Hardware hacker Joe Grand discovered malicious components inside two Trezor cryptocurrency wallets and informed the manufacturer months before it publicly said there was no evidence that its devices had been compromised, according to an investigation published on October 13, 2026.
The findings concern a Trezor Model One and a Model T obtained through unauthorized third-party sellers. Investigators found that attackers had replaced the devices’ original microcontrollers with modified chips programmed to generate recovery phrases already known to the attackers.
One buyer became suspicious after approximately $50 disappeared from his cryptocurrency account, although the publicly disclosed evidence does not conclusively establish that the modified device caused the transfer.
The disclosure comes as Trezor reduces its authorized reseller network following a separate hardware-wallet supply-chain incident involving competitor Ledger. Unlike the recently identified Ledger implants, the two Trezor devices were purchased outside the manufacturer’s authorized distribution network.
Researcher Reported Modified Trezor Devices in August
Grand, a hardware security researcher known for reverse-engineering cryptocurrency wallets, examined two devices obtained through online marketplaces.
According to Kim Zetter’s investigation published by ZERO DAY, the Model T was purchased through Facebook Marketplace in Canada during 2025. The Model One came from a TikTok shop in August 2026.
Both devices contained replacement microcontrollers running altered firmware. Instead of producing genuinely random recovery phrases during initialization, the modified chips selected from approximately a dozen predetermined phrases embedded by the attackers.
That allowed whoever controlled the malicious firmware to anticipate which private keys the buyers’ wallets would use.
Grand said he notified Trezor about the Model T on August 10. The company responded three days later, acknowledging the technical findings and noting similarities to previously identified modified wallets sold through Russian marketplaces.
According to correspondence reviewed by Zetter, Trezor requested additional technical information, including the extracted firmware binary, and asked whether its Trezor Suite application recognized the device as counterfeit.
The company continued communicating with Grand into early September and requested advance notice if he intended to publish his findings.
These interactions suggest that Trezor had received information about at least one modified device before its October statement. However, they do not establish that the company had discovered compromised inventory within its authorized reseller network.
Attackers Replaced the Microcontroller to Manipulate Recovery Phrases
The Trezor attack differs substantially from ordinary phishing and from the LTE-enabled hardware implants recently identified inside Ledger wallets.
According to Grand’s findings, the attackers replaced the legitimate microcontroller with another chip containing modified firmware. Because Trezor’s firmware is open source, attackers could use publicly available code as a starting point for creating a malicious version.
The modified devices reportedly attempted to bypass software integrity checks by presenting legitimate firmware during verification before executing malicious behavior.
Trezor documents firmware authenticity checks designed to identify modified or counterfeit hardware, including verification procedures for its older Model One and Model T devices. The newly disclosed findings raise questions about how those protections behave when an attacker replaces the underlying controller.
The risk is particularly serious because the recovery phrase determines control over the wallet’s assets. Someone who already knows that phrase can reconstruct the wallet elsewhere without obtaining the physical device.
A related weakness in recovery-phrase generation featured in Dave Finances’ coverage of the COLDCARD seed-generation incident, where reduced randomness left wallet credentials vulnerable to reconstruction.
Although the technical causes differ, both cases demonstrate how a compromised seed-generation process can defeat the protections investors expect from offline storage.
Trezor Cuts Reseller Network Following Ledger Supply-Chain Attack
On October 13, Trezor announced that it would reduce the number of authorized retailers distributing its hardware wallets, describing the decision as a preventive response to recent supply-chain incidents.
Chief Commercial Officer Danny Sanders informed affected partners that they would stop receiving new inventory immediately and lose their authorized reseller status on January 1, 2027. Existing stock can continue to be sold before authorization expires.
Trezor said the decision would allow it to monitor remaining distribution partners more closely and emphasized that it had no evidence of compromised devices sold through its authorized channels.
However, its broader public assertion that there was no evidence of compromised Trezor devices prompted renewed scrutiny after Grand’s earlier findings became public.
The reseller changes follow the Ledger CryptoBilis wallet investigation, which began after customers reported substantial cryptocurrency losses involving devices obtained from an authorized Southeast Asian reseller.
Ledger’s security researchers subsequently identified implants capable of capturing recovery phrases displayed during wallet initialization and transmitting them through LTE cellular connections using embedded eSIM technology.
Those implants operated separately from Ledger’s secure element and did not need to replace the device’s legitimate firmware.
Independent blockchain researchers have estimated substantial losses connected to the incident, but Ledger has not confirmed a definitive total or number of affected customers.
Why the Two Implant Methods Present Different Security Risks
The Trezor findings should not be treated as evidence that its authorized supply chain has suffered the same compromise as Ledger’s. The devices investigated by Grand came from unauthorized sellers, and the company has not confirmed similar malicious units reaching customers through official channels.
Nevertheless, the technical distinction reveals a broader problem with hardware-wallet security.
In the Ledger case, the legitimate device could generate a secure recovery phrase while an additional component secretly captured it. In the Trezor cases, the malicious controller reportedly made the recovery phrase predictable from the beginning.
The result can be similar: attackers gain knowledge of the credentials needed to move funds, even when the buyer believes the wallet was initialized securely.
This also shows why ordinary advice about avoiding suspicious links or never sharing recovery phrases, while essential, cannot address every threat. Investors can follow those instructions and still face losses if the device generating their credentials has already been manipulated.
Dave Finances previously examined the consequences of compromised wallet keys in the D’CENT XRP investigation, where previously exposed credentials reportedly remained usable as further funds entered affected accounts.
The same fundamental problem applies here. Once a recovery phrase is known to someone else, moving it to a different hardware device does not restore its secrecy. Investors must create new, independently generated credentials and transfer the assets to addresses derived from those new keys.
Reseller Controls Could Become a Competitive Priority
Trezor’s decision to shrink its retail network is commercially significant because accessibility and security do not always work together.
A broader reseller network makes hardware wallets easier to purchase, particularly in countries where direct international shipping is expensive or difficult. But every additional distributor, warehouse and fulfillment partner introduces another point where the chain of custody must be controlled.
Reducing the number of partners could improve oversight while limiting local availability or concentrating sales among fewer retailers. Whether the trade-off improves customer protection will depend on the strength of those controls rather than the number of partners alone.
The incidents also expose a difficult question for the entire hardware-wallet industry: how can manufacturers give customers reliable assurance that a product has not been physically altered after leaving the factory?
Software verification remains important, but sophisticated physical modifications may require additional authentication mechanisms and stronger inventory controls. Tamper-evident packaging can help, although it cannot guarantee that every component inside a device is genuine.
For Trezor, the immediate challenge is explaining how its existing checks respond to the specific controller-replacement method Grand identified and whether additional safeguards are necessary for older models.
For investors, the most important distinction is between an isolated compromised product obtained through an unauthorized marketplace and evidence of tampering inside an approved distribution channel.
Grand’s findings establish that attackers have targeted older Trezor hardware with manipulated recovery-phrase generation. They do not establish widespread customer losses or compromise of Trezor’s official retail network.
What happens next will depend on whether further forensic investigations uncover similar devices, whether Trezor clarifies its handling of the August disclosure, and whether tighter reseller controls can prevent modified wallets from reaching customers through channels they reasonably trust.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574