TL;DR
Trezor says it confirmed implants in three Safe 5 hardware wallets bought through former reseller CryptoBilis. The extra circuit boards copied information displayed on the screen and sent it over a mobile network, according to the company. Firmware released November 11 blocks the implants Trezor has found, but cannot protect recovery words already captured; Trezor says no affected owner has reported losing funds.
Trezor says it confirmed implants in three Safe 5 hardware wallets sold through CryptoBilis, a Southeast Asian reseller the company removed from its network on October 9. The extra circuit boards copied information shown on the wallets’ screens, including recovery words during setup or restoration, and transmitted the captured data over a mobile network, according to Trezor. The company says a firmware update released November 11 blocks the implants it has found, but cannot protect information captured before installation.
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Trezor’s lab examined one device reported by a customer and identified two more implanted wallets based on photographs provided by their owners. The three Safe 5s were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor says the implant was an extra circuit board fitted between the main board and the screen. The finding concerns three individual devices of one model.
According to Trezor’s analysis, the board copied what appeared on the screen, including recovery words when a wallet backup was created or restored and a passphrase if one was displayed. It encrypted the captured information and sent it over a mobile network to a server controlled by the attackers, the company said. If it could not connect, it retained the data and tried again later. Trezor says the device firmware and Secure Element, its dedicated security chip, were not altered.
Trezor released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. The company says the update prevents the implants identified so far from capturing information on updated devices. It also says no owner of the three devices has reported losing funds. Forty-eight CryptoBilis customers have come forward, and their devices are being checked. Trezor says other devices it examined, including devices from other regional resellers, showed no evidence of tampering.
Recovery Words Can Outlast the Fix
A hardware wallet’s security depends in part on keeping its recovery words private: someone who obtains those words may be able to restore the wallet elsewhere. Trezor’s account describes a supply chain attack in which a device could copy information shown on its screen even though its firmware and Secure Element remained unchanged. The reported method matters because buyers may regard a device as safe based on its brand while having limited ability to inspect its internal components.
The firmware update addresses the implants Trezor has identified, but it cannot retrieve or invalidate a recovery phrase that may already have been copied. Trezor advises CryptoBilis buyers to move funds to a new wallet using a new seed. That advice reflects the specific risk the company describes; the report does not establish that every CryptoBilis device was tampered with or that captured data was used to access funds.
The case also affects confidence in reseller controls. Trezor says it has cut its reseller network by about 80 percent. That figure signals a substantial change in distribution, though the company’s source material does not detail how the reduction was calculated or what oversight measures will replace the former network.
Products Worth Considering
Apple MacBook Pro 2026 14.2 Laptop with M5 Pro chip, 15‑core CPU, 16‑core GPU, 24 GB Unified Memory, 1 TB SSD, Wi‑Fi 7 – Silver
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Finding
The investigation began amid reports involving another hardware wallet brand. Trezor says Ledger began investigating customer fund losses linked to wallets bought from CryptoBilis on October 9. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis was also an authorized Trezor reseller; Trezor says it removed the company on October 9.
On October 28, a Trezor customer in Indonesia reported an extra circuit board inside a Safe 5 bought from CryptoBilis through Tokopedia. Trezor says it treated the report as credible before its lab had examined the device and warned customers on October 30. The company said it did so because waiting for lab confirmation would leave buyers exposed. Its November 12 update reported the lab confirmation and two further devices identified from owner-submitted photographs.
Trezor says it is working with SEAL 911, the Security Alliance’s emergency response service. The company’s account of the investigation and the firmware changelog are the cited sources for the findings and update details.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor, on firmware 2.13.1
Scope and Data Use Remain Unknown
The confirmed count is three implanted Safe 5 devices; Trezor has not said that all wallets sold by CryptoBilis were altered. Forty-eight customers have come forward for checks, but the supplied information does not state how many devices have been examined or when those checks will finish. Trezor says no tampering was found in the other devices it checked, including devices from other regional resellers.
The company has not reported evidence that the captured screen data was used to access funds. It says no owner of the three identified devices has reported losses, but that does not establish whether any data was transmitted, stored, or accessed by attackers. Details about the server, the attackers’ identities, and the total number of potentially affected devices have not been provided in the cited material.
Customer Checks and Wallet Updates
Trezor says it is checking devices from customers who came forward and working with SEAL 911. Owners of supported devices can install firmware 2.13.1, which the company says blocks the implants found so far. For buyers from CryptoBilis, Trezor’s stated advice is to move funds to a new wallet with a new seed, because an update cannot protect a backup that was captured earlier. The company has not specified a completion date for customer checks or announced further findings.
Key Questions
How many Trezor wallets were confirmed to contain implants?
Trezor says it confirmed implants in three Safe 5 devices bought through CryptoBilis between August 20 and September 23, 2026.
What information did the implant copy?
According to Trezor, it copied information shown on the device screen, including recovery words during wallet setup or restoration and a passphrase if one appeared.
Does firmware 2.13.1 protect recovery words captured earlier?
No. Trezor says the update blocks the implants it has found from capturing information on updated devices, but cannot protect a backup captured before installation.
Have the affected owners lost funds?
Trezor says none of the owners of the three identified devices has reported losing funds. The company has not said whether captured data was transmitted or accessed.
Source: Thorsten Meyer AI
