TL;DR
Trezor says it found an extra circuit board in three Safe 5 wallets bought from former reseller CryptoBilis. The company says firmware 2.13.1 stops the implants it has found from capturing data, but cannot protect a recovery backup that was captured before the update. No customer fund losses have been reported to Trezor so far.
Trezor says three Safe 5 hardware wallets bought from former reseller CryptoBilis contained an extra circuit board that copied information displayed on the device screen, including recovery words when users created or restored a wallet. The company says firmware 2.13.1, released November 11, blocks the implants it has found from capturing data, but cannot protect a backup that may have been copied before the update.
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Trezor’s investigation found the circuit board fitted between the wallet’s main board and screen. The company says it copies what appears on the screen, including recovery words and a passphrase if one is displayed. It encrypts the captured information and sends it over a mobile network to a server controlled by the attackers. If it cannot connect, Trezor says, it stores the data and tries again later.
The devices were Safe 5 units bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor says the implant leaves the wallet’s firmware and Secure Element, its dedicated security chip, unchanged. The company described the device as one that “only listens.”
Trezor released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. Its changelog says the update stops the implants found so far from capturing information on devices running the firmware. Trezor says no customer has reported losing funds in connection with the three devices. It is checking devices belonging to 48 CryptoBilis customers who have come forward.
Why Earlier Backups Remain at Risk
The case highlights a limit of a software fix for a hardware compromise: an update may stop further capture by known implants, but it cannot retrieve information already copied. Trezor says a recovery backup captured before installation remains potentially exposed. That matters because recovery words can provide access to the wallet’s funds, while a displayed passphrase may add another piece of sensitive information.
Trezor’s advice to CryptoBilis buyers is to move funds to a new wallet using a new seed. The advice reflects the possibility that a backup was copied; it does not establish that any particular customer’s words were captured or that funds were taken. Readers should distinguish the company’s reported findings from evidence of actual losses: Trezor says none have been reported to it so far.
The incident also raises questions about the risks in the distribution chain for security devices. Trezor says it has cut its reseller network by about 80%. The company has not reported finding tampering in devices it checked from other regional resellers, but its published findings concern the devices examined to date.
Products Worth Considering
Ledger Flex Crypto Wallet with 2.8-Inch E Ink Touchscreen
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
Apple MacBook Pro 2026 14.2 Laptop with M5 Pro chip, 15‑core CPU, 16‑core GPU, 24 GB Unified Memory, 1 TB SSD, Wi‑Fi 7 – Silver
As an affiliate, we earn on qualifying purchases.
How the CryptoBilis Case Developed
The investigation followed reports involving another wallet maker. According to Trezor, Ledger began investigating customer fund losses involving CryptoBilis purchases on October 9. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger called the incident “an attack on the distribution channel after the devices left our control.” CryptoBilis was also an authorized Trezor reseller at the time; Trezor says it removed the company from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra circuit board inside a Safe 5 bought from CryptoBilis through Tokopedia. Trezor issued a warning on October 30 before it had examined the device in its lab. The company said waiting for lab confirmation could leave buyers exposed while the investigation continued.
By November 12, Trezor said its lab had examined the reported wallet and that owners had supplied photos identifying two more implanted Safe 5s. The three devices came from CryptoBilis’s Tokopedia and Shopee stores and direct sales. Trezor says its checks of other devices from regional resellers found no evidence of tampering. It is working with SEAL 911, the Security Alliance’s emergency response service.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
What Device Checks Have Established
Trezor has identified three implanted Safe 5 devices, but its account does not establish how many were modified or whether any other affected devices remain undiscovered. The company says 48 CryptoBilis customers have come forward and their devices are being checked. Its statement that no funds have been reported lost is limited to the reports it has received so far.
It is also not clear from the published findings whether each implant successfully transmitted captured data, or what information, if any, reached the attackers’ server. Trezor says the implant can store data when it cannot connect and retry later, but has not described what investigators recovered from the server. The company’s update blocks the implants found so far from capturing information on updated devices; the published material does not establish whether a modified device could contain a different implant design.
Checks Continue for CryptoBilis Buyers
Trezor says it is continuing to examine devices from the 48 CryptoBilis customers who have come forward and is working with SEAL 911. Buyers with a CryptoBilis device should follow Trezor’s guidance to move funds to a new wallet with a new seed, and should consult the company’s investigation update for current instructions. Installing firmware 2.13.1 addresses the implants Trezor has found so far, but does not reverse a possible earlier exposure.
Further updates could clarify whether additional devices were affected, what the ongoing checks find and whether investigators can determine if captured data was transmitted or used. For now, Trezor’s published findings cover three confirmed Safe 5 implants, with no customer fund losses reported to the company.
Key Questions
Which Trezor wallets contained implants?
Trezor says it found implants in three Safe 5 devices bought from CryptoBilis between August 20 and September 23, 2026. It has not reported finding implants in other models.
What information could the implant copy?
According to Trezor, it copied information displayed on the screen, including recovery words during wallet backup or restoration and a passphrase if one appeared. The company says the implant encrypted captured data and tried to send it over a mobile network.
Does firmware 2.13.1 protect a backup copied earlier?
No. Trezor says the update stops the implants it has found from capturing information on devices running the firmware, but cannot protect a backup that was captured before installation.
Have customers reported losing funds?
Trezor says no customer has reported losing funds in connection with the three devices so far. Its published account does not establish whether any captured information reached or was used by the attackers.
Source: Thorsten Meyer AI
