Crypto: after Ledger, spy chips found in Trezor wallets, what to do?

Here we go again. A month ago, we discovered spy chips hidden in Ledger crypto wallets sold in Southeast Asia. On Thursday, November 12, it's Trezor, the other major manufacturer of these little digital safes, confirming the same thing at its end. Three of its Safe 5 wallets contained an extra electronic board, slipped in under the screen. Same reseller, same method. But this time, there's some good news in the story: Trezor released an update that makes these bugs deaf and blind. A software update against a physical chip, frankly, I wasn't expecting that!

An extra board, slipped between the screen and the main board

Same reseller, same method

A quick reminder for those who've never held one. A hardware wallet is a case the size of a USB stick, with a small screen, that keeps the codes for your crypto offline. When you start it up, it displays a list of words, the recovery phrase, which you copy down on paper. Those words are the key to the safe: whoever has them can empty your wallet from anywhere in the world.

The reseller is still CryptoBilis, a Malaysian shop that also sold on Tokopedia and Shopee, two major online marketplaces in Southeast Asia. It's the one that had sold the booby-trapped Ledgers, and last month I told you how these spy chips had made it possible to empty more than three hundred wallets. At Trezor, the three affected devices were bought from CryptoBilis between August 20 and September 23. One was taken apart in Trezor's lab, the other two were spotted thanks to photos sent by their owners. In total, 48 buyers from CryptoBilis contacted the manufacturer.

The spy device doesn't tamper with anything. It doesn't modify either the wallet's software or its security chip, the one that keeps the secrets. It simply watches the screen. When the recovery words appear, it spots them, keeps them, then sends them over the mobile network, like a phone would send a text message. No network? It waits and tries again later. Patient little thing.

The spy device reads the recovery words at the same time as their owner

And the most important thing: according to Trezor, no customer has reported losing money. At Ledger, the haul had exceeded one hundred million dollars. Here, the warning arrived before the theft.

The countermeasure: software against a chip

Firmware is the wallet's internal software, the one that handles everything, from the screen to the buttons. Trezor published its own as version 2.13.1 on Wednesday, November 11, and according to the manufacturer, it prevents the spy devices found so far from capturing anything at all. Trezor doesn't say how, and that's deliberate: the brand refuses to publish technical details that could help hackers make the next version.

There, I find that really clever. Usually, a hardware vulnerability means it's over: you don't repair a circuit remotely, you throw the device away. Here, the manufacturer found a way to make the spy chip useless without even opening the case. It's a bit like being unable to unplug the hidden camera above the safe, but finding a way to make sure it doesn't film anything useful anymore.

There is still one limitation, and Trezor says it clearly: the update protects you going forward, it doesn't fix the past. If your recovery words were read before the update, they're gone, and no update will bring them back.

Four out of five resellers, gone

The other decision is more radical. Trezor cut about 80% of its reseller network. The manufacturer specifies that the partners removed were reliable and posed no immediate danger, but that they didn't comply with the new, stricter rules: where the devices come from, where they're stored, and who can touch them before they get to you.

Four out of five, that’s a lot of stores losing the brand overnight. But it shows exactly where the real weak point is: not in the chip, not in the software, in the box. Between the factory and your mailbox, the device passes through hands that neither you nor the manufacturer know.

The weak point isn’t the chip, it’s the journey between the factory and your home

You have a wallet, what do you do?

If you bought it directly from the manufacturer’s website, you’re not affected: no cases were found outside CryptoBilis, either at Trezor or at Ledger. If you have a Trezor, still update it to 2.13.1 via the official application, Trezor Suite. It costs nothing.

If you bought from CryptoBilis, or if you’re no longer quite sure where your device came from (a gift, a second-hand purchase, a good deal online), Trezor’s instructions are clear: contact official support, keep the device, and move your crypto to a new wallet with a new recovery phrase. For CryptoBilis buyers since March 2026, Trezor is offering a replacement or a refund.

New recovery phrase, new safe: the only countermeasure when the old one may have been read

And next time, buy directly from the manufacturer. Not from a marketplace, not from a seller who slashes prices, not second-hand. According to researchers who had been following the case since September, the compromised Ledgers were selling for almost half price. That should have raised the alarm, if I may put it that way.

One last reflex, valid everywhere: nobody ever needs your recovery phrase. Not Trezor, not Ledger, not your bank, not a “consultant” who calls you to help after this affair. Scammers love this kind of news for sending fake “verification” emails.

What I take away from this is that two competing manufacturers got trapped in exactly the same way, by the same store, just a few weeks apart. The security chip held up both times. The weak link was the screen, the very one used to show you your words. And I wonder how many other small devices bought cheaply on a marketplace are walking around today with a stowaway inside.

Sources

• Trezor, November 12, 2026: our investigation into CryptoBilis, what we found and what we changed (in English)
• CoinDesk, October 12, 2026: Ledger confirms an implant in at least one device sold by CryptoBilis (in English)
• The Crypto Desk, November 13, 2026: Trezor confirms the implants (in English)

Article written with the help of Claude Code, proofread and corrected by me.