TL;DR
Trezor confirmed that three Safe 5 hardware wallets sold by reseller CryptoBilis contained extra circuit boards that copied recovery words shown on the screen and transmitted the data over a mobile network. The company says firmware 2.13.1 blocks the implants it has found, but cannot protect a backup captured before the update; no losses have been reported so far.
Trezor confirmed on November 12 that three of its Safe 5 hardware wallets bought from reseller CryptoBilis contained an extra circuit board that copied information displayed on the device, including recovery words. Trezor says firmware 2.13.1, released the previous day, stops the implants it has found from capturing data, but cannot protect wallet backups recorded before the update.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Trezor says the implant was fitted between the Safe 5’s main board and screen. Its analysis found that the board copied screen contents, including recovery words shown while creating or restoring a wallet and any passphrase displayed. The captured information was encrypted and sent over a mobile network to a server controlled by the attackers. If it could not connect, the implant stored the data and tried again later, according to the company.
The devices were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores and directly from the reseller. Trezor said its lab examined one device reported by a customer and identified two more implanted devices from photographs supplied by their owners. The company says the implant did not alter the wallet’s firmware or its Secure Element, a dedicated security chip.
Trezor released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. It says the update blocks the implants found so far from capturing information on devices running the new firmware. Trezor also says no customers have reported losing funds. Forty-eight CryptoBilis customers have come forward, and their devices are being checked.
Why a Captured Recovery Phrase Matters
A wallet’s recovery words can allow someone to restore access to its funds from another device. Trezor’s findings describe a supply-chain risk: a device can be altered before it reaches a buyer, so the screen and the wallet’s normal software may not reveal the full problem. The company’s account says the implant copied information shown on the screen while leaving the firmware and security chip unchanged.
The firmware update addresses future capture by the implants Trezor has identified, but it cannot reverse a previous exposure. Trezor advises CryptoBilis buyers to move funds to a new wallet with a new seed. That advice reflects the difference between updating a device and replacing credentials that may already have been copied.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Apple MacBook Pro 16-inch (2021), M1 Pro, 10-core CPU, 16-core GPU, 16GB RAM, 512GB SSD, Silver
Logitech MX Vertical Wireless Ergonomic Mouse
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
Trezor removed CryptoBilis from its reseller network on October 9, 2026, after Ledger began investigating customer fund losses among people who had bought hardware wallets from the same Southeast Asian reseller. Ledger later said some of its devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” Those findings concern Ledger devices and do not establish that Trezor customers lost funds.
On October 28, a Trezor customer in Indonesia reported an extra circuit board in a Safe 5 bought from CryptoBilis through Tokopedia. Trezor warned customers on October 30, before it had examined the device, saying it did not want buyers to remain exposed while waiting for lab confirmation. The company confirmed the implants after its examination and review of photographs on November 12. It says devices checked from other resellers in the region showed no evidence of tampering, and it is working with SEAL 911, an emergency response service run by the Security Alliance.
““It only listens.””
— Trezor
Scope of Exposure Still Under Review
The total number of affected devices is not yet known. Trezor has confirmed three implanted Safe 5 wallets and says it is checking devices belonging to 48 CryptoBilis customers who came forward. Its report does not establish whether additional implanted units were sold or whether captured data was accessed or used.
Trezor says no customer has reported losing funds so far, but that does not establish whether recovery words were copied from every affected device or whether any captured information was used. The company’s findings about devices from other regional resellers apply to the units it checked; the scale and full history of the tampering remain under investigation.
Checks and Wallet Updates Continue
Trezor says it is checking devices from customers who contact the company and cooperating with SEAL 911. Owners of CryptoBilis devices should follow Trezor’s guidance to move funds to a new wallet with a newly generated seed; installing firmware 2.13.1 alone cannot undo a prior capture. The company has also said it cut its reseller network by about 80%, though the reported material does not explain the full criteria or timing for those changes.
The next meaningful updates are likely to be the results of customer device checks and any new information about the number of implants or use of captured data. Trezor has not reported a final total or described a confirmed loss of funds tied to the three devices.
Key Questions
How many Trezor wallets were confirmed to contain implants?
Trezor confirmed three Safe 5 devices. They were three individual wallets of the same model, not three different models.
What information did the implant copy?
According to Trezor, it copied content displayed on the screen, including recovery words during wallet creation or restoration and a passphrase if one appeared.
Does firmware 2.13.1 protect an exposed recovery phrase?
Trezor says the update blocks the implants it has found from capturing information on updated devices. It cannot protect a backup that may have been captured before installation.
Have customers reported losing funds?
Trezor says no customer has reported losing funds in connection with the confirmed devices. The company is checking devices from 48 CryptoBilis customers who have come forward.
Source: Thorsten Meyer AI
![Stalking The Wily Hacker: 40 Years Later – Cliff Stoll [Video]](https://cipherdot.com/wp-content/uploads/2026/08/stalking-the-wily-hacker-40-years-later-cliff-stoll-video-featured-560x300.jpg)
