Trezor slashes reseller network by 80% after uncovering additional spy implants

Crypto wallet firm Trezor has reduced its reseller network by 80% after further spy implants were found in devices sold by Malaysian vendor CryptoBilis.

Trezor's most recent statement on the spyware incident said it has put in place tougher rules for vendors to safeguard its supply chain.

Only 20% of vendors managed to meet the new requirements, which concern "how devices are sourced, stored and who has access to them."

Trezor emphasized that the removed resellers "were trustworthy and posed no immediate threat."

Trezor says its new update renders spy implants useless

Trezor also says it released an update on November 11 that prevents the implants from recording data and makes them "useless."

A company spokesperson told Protos: "The implant listens to the communication between the MCU and the display and triggers the capture when it sees a specific sequence."

To block the sequence trigger — a wallet's seed phrase — Trezor said it "changed the order of the commands sent to the display" and that it can do so "without any effect on the displayed screen."

Read more: Trezor reveals Malaysian reseller sold wallet with spyware

Nevertheless, Trezor warned CryptoBilis customers to still transfer their funds to a new wallet because "the update can’t protect a wallet backup that was captured before it."

Three Trezor wallets infected but no funds stolen

Trezor says three Trezor Safe 5 devices in total have been found to contain the spyware, purchased between August 20 and September 23.

It still maintains that no cryptocurrency has been taken from the affected devices and has offered a free replacement to anyone who bought their wallets from CryptoBilis.

Ledger wallet users suffered $86M theft

Wallets sold by Trezor rival Ledger were drained of over $86 million last month in an attack that also involved tampered wallets sold by CryptoBilis.

Stablecoin firm Tether froze $10 million of the stolen funds, and Ledger asked several wallet vendors across Asia to stop sales.

Ledger’s SDK snitched users’ transaction data and device info

Read more: Ledger roasted over $849 device launch after $86M hack

Its investigation found an organized crime group that spent millions building spyware infrastructure involving logistics, seed collector servers, and draining and laundering systems.

It took several weeks before Trezor disclosed that it too had found an implant in one of its devices.