Trezor warns wallets sold since March may contain *seed-stealing implants*

A hardware wallet with a passenger

A hardware wallet is meant to be a safe: you hold the keys, nobody else does. That's the promise. So when Trezor warned on 2 November 2026 that some of its Safe 5 wallets sold since March might contain hidden implants that steal users' seed phrases, it broke that promise at the worst possible level ^[1].

The implants are tiny circuit boards slipped inside the wallet during the supply chain. When a user types in their recovery phrase – the list of words that unlocks their cryptocurrency – the implant records it and sends it out. Whoever gets that phrase can drain the wallet from anywhere in the world.

It's like buying a new padlock and finding out later that someone had already taken a copy of the key.

What happened

Trezor traced affected wallets to CryptoBilis, a Turkish reseller ^[1]. The company has also been linked to recent Ledger wallet drains, and several users have reported stolen funds. Trezor says it has blocked affected devices from receiving firmware updates and is working with law enforcement, but it hasn't said how many wallets are involved or how the implants got there.

The reseller denies wrongdoing. Users are left with wallets they can't trust and, in many cases, empty accounts.

The evidence question

This is where it gets harder. Say you bought one of these wallets and your cryptocurrency disappeared. You want to know: who is liable? The manufacturer, for letting a compromised batch reach customers? The reseller, for adding the implant or buying from someone who did? Or an attacker who intercepted the shipment?

Without a record of what the wallet contained when it left the factory, when it reached the reseller and what was added at each stage, no one can prove who did what. The implant is physical evidence, if you still have the device and can afford the analysis. But it doesn't tell you when it was added or by whom.

Under the EU's new product liability rules, software is explicitly a product, and liability is strict ^[2]. Hardware wallets aren't pure software, but they're certainly products with a digital element. The question a court would ask is: what did the manufacturer know, when did they know it, and could they have prevented it?

If the manufacturer can't show what left the factory and what reached the customer, the argument becomes a matter of competing stories. The side without records starts behind.

What a digital witness would seal in a case like this

Here, the things to seal are the hardware audit at production and the handover to each reseller. That means sealing a record of each device's serial number, a fingerprint of its firmware image, the results of any hardware inspection and the party who received it, at the time of handover.

Sealing takes a fingerprint of the record, not the record itself, so sensitive commercial and security details stay with the manufacturer. If a device later turns out to be compromised, anyone the manufacturer shares the sealed record with – a court, an insurer or law enforcement – can check that it's the one written on the day the wallet left the factory.

What it shows is that the record hasn't changed since it was sealed. It doesn't show that the inspection was thorough, that the reseller was trustworthy or that an implant couldn't have been added later. But it does give the manufacturer a dated record they didn't write in hindsight.

Anyone can check the seal, and if the fingerprint matches, the record is unchanged. If someone has altered it – even the manufacturer – the check fails. You can start sealing production and supply chain records now, through WitniumChain's REST API, SDK or MCP server, and the first 2,000 witnesses a month are free. Read the full documentation at witniumchain.com/docs.

How it would work

1. At final inspection, seal a record of the device serial number, firmware fingerprint and inspection results.
2. At handover to the reseller, seal a record of which devices were transferred and to whom.
3. If a device is later questioned, recalculate the fingerprints and check them against the sealed records.

What this means for you

If you make hardware that holds value or secrets, ask yourself: could you show what left your premises, and in what state? If something goes wrong six months later, will you have a dated record, or will you be piecing together emails and invoices?

If you bought a Trezor Safe 5 from CryptoBilis since March, Trezor advises moving your funds to a new wallet from a trusted source immediately ^[1]. Don't enter your existing seed phrase into any device.

What to watch

The EU's Cyber Resilience Act will require manufacturers of products with digital elements to have documented security practices and report actively exploited vulnerabilities within 24 hours of becoming aware of them ^[3]. Those rules apply from 11 September 2026 for reporting and from 11 December 2027 for the essential requirements ^[4]. A hidden implant would count.

The new Product Liability Directive, which treats software as a product, is proposed to enter into force in Sweden on 9 December 2026 ^[2]. If a hardware wallet with a compromised firmware or an added implant causes loss after that date, the question of who is liable – and what they can prove – becomes sharper.

Sources

1. Help Net Security, "Trezor warns: Hardware wallets bought via certain reseller may be implanted", 2 November 2026, https://www.helpnetsecurity.com/2026/11/02/trezor-hardware-wallet-implant-cryptobilis/
2. Swedish Government, lagrådsremiss: En ny produktansvarslag, August 2026, implementing Directive (EU) 2024/2853, https://www.regeringen.se/rattsliga-dokument/lagradsremiss/2026/08/en-ny-produktansvarslag/
3. Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14, https://eur-lex.europa.eu/eli/reg/2024/2847/oj
4. Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex I essential requirements apply from 11 December 2027, https://eur-lex.europa.eu/eli/reg/2024/2847/oj