Trezor confirms three tampered wallets in October report investigation, updates response
Trezor said its investigation into a wallet-tampering report received on 28 October identified malicious hardware devices in three Safe 5 wallets sold by Cryptobilis. The devices collect information including recovery phrases displayed on the screen and transmit it to attackers over mobile networks. Trezor released firmware on 11 November to block the devices’ data collection and said no related losses of funds had been reported to date.
Key facts
- Affected organisation
- Trezor
- Incident type
- Hacking & intrusion
- Occurred / detected
- 2026-10-28
- Scale of damage
- Malicious devices identified in three Safe 5 hardware wallets
- Cause / method
- Insertion of malicious hardware devices to steal wallet recovery information
- Location
- Other countries
Timeline
- Trezor confirmed malicious hardware devices in three Safe 5 wallets and disclosed corrective measures.
1 related reports
Other incidents at Trezor
Trezor email provider breach leads to scams targeting crypto owners
Impact: Hundreds of thousands of cryptocurrency owners targeted by fraudsters
Trezor confirmed a data breach at its email provider. After the breach, fraudsters targeted hundreds of thousands of cryptocurrency owners. The specific data exposed and the scale of financial losses have not been confirmed.
Read on TechCrunch ↗Trezor Customer Data Leak Widens After Shipping Partner Breach
67kImpact: Information of 13,689 customers and about 67,000 additional US customers
A breach at Trezor's shipping partner ShipMonk exposed the information and shipping addresses of 13,689 customers. It later emerged that the information of about 67,000 additional US customers, which had been described as deleted, was also exposed. Trezor disclosed the widening scale of the damage.
Related reports: 16 · last report →Trezor's X account hacked and used to promote crypto scam
Impact: X account used to promote a cryptocurrency scam
Trezor's X account was hacked and used to promote a cryptocurrency scam. The amount of financial damage and whether the account has been recovered have not been confirmed.
Read on Yahoo Finance ↗Trezor support site breach leaks personal data of 66,000 customers
66kImpact: Email addresses and names of 66,000 customers
Trezor's support site was breached, leaking the personal information of 66,000 customers. The leaked information included email addresses and names, and the specific response has not been confirmed.
Related reports: 2 →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.