Company
Trezor, made by SatoshiLabs, is a hardware cryptocurrency wallet brand storing private keys offline, paired with Trezor Suite account software.
Researcher Joe Grand says he told Ledger of an implanted Nano X on March 4, 219 days before the Oct. 9 CryptoBilis wallet losses. The case that Ledger gave no public warning rests on Grand's criticism and Mark Karpelès saying he has seen none.
Reality
Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.
Perspective Coverage
6 publishersReality
Ledger disclosed on October 13 that an implant in a signer sold by CryptoBilis captures 24-word recovery phrases and sends them over LTE. Every fund loss Ledger has verified involved devices bought through that reseller.
Perspective Coverage
8 publishersReality
Ledger confirmed on Oct. 10 that one affected customer's wallet held an unauthorized implant, after drains that trackers put near $93 million. That proves tampered hardware reached a victim, but investigators have not tied comparable equipment to the rest of the losses.
Perspective Coverage
22 publishersReality
Ethena CEO Guy Young says a large ENA holder's transfers were a security precaution after the Ledger attack. Researchers put the thefts at up to $93.2 million, and every holder who moves to a fresh signer leaves a trail that looks like an exit.
Reality
MediaMarktSaturn removed all Ledger products from its stores and online platforms over tampering reports. The public German evidence is an X user's claim that two wallets held cellular modules. Ledger did not answer Cointelegraph on whether it has confirmed any tampered device in Europe.
Perspective Coverage
6 publishersReality
Ledger asked resellers in seven Asian markets to pull its wallets from shelves on October 14. It has not tied a suspected implant in a Flex from a second reseller to the first cases, so how far the tampering reaches is open.
Perspective Coverage
7 publishersReality
Ethereum researcher Justin Drake says ECDSA could break in the worst case within months and wants coins moved to fresh addresses. Of six other people Cointelegraph quotes, one shares his alarm, two dispute the evidence and three question the remedy.
Reality
Joe Grand told Trezor in August that two of its wallets carried hardware implants, zetter-zeroday.com reports. Trezor's commercial chief has since written that there is no evidence of compromise as the company trims its authorized sellers.
Reality
Trezor will end its resellers' authorization on January 1, 2027, days after Ledger found an LTE spy implant in wallets sold by CryptoBilis. Trezor says there is no evidence its own devices were compromised.
Perspective Coverage
7 publishersReality
Bitcoin users moving to multivendor multisig after Coldcard and Ledger face a $285 device bill at the lowest listed prices, against $59 for one wallet. Wallet makers and services like Casa and Unchained could gain customers, news.bitcoin.com reported, but the cost may push some users to custodians.
Reality
BasedApp said a breach exposed passport numbers and home addresses linked to customer wallets, without saying how many of its 100,000-plus users were hit. The leak gives Recap a live example in its fight against HMRC's draft power to demand crypto records without tribunal approval.
Reality
Bitget lost about $387.5 million to forged withdrawals from its wallet system, more than half of September's $742 million in crypto thefts. Most of Liquid Network's loss was handed back, so what stayed stolen sits mainly with one exchange's withdrawal infrastructure.
Reality
Hester Peirce used her penultimate week as an SEC commissioner to urge replacing bulk KYC collection with zero-knowledge proofs of eligibility. She filed no proposal and spoke for herself, so the collection rules she criticized stay as written.
Perspective Coverage
3 publishersReality
A fulfillment partner exposed names, addresses and phone numbers belonging to hardware wallet buyers, according to The Register. The vendor's boundary was the company's boundary.
Perspective Coverage
3 publishersReality
The wallets held. The customer list did not: 39,798 names, phone numbers and shipping addresses, taken through commerce plumbing nobody threat-models.
Perspective Coverage
3 publishersReality
Roughly 40,000 SafePal customers had names, addresses and payment methods exposed, according to Crypto Briefing; the air-gapped device held, the shipping list did not.
Perspective Coverage
4 publishersReality
No seed phrases were touched. What was taken is names, phone numbers and shipping addresses for people known to own a hardware wallet, now advertised on a crime forum.
Perspective Coverage
8 publishersReality
The records that expanded Trezor's breach were US orders from 2019 to 2021, held years past the 90-day deletion window its fulfillment partner had promised, which puts the failure in the contract rather than the device.
Reality
The records cover orders placed between November 2019 and August 2021, years past the 90-day deletion window Trezor advertises. Trezor says it held repeated written confirmation from ShipMonk that the data was gone.
Perspective Coverage
3 publishersReality
Security · September 10, 2026 · Confirmed4 publishers
Invest · September 12, 2026 · Confirmed5 publishers
Security · September 17, 2026 · Confirmed3 publishers
Invest · August 20, 2026 · Confirmed2 publishers