Trezor Confirms Hardware Implants in Three Safe 5 Wallets, Slashes Reseller Network

Trezor has confirmed malicious hardware implants in three Safe 5 hardware wallets sold through Southeast Asian reseller CryptoBilis. The compromised devices contained unauthorized circuit boards capable of capturing recovery phrases and transmitting them over mobile networks to attacker-controlled infrastructure.

The company disclosed the findings in a November 12, 2026 announcement. All three affected wallets were purchased between August 20 and September 23, either directly from CryptoBilis or through its Tokopedia and Shopee marketplace stores. Trezor said no customer has reported losing cryptocurrency through the identified implants.

In response, Trezor has cut its authorized reseller network by approximately 80%. The company also released emergency firmware on November 11 designed to block further data capture.

How did the attack work?

The investigation began after a customer reported a suspicious component inside a Trezor Safe 5 on October 28. Trezor treated the report as credible and issued a public warning on October 30, before completing laboratory work. Forty-eight CryptoBilis customers then contacted the company following the warning, submitting devices for physical examination or photographs of internal components. Trezor confirmed three affected devices: one examined directly in its laboratory and two identified through customer-submitted photographs.

According to Trezor's technical analysis, each implant consisted of an additional circuit board positioned between the device's main circuit board and its display. The components could capture:

• Recovery phrases entered during wallet creation or restoration
• Passphrases typed on the device

Captured information was encrypted and transmitted over mobile networks. The implants did not alter device firmware or the Secure Element, so conventional software integrity checks might not detect their presence.

On November 11, Trezor released firmware version 2.13.1. The update prevents the identified implants from capturing additional information but cannot invalidate recovery phrases potentially exposed before installation.

What must affected owners do?

Trezor instructed anyone who purchased a hardware wallet from CryptoBilis since March 2026 to move existing holdings into newly created wallets with completely new recovery phrases. Restoring an existing recovery phrase onto another hardware wallet does not eliminate risk if attackers already hold that phrase.

Customers who have not initialized devices should avoid setting them up or entering existing recovery information. Trezor is offering replacement devices to eligible CryptoBilis customers, with alternative models or refunds where shipping restrictions prevent direct replacement. Affected customers should retain original devices and contact Trezor through its official support website.

For customers who bought through other distributors, Trezor has identified no confirmed cases requiring comparable emergency migration. The company warned that criminals may exploit the incident through fraudulent replacement offers and phishing messages.

Why did Trezor cut 80% of its resellers?

Trezor said the reduction was precautionary and does not indicate the removed businesses were compromised. Remaining distributors must now satisfy stronger supply-chain security requirements covering product storage, handling and distribution. The company's investigation has found no evidence of tampering in other Trezor models or devices from other resellers, though the inquiry remains ongoing.

The case exposes a structural limitation of hardware wallet security: even when private keys stay protected inside dedicated security chips, compromised physical components can expose recovery information before a transaction is ever authorized. Customers who purchased from CryptoBilis since March face the cost of a full wallet migration, while Trezor's shrunken reseller network will test whether tighter supply-chain controls can prevent a repeat.