Trezor: separate device provenance from secret recovery
A custody procedure must track the equipment and the authority it represents. This analysis proposes an acceptance record with owners, provenance evidence and decisions about the secrets involved.
Ler em portuguêsBy Pentesty
The confirmed finding and the correction’s limit
In Trezor’s official investigation, three Safe 5 devices sold by CryptoBilis contained physical implants. The manufacturer says firmware 2.13.1 blocks the identified implants but cannot protect secrets captured earlier; the owners of those three devices reported no lost funds.
Pentesty’s operational recommendation is to keep two decisions in the ticket: whether the equipment can be used and whether signing authority can be trusted. The owner should state the evidence supporting each decision and the questions still open. A supplier’s publication is one input to that assessment, with its scope and access date recorded.
Reconstruct acquisition without circulating sensitive information
Procurement, security and the custody owner should assemble the order, seller, purchase channel, receiving record and device identifiers. Preserve the documents in a restricted repository. Use internal references in shared tickets and record who can access the originals. Do not include copies of recovery words or other secrets.
Map every device to its role: routine approval, reserve, testing or recovery. Ask who possessed it, where it was stored and when responsibility changed. Mark any unproven part of that chain as unknown. Filling a mandatory field with an assumption makes the later decision harder to defend.
Prepare the decision before carrying out a change
Define who can suspend use and who authorizes recovery. Describe dependencies, participants, the approved environment and the condition for stopping the procedure. Use a synthetic exercise to check the approval workflow, avoiding tests with production secrets or assets. Record the expected outcome before execution.
The procedure should provide for communication through an independent channel already known to the company. An unexpected message should not authorize connecting equipment, installing software or disclosing information. Support contact must follow official channels and internal access rules. Urgent instructions received by telephone must also follow the agreed approval process.
Keep distinct evidence for distinct decisions
Create a record naming three owners: the person checking provenance, the person accepting the technical procedure and the person authorizing the business operation. Attach document identifiers, timestamps and observed results. Keep sensitive details in the appropriate system, including only what the decision reviewer needs in the report.
Write an observable acceptance condition for every step. Inventory must identify the right device; approval must match the procedure performed; resumption must follow the authorized limits. A step without evidence remains pending. The analysis of keys and trust recovery develops the question of who accepts a change in authority.
Close the ticket with a decision that can be revisited
Acceptance should record what resumed, who approved it and when the decision will be reviewed. Include the investigation’s limitations and the person responsible for receiving updates. New information about provenance or exposure must lead to a retrievable ticket with owners able to reconsider the decision.
The article on Trezor, ShipMonk and data deletion addresses a separate event and a different operational obligation. It supports discussion of supplier evidence but does not establish a device’s condition. Preserve that distinction when bringing incidents and contracts into a shared dashboard.
Frequently asked questions
Who should approve resumption?
Name a technical owner and a business owner. Acceptance should identify the evidence examined and the approved limits of use.
Should the report include secrets?
Use internal references and verification results. Keep secrets out of shared tickets and reports, and restrict access to custody records.
How should an unknown provenance step be handled?
Record the gap and its owner. The decision should explain the effect of that uncertainty and the condition for reassessment.
Must assets move to test the procedure?
Start with an authorized exercise using synthetic resources. Any production decision belongs to the custody owners and must follow approved procedures.
Sources and references
Original Pentesty analysis, published November 13, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.