method of operation.
More devices found with implants
Trezor’s latest account of the incident says three Trezor Safe 5 wallets were found with spy implants. The devices had been purchased between August 20 and September 23 through CryptoBilis, a reseller based in Malaysia.
The company said no cryptocurrency was stolen from the affected wallets. Trezor also offered free replacement devices to customers who bought their wallets from CryptoBilis.
How the implant worked
The implant was designed to monitor communication between the wallet’s microcontroller unit and its display. Trezor said it would begin capturing data only after detecting a particular sequence tied to the display of the wallet’s seed phrase.
To block that trigger, Trezor changed the order of commands sent to the display while leaving the visible output unchanged. The company said this adjustment prevents the implant from recognizing the sequence it relied on, making the device ineffective.
November 11 update and supply-chain response
Trezor said it released an update on November 11 that renders the implants useless by stopping them from recording data through the earlier trigger mechanism. The software change was paired with a broader review of how devices move through its sales network.
As part of that response, the company introduced stricter reseller rules focused on sourcing, storage, and access controls. Trezor said only one in five vendors could satisfy those standards, leading to an 80% reduction in its reseller network.
What happens next for affected customers
For customers who purchased through CryptoBilis, Trezor’s immediate remedy is device replacement. The company’s statements also indicate that while no funds were reported stolen from the identified wallets, the incident prompted both technical and distribution changes aimed at reducing the chance of similar tampering in the future.
The next confirmed step so far is the enforcement of the new reseller standards alongside the November 11 update. Trezor has presented those measures as its current response to the discovered implants and the supply-chain weaknesses exposed by the case.
Source: protos.com