From the page · 12 passages with claims
I published a story this morning about implants that have been discovered in a number of Ledger crypto devices. (Unverified, claim 1) In initial had included in the story information about implants that were also discovered in devices made by Trezor – Ledger's main competitor. (Unverified, claim 2) I removed this, however, before publishing the story because I didn't want to confuse matters. (Unverified, claim 3)
But a few hours ago Trezor announced on X that it would be reducing the number of merchants authorized to sell its devices out of an "abundance of caution." (Corroborated, claim 4) Chief Commercial Officer Danny Sanders wrote that there was "not a single piece of evidence that Trezor devices have been compromised," and that this was reducing its list of authorized sellers simply as a "preventive step" to have better control over its supply chain. (Not auto-checked, claim 5)
But this isn't exactly true. Famed hardware hacker Joe Grand found implants in two Trezor wallets recently and notified the company about them in August. (2 claims: 2 Not auto-checked) I didn't include this in my Ledger story because the circumstances were different from the Ledger incidents. (Unverified, claim 8) The Ledger implants became news because the implants were 1) sold in devices distributed by authorized resellers of Ledger devices and 2) the implants were subsequently used to steal $100 million in crypto from the owners of devices that were compromised. (4 claims: 2 Corroborated, 2 Unverified)
But as I noted in the Ledger story, Grand had initially found implants in four Ledger devices that were sold online by unauthorized Ledger merchants. (Unverified, claim 13) These merchants appeared to be fly-by-night sellers who popped up in online marketplaces only to disappear after days or weeks. (Unverified, claim 14) So the provenance of the compromised devices was already sketchy, as opposed to the later implants that were sold by reputable and authorized sellers. (Unverified, claim 15)
The implants Grand found in Trezor One and Trezor Model T devices were also sold by third-party nonauthorized sellers – not by reputable authorized sellers. (Unverified, claim 16) No real surprise there, since both Ledger and Trezor have warned customers for years to purchase directly from their own web sites or from authorized merchants. (Unverified, claim 17) Therefore the information that Grand found Trezor wallets compromised by implants didn't seem newsworthy. Especially because three years ago, researchers at Kaspersky Lab had also found an implant in a Trezor wallet sold on a popular Russian marketplace. (Unverified, claim 18) In its report, Kaspersky called it a fake wallet, but it was a real Trezor wallet that had been compromised.
Grand found an implant in a Trezor Model T wallet that someone had purchased via Facebook Marketplace in Canada some time in 2025 and another one in a Trezor One device that someone had obtained from a TikTok shop in August. (4 claims: 3 Unverified, 1 Not auto-checked) The buyer of the Trezor One became suspicious when about $50 got transferred out of his crypto account. (Unverified, claim 23) Both the Trezor One and Trezor Model T are discontinued devices, but Trezor still supports them (as noted in the product photo at top, the company will continue to distribute software updates until 2031 and security updates until 2036) and customers still buy them from third-party sellers. (6 claims: 6 Unverified)
Grand says the legitimate microcontrollers used in the Trezor devices have code-protection features that are meant to prevent someone from accessing and changing the code. (Unverified, claim 31) But because the Trezor code is open source, it was easy for the attackers to obtain the code, modify it, and program it into a new, unsecured device by just replacing the legitimate chip with their own chip. (Unverified, claim 32)
This is very interesting, and we appreciate the work you have put into investigating the device. Based on your description, the unit has very similar characteristics to the counterfeit or modified Model T devices that were discovered on Russian marketplaces in 2022–2023. (Unverified, claim 34) The use of a replaced MCU and modified firmware, together with an external microSD card containing legitimate firmware for the integrity check, is a particularly interesting variation on those earlier devices. We would definitely be interested in examining the binary you extracted from the STM32F427.
Does Trezor Suite recognize or flag the device as counterfeit or otherwise indicate that something is wrong? Although we have discontinued sales of the Model T, we continue to improve the checks in Trezor Suite that are intended to identify counterfeit and modified devices. (Unverified, claim 37) Any information you can provide about how the current version of Trezor Suite treats this particular unit would therefore be very helpful. Thank you again for bringing this to our attention and for sharing the technical details of your investigation.
No passage has a claim with this status.
- Corroborated backed by sources
- Contradicted contradicted by sources
- Unverified not confirmed or contradicted
- Not auto-checked evidence only, no automated status