Counterfeit Trezor Model T with modified bootloader and preset seeds
Who is affected
Anyone who set up a wallet on such a counterfeit used a seed the attacker already knew. Owners of genuine devices bought through official channels are not affected.
What happened
Kaspersky analyzed a device sold as a Trezor Model T after its owner lost cryptocurrency. The owner had bought it from a seller on a popular classifieds website. According to Kaspersky, it looked genuine at first glance but reported bootloader version 2.0.4, which Trezor never released.
Kaspersky found that the genuine STM32F427 microcontroller had been replaced with an STM32F429 with read-out protection disabled, and that the bootloader’s firmware originality and signature checks had been removed. The modified firmware replaced the randomly generated seed with one of 20 seed phrases stored in the firmware, and used only the first character of the optional passphrase.
This is a counterfeit device, not a vulnerability in genuine Trezor hardware or firmware. A Trezor spokesperson told Cointelegraph that Trezor Suite warns users when a device runs unofficial firmware.
What to do:
- Buy hardware wallets only from the vendor or its authorized resellers.
- Never ignore warnings shown by the device or its companion app.
- Update the firmware and reset a new device before use.
Cryptocurrency is a digital or virtual currency secured by cryptography, operating on decentralized blockchain networks to enable secure, peer-to-peer transactions.
A bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionA mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionA passphrase is an additional security layer for cryptocurrency wallets, acting as a 25th word in the BIP39 seed phrase, protecting access to hidden wallets.
Read full definitionA supply chain attack targets vulnerabilities in the production or distribution process of crypto hardware or software, compromising devices or systems before they reach the user.
Read full definitionTrezor Suite is a software interface for managing Trezor hardware wallets, allowing users to send, receive, and store cryptocurrencies securely.
Read full definitionA hardware wallet is a dedicated device that keeps private keys offline and signs transactions internally, so the keys never reach an internet-connected computer or phone.
A companion app is a software application used to manage and interact with cryptocurrency wallets or blockchain networks, typically offering features like transactions and security controls.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Supply chain) and the glossary terms that describe it.
Supply Chain Attacks on Hardware Wallets: How to Verify Your Device
Tampered packaging, modified firmware, fake devices — how to verify your hardware wallet is genuine and has not been compromised.
Read GuideHow to Verify Your Hardware Wallet Is Genuine
A tampered or fake hardware wallet can steal your funds. Use this quick checklist to confirm your device is genuine before you trust it with crypto.
Read GuideSupply Chain Attack
A supply chain attack targets vulnerabilities in the production or distribution process of crypto hardware or software, compromising devices or systems before they reach the user.
Tamper-Evident Design
Tamper-Evident Design refers to features on hardware devices that visibly show if they have been altered, ensuring the integrity and security of blockchain assets or data.
Cite this entry
WalletInsights. “Counterfeit Trezor Model T with modified bootloader and preset seeds”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/counterfeit-trezor-model-t-preset-seeds-2023/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.
All Trezor incidents
- Suspected implant in a Trezor Safe 5 sold by CryptoBilis
- Breach at shipping provider ShipMonk exposes data of up to 80,689 Trezor customers
- Laser fault injection bypasses firmware checks on Trezor Safe 7's TROPIC01 chip
- Ledger Donjon bypasses Trezor Safe 3 supply-chain protections
- EUCLEAK side channel in Infineon ECDSA library reaches Trezor Safe 3 and Safe 5 chip