Cryptocurrency hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers over cellular networks.

The findings follow an investigation into a suspected hardware implant first reported in October, when a customer discovered an unauthorized circuit board inside a Trezor Safe 5 purchased from Indonesian reseller CryptoBilis.

At the time, Trezor had not received the device for examination and could not confirm the implant’s capabilities.

In a new investigation update, the company says it has now examined the original device in its laboratory and identified two…