Trezor
CompanySecurity timeline
- Malware reported by Security AffairsSecurity Affairs newsletters flag malicious Claude Code extension, Trezor implant warning and AI-driven attacks
Recent news
Security Affairs newsletters flag malicious Claude Code extension, Trezor implant warning and AI-driven attacks
The Security Affairs AI-cybersecurity and malware newsletters collect recent reporting on AI-enabled attacks, Android spyware such as uCreator, and a Magento skimming campaign affecting 953 stores. They also flag a malicious Anthropic.claude-code build (2.1.313) found in the Cursor Extension Marketplace, a Trezor warning about a suspected crypto-theft implant, and a Hugging Face malware campaign that returned after a takedown.
Trezor warns of suspected hardware implant in Safe 5 wallet sold via CryptoBilis
Trezor has issued a security notice about a suspected hardware implant in a Safe 5 bought through CryptoBilis, a reseller it removed from its authorised network on 9 October. A customer in Indonesia reported an extra board with a cellular module and antenna between the main board and screen, allegedly capturing the recovery phrase shown on the display and sending it over a mobile network. The device is going to Trezor's security lab, so the implant is unconfirmed, but all Trezor devices bought from CryptoBilis from March 2026 onward are covered as a precaution. No fund losses have been reported by CryptoBilis buyers.
Trezor warns of suspected hardware implant in Safe 5 wallets sold by reseller CryptoBilis
Trezor has received credible reports of a suspected hardware implant in a Trezor Safe 5 sold by its reseller CryptoBilis, which BleepingComputer says operates in Southeast Asia. One customer reported an extra circuit board that transmits the recovery phrase over a mobile network. Trezor has not yet examined the device and advises everyone who bought from CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase.