Crypto wallet firm Trezor has cut its reseller network by 80% following the discovery of more spy implants in devices sold by Malaysian vendor CryptoBilis.
Trezor’s latest update on the spyware incident revealed it has implemented stricter rules for vendors in order to protect its supply chain.
However, only 20% of vendors were able to abide by the new rules that focus on “how devices are sourced, stored and who has access to them.”
Trezor stressed, however, that the dropped resellers “were trustworthy and posed no immediate threat.”
Trezor says its new update renders spy implants useless
Trezor also claims to have released an update on November 11 that stops the implants recording data and renders them “useless.”
A spokesperson for the company told Protos, “The implant listens to the communication between the MCU and the display and triggers the capture when it sees a specific sequence.”
In order to stop the sequence trigger, which is a wallet’s seed phrase, Trezor claims it “changed the order of the commands sent to the display” and that it can do this “without any effect on the displayed screen.”
Read more: Trezor reveals Malaysian reseller sold wallet with spyware
Despite this, Trezor warned CryptoBilis customers that they should still move their funds to a new wallet as “the update can’t protect a wallet backup that was captured before it.”
Three Trezor wallets infected but no funds stolen
Trezor says a total of three Trezor Safe 5 models have been found implanted with the spyware and that the devices were purchased between August 20 and September 23.
It still maintains that no crypto has been stolen from the affected devices, and has offered those who bought their wallets from CryptoBilis a free replacement.
Ledger wallet users suffered $86M theft
Wallets sold by Trezor rival Ledger were drained of over $86 million last month in an attack that also involved tampered wallets sold by CryptoBilis.
Stablecoin firm Tether froze $10 million in stolen funds, and Ledger asked multiple wallet vendors across Asia to halt sales.
Read more: Ledger roasted over $849 device launch after $86M hack
Its investigation uncovered an organized crime group spending millions to build spyware infrastructure that involved logistics, seed collector servers, and draining/laundering infrastructure.
It took several weeks before Trezor revealed it too had discovered an implant in one of its devices.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.