{ "version": 1, "event_id": "evt_ef55a9b094f31e63", "url": "https://xiyu.news/events/evt_ef55a9b094f31e63/", "json": "https://xiyu.news/api/events/evt_ef55a9b094f31e63.json", "type": "security_incident", "status": "developing", "category": "crypto", "title": { "zh": "Trezor 警告 CryptoBilis 售出的 Safe 5 设备疑似存在硬件植入", "en": "Trezor warns of suspected hardware implant in Safe 5 devices sold by CryptoBilis" }, "current_state": { "zh": "Trezor 仍将此事视为可信但未经实验室验证的疑似硬件植入事件，已建议自2026年3月起从 CryptoBilis 购买其钱包的用户迁移资金并提供更换设备，同时正在审查其他亚洲经销商；公司尚未收到涉事 Safe 5，已检查的四台 CryptoBilis 设备未发现篡改，且尚无 CryptoBilis 买家报告资金损失。", "en": "Trezor still treats this as a credible but not lab-verified suspected hardware implant, has advised anyone who bought from CryptoBilis since March 2026 to move funds and is offering replacement devices while reviewing other Asia-based resellers; it has not received the affected Safe 5, found no tampering in four inspected CryptoBilis devices, and no CryptoBilis buyer has reported lost funds." }, "first_seen_at": "2026-10-30T10:58:35.927660+00:00", "last_updated_at": "2026-10-30T18:08:56.303341+00:00", "last_material_change_at": "2026-10-30T18:08:56.303341+00:00", "confidence": 0.75, "updates_count": 3, "sources_count": 5, "entities": [ "after", "buyers", "cryptobilis", "hardware", "implant", "largest", "maker", "malaysian", "report", "safe", "second", "spyware", "suspected", "trezor", "wallet", "warns", "world" ], "identifiers": [], "topics": [ "crypto-security", "cryptobilis", "hardware-wallets", "security-incident", "self-custody", "spyware", "supply-chain-attack", "supply-chain-security", "trezor", "wallet-security" ], "updates": [ { "update_id": "upd_d321f48d977a4a30", "event_id": "evt_ef55a9b094f31e63", "occurred_at": "2026-10-30T07:31:24Z", "published_at": "2026-10-30T07:31:24Z", "first_seen_at": "2026-10-30T10:58:35.927660Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "全球第二大硬件钱包制造商 Trezor 警告疑似硬件植入", "title_en": "World’s Second-Largest Hardware Wallet Maker Trezor Warns of Suspected Hardware", "what_changed_zh": "Trezor 披露了一份可信报告，称2026年8月从经销商 CryptoBilis 处购买的一台 Trezor Safe 5 中疑似存在硬件植入，并敦促自2026年3月起从该经销商处购买过产品的用户将资金转移到使用新生成恢复种子的钱包，同时指出该设备尚未收到以进行验证，也没有客户报告资金损失。", "what_changed_en": "Trezor disclosed a credible report of a suspected hardware implant in a Trezor Safe 5 purchased from reseller CryptoBilis in August 2026 and urged anyone who bought from that reseller since March 2026 to move funds to wallets with newly generated recovery seeds, while noting the device has not been received for verification and no customer has reported lost funds.", "current_state_zh": "Trezor 披露了一份可信报告，称2026年8月从经销商 CryptoBilis 处购买的一台 Trezor Safe 5 中疑似存在硬件植入，并敦促自2026年3月起从该经销商处购买过产品的用户将资金转移到使用新生成恢复种子的钱包，同时指出该设备尚未收到以进行验证，也没有客户报告资金损失。", "current_state_en": "Trezor disclosed a credible report of a suspected hardware implant in a Trezor Safe 5 purchased from reseller CryptoBilis in August 2026 and urged anyone who bought from that reseller since March 2026 to move funds to wallets with newly generated recovery seeds, while noting the device has not been received for verification and no customer has reported lost funds.", "detailed_summary_zh": "Trezor disclosed a credible report of a suspected hardware implant in a Trezor Safe 5 purchased from reseller CryptoBilis in August 2026 and urged anyone who bought from that reseller since March 2026 to move funds to wallets with newly generated recovery seeds, while noting the device has not been received for verification and no customer has reported lost funds.", "detailed_summary_en": "Trezor disclosed a credible report of a suspected hardware implant in a Trezor Safe 5 purchased from reseller CryptoBilis in August 2026 and urged anyone who bought from that reseller since March 2026 to move funds to wallets with newly generated recovery seeds, while noting the device has not been received for verification and no customer has reported lost funds.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:wublockchainenglish:26621", "rss:cointelegraph.com_rss:4cd4299e75d3ecdb" ], "sources": [ { "url": "https://wublockchain.xyz/news/trezor-warns-suspected-hardware-implant-device-sold-by-reseller-21453", "label": "wublockchainenglish", "source_type": "telegram", "official": false }, { "url": "https://cointelegraph.com/news/trezor-cryptobilis-wallet-implant-funds-warning?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c132d9797fd1053c", "event_id": "evt_ef55a9b094f31e63", "occurred_at": "2026-10-30T10:07:29Z", "published_at": "2026-10-30T10:07:29Z", "first_seen_at": "2026-10-30T10:59:31.648928Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Trezor 在 Safe 5 硬件植入报告后警告 CryptoBilis 买家", "title_en": "Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5", "what_changed_zh": "报道补充了披露细节：印尼买家于2026年10月28日通过负责任披露项目报告，涉事Safe 5于2026年8月通过Tokopedia从CryptoBilis购买；植入物被描述为夹在主board与屏幕之间的额外电路板，带蜂窝模块和天线，可读取屏幕内容（包括助记词备份）并在设备插电时通过移动网络发送。Trezor称尚未收到设备，但基于描述和视频采访认为报告可信；此前已于10月9日下架CryptoBilis，并检查了从其购买的4台设备（Safe 7、两台Safe 5、Safe 3）未发现篡改，且无CryptoBilis买家报告资金损失。", "what_changed_en": "The report adds disclosure details: an Indonesian buyer reported it on October 28, 2026 via responsible disclosure; the Safe 5 was bought from CryptoBilis via Tokopedia in August 2026. The implant is described as an extra circuit board between the main board and screen, with a cellular module and antenna, able to read screen contents including the backup and transmit over a mobile network when plugged in. Trezor says it has not received the device but treats the report as credible based on the description and a video interview; it had removed CryptoBilis on October 9 and inspected four devices bought from it (a Safe 7, two Safe 5s, and a Safe 3) finding no tampering, with no CryptoBilis buyer reporting lost funds.", "current_state_zh": "Trezor仍将此事视为可信但未经实验室验证的疑似硬件植入事件，已建议自2026年3月起从CryptoBilis购买其钱包的用户尽快迁移到新助记词钱包；公司尚未收到涉事Safe 5，已检查的四台CryptoBilis设备未发现篡改，且尚无CryptoBilis买家报告资金损失。", "current_state_en": "Trezor still treats this as a credible but not lab-verified suspected hardware implant and has advised anyone who bought its wallets from CryptoBilis since March 2026 to move funds to a new recovery phrase; it has not received the affected Safe 5, found no tampering in four inspected CryptoBilis devices, and no CryptoBilis buyer has reported lost funds.", "detailed_summary_zh": "Trezor urged customers who bought wallets from reseller CryptoBilis since March 2026 to move funds to a new seed after an Indonesian buyer reported a hardware implant in a Safe 5 that allegedly captures the backup from the screen and transmits it over a mobile network.", "detailed_summary_en": "Trezor urged customers who bought wallets from reseller CryptoBilis since March 2026 to move funds to a new seed after an Indonesian buyer reported a hardware implant in a Safe 5 that allegedly captures the backup from the screen and transmits it over a mobile network.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.96, "story_ids": [ "rss:decrypt.co_feed:21298acebe8004e5", "telegram:foresightnews:121779" ], "sources": [ { "url": "https://decrypt.co/382216/trezor-warns-cryptobilis-buyers-after-report-of-hardware-implant-in-safe-5", "label": "Decrypt", "source_type": "rss", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/116452", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_ae8fb680cca5998c", "event_id": "evt_ef55a9b094f31e63", "occurred_at": "2026-10-30T15:27:39Z", "published_at": "2026-10-30T15:27:39Z", "first_seen_at": "2026-10-30T18:08:56.303341Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Trezor 披露马来西亚经销商出售了装有间谍软件的硬件钱包", "title_en": "Trezor reveals Malaysian reseller sold wallet with spyware", "what_changed_zh": "Trezor 表示将更换自2026年3月起从 CryptoBilis 购买钱包的用户设备，并正在审查其他亚洲经销商；报道还将 CryptoBilis 于10月9日被下架与一起8600万美元 Ledger 钱包黑客事件联系起来。", "what_changed_en": "Trezor said it will replace wallets for buyers who purchased from CryptoBilis since March 2026 and is reviewing other Asia-based resellers; the report also links CryptoBilis’s October 9 removal to an $86 million Ledger wallet hack.", "current_state_zh": "Trezor 仍将此事视为可信但未经实验室验证的疑似硬件植入事件，已建议自2026年3月起从 CryptoBilis 购买其钱包的用户迁移资金并提供更换设备，同时正在审查其他亚洲经销商；公司尚未收到涉事 Safe 5，已检查的四台 CryptoBilis 设备未发现篡改，且尚无 CryptoBilis 买家报告资金损失。", "current_state_en": "Trezor still treats this as a credible but not lab-verified suspected hardware implant, has advised anyone who bought from CryptoBilis since March 2026 to move funds and is offering replacement devices while reviewing other Asia-based resellers; it has not received the affected Safe 5, found no tampering in four inspected CryptoBilis devices, and no CryptoBilis buyer has reported lost funds.", "detailed_summary_zh": "Trezor warned that a Safe 5 wallet bought from Malaysian reseller CryptoBilis contained a physical spyware implant that could read and transmit screen data, including backups, and said it will replace affected wallets.", "detailed_summary_en": "Trezor warned that a Safe 5 wallet bought from Malaysian reseller CryptoBilis contained a physical spyware implant that could read and transmit screen data, including backups, and said it will replace affected wallets.", "background_zh": "在CryptoBilis售出的钱包中被植入间谍软件、并导致一起8600万美元Ledger钱包被盗事件后，Trezor于10月9日取消了CryptoBilis的官方经销商资格；Ledger随后切断了与马来西亚、印度尼西亚、新加坡、泰国、菲律宾、越南和香港官方经销商的合作。在Ledger事件发生时，Trezor曾表示“没有任何证据表明Trezor设备遭到入侵”。Trezor称目前正在审查其他亚洲经销商。", "background_en": "Trezor dropped CryptoBilis as an official reseller on October 9 following an $86 million Ledger wallet hack that relied on spyware installed in CryptoBilis-sold wallets; Ledger subsequently cut ties with official resellers across Malaysia, Indonesia, Singapore, Thailand, the Philippines, Vietnam and Hong Kong. At the time of the Ledger hack, Trezor said there was \"not a single piece of evidence that Trezor devices have been compromised.\" Trezor says it is now reviewing its other Asia-based resellers.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件使市场关注点转向经销商渠道这一硬件钱包托管的薄弱环节：通过东南亚地区分销商而非厂商直接购买设备，存在任何固件检查都无法发现的篡改风险。其影响通过托管完整性渠道传导至Trezor及同类硬件钱包的自托管用户，而非通过价格，并使供应链验证继续成为该领域关注焦点。", "market_impact_en": "The report shifts attention to the reseller channel as a weak link in hardware-wallet custody: devices bought through regional distributors in Southeast Asia rather than directly from the vendor carry tampering risk that no firmware check can detect. It affects self-custody holders of Trezor and competing hardware wallets through the custody-integrity channel rather than through price, and keeps supply-chain verification in focus for the sector.", "importance_score": 8.0, "references": [ { "url": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/", "title": "Ledger confirms spy chip implant behind wallet crypto thefts" }, { "url": "https://www.theverge.com/tech/1009294/ledger-wallet-tampering-suspected-after-reports-of-crypto-thefts", "title": "Ledger wallet tampering suspected after reports of crypto... | The Verge" }, { "url": "https://trezor.io/trezor-safe-5", "title": "Trezor Safe 5 | Secure Crypto Hardware Wallet | Trezor" } ], "confidence": 0.93, "story_ids": [ "rss:protos.com_feed_:35bfa4752957e5a2" ], "sources": [ { "url": "https://protos.com/trezor-reveals-malaysian-reseller-sold-wallet-with-spyware/", "label": "Protos", "source_type": "rss", "official": false } ] } ] }