- Messages
- 91
- Likes
- 10
- Points
- 8
The manufacturer denied the problem, although it received evidence two months ago.
Spy chips were found not only in Ledger crypto wallets but also in devices from competitor Trezor. Researcher Joe Grand discovered two modified wallets that provided owners with pre-prepared passphrases. The manufacturer had been aware of the findings since August but publicly denied any such incidents.
On October 13, Trezor announced it was reducing the number of authorized resellers to tighten supply chain controls. Chief Commercial Officer Danny Sanders called the decision preventative and claimed there was no evidence of device compromise. However, hardware hacker Joe Grand provided the company with the results of an investigation into one of the rigged wallets on August 10.
The researcher examined two older models, the Trezor Model T and the Trezor One. The former was purchased through Facebook* Marketplace in Canada in 2025, and the latter was purchased from a TikTok store in August 2026. The buyer of the Trezor One became suspicious after approximately $50 went missing. Both devices have been discontinued by the manufacturer but continue to receive security updates.
In both cases, the criminals replaced the standard microcontroller with a custom chip with modified firmware. Instead of a random seed phrase, the device output one of approximately twelve pre-recorded combinations. The attackers already knew the secret words and could restore access to the cryptocurrency without physical contact with the wallet.
The substitution also affected the firmware authentication mechanism. The malicious device first provided the Trezor Suite program with a copy of the real software, allowing it to pass verification. Then, control was transferred to the modified code. The open source nature of Trezor allowed the criminals to prepare their own version of the firmware for the replaced microcontroller.
This differs from the attack on Ledger , where third-party components intercepted the real recovery phrase during initial setup and transmitted the information over the cellular network. In the case of Trezor, the criminals did not steal a randomly generated secret, but rather determined in advance which combination the buyer would receive. Both discovered wallets came from unauthorized sellers.
According to the researcher's correspondence with the manufacturer, on August 13, Trezor acknowledged the similarity between the discovered device and modified wallets found on Russian marketplaces in 2022–2023. The company expressed interest in the extracted firmware and requested that the behavior of the current version of Trezor Suite be verified. In early September, Trezor representatives also discussed the possible publication of the findings.
There is no evidence of mass sales of infected Trezor devices through official partners. The manufacturer recommends verifying the authenticity of devices and firmware through Trezor Suite. Additional randomness checks during wallet creation help identify predictable secret phrases. If a tampering is suspected, the owner should transfer funds to a new wallet with an independently generated recovery phrase.
* Meta and its products (including Instagram, Facebook, and Threads) are recognized as extremist and their activities are prohibited in the Russian Federation.
Spy chips were found not only in Ledger crypto wallets but also in devices from competitor Trezor. Researcher Joe Grand discovered two modified wallets that provided owners with pre-prepared passphrases. The manufacturer had been aware of the findings since August but publicly denied any such incidents.
On October 13, Trezor announced it was reducing the number of authorized resellers to tighten supply chain controls. Chief Commercial Officer Danny Sanders called the decision preventative and claimed there was no evidence of device compromise. However, hardware hacker Joe Grand provided the company with the results of an investigation into one of the rigged wallets on August 10.
The researcher examined two older models, the Trezor Model T and the Trezor One. The former was purchased through Facebook* Marketplace in Canada in 2025, and the latter was purchased from a TikTok store in August 2026. The buyer of the Trezor One became suspicious after approximately $50 went missing. Both devices have been discontinued by the manufacturer but continue to receive security updates.
In both cases, the criminals replaced the standard microcontroller with a custom chip with modified firmware. Instead of a random seed phrase, the device output one of approximately twelve pre-recorded combinations. The attackers already knew the secret words and could restore access to the cryptocurrency without physical contact with the wallet.
The substitution also affected the firmware authentication mechanism. The malicious device first provided the Trezor Suite program with a copy of the real software, allowing it to pass verification. Then, control was transferred to the modified code. The open source nature of Trezor allowed the criminals to prepare their own version of the firmware for the replaced microcontroller.
This differs from the attack on Ledger , where third-party components intercepted the real recovery phrase during initial setup and transmitted the information over the cellular network. In the case of Trezor, the criminals did not steal a randomly generated secret, but rather determined in advance which combination the buyer would receive. Both discovered wallets came from unauthorized sellers.
According to the researcher's correspondence with the manufacturer, on August 13, Trezor acknowledged the similarity between the discovered device and modified wallets found on Russian marketplaces in 2022–2023. The company expressed interest in the extracted firmware and requested that the behavior of the current version of Trezor Suite be verified. In early September, Trezor representatives also discussed the possible publication of the findings.
There is no evidence of mass sales of infected Trezor devices through official partners. The manufacturer recommends verifying the authenticity of devices and firmware through Trezor Suite. Additional randomness checks during wallet creation help identify predictable secret phrases. If a tampering is suspected, the owner should transfer funds to a new wallet with an independently generated recovery phrase.
* Meta and its products (including Instagram, Facebook, and Threads) are recognized as extremist and their activities are prohibited in the Russian Federation.