Trezor Confirms Hardware Implants in Three Safe 5 Wallets Sold via Reseller

Three Trezor Safe 5 hardware wallets sold by a Southeast Asian reseller contained malicious circuit boards built to steal recovery phrases, the company has confirmed. The devices were bought from CryptoBilis between Aug. 20 and Sept. 23, 2026, through its Tokopedia and Shopee storefronts or directly from the reseller.

Firmware 2.13.1, released Nov. 11, stops the known implants from capturing anything. That is the good news. The caveat follows immediately: the update cannot protect a recovery phrase captured before installation.

How did the tampering come to light?

The case began in October, when a customer opened a Safe 5 bought from CryptoBilis and found an unauthorized board inside. Trezor examined that device in its laboratory. It then identified two additional tampered units from photographs sent by owners, out of 48 CryptoBilis customers who contacted the company.

Trezor found no tampering in devices from other regional resellers. It also found none in other Trezor models. No customer has reported losing funds. Those are the confirmed facts. Whether more implanted devices remain in circulation is a question the company's sampling cannot fully answer.

What does the implant actually do?

The extra board sits between the Safe 5's main board and its display. It copies whatever appears on screen. That single placement defeats the device's own security model, because the firmware and the Secure Element chip remain untouched, and the integrity checks therefore report nothing unusual.

When a user creates a wallet and views the backup words, or types them in during recovery, the implant stores them. It also records any passphrase displayed. The board encrypts the harvested data and transmits it over a mobile network to an attacker-controlled server, retrying until a connection succeeds.

Trezor said the design resembles implants found earlier in Ledger devices, adapted to the Safe 5's display. This is a known attack class, not a novel one. That cuts both ways: the technique is proven, and so is the defense.

What does the firmware fix change?

Firmware 2.13.1, released Nov. 11, "stops the implants we've found from capturing anything on devices that run it, making the current batch of implants useless," Trezor said. The statement is precise, and its limits deserve attention. It covers the implants Trezor has found. It does nothing for a seed phrase already captured and queued on an attacker's server.

Owners who bought from CryptoBilis should not rely on the patch alone. Trezor advises them to move their funds to a new wallet with a new recovery phrase. It also asks them to keep any suspicious device unused until support provides instructions. A patched device with a stolen seed is still a compromised device.

What is Trezor doing about its reseller channel?

The company is offering a replacement to every CryptoBilis buyer since March 2026, whether or not their device is confirmed compromised. That is a broad commitment. Trezor has not said how many wallets the program covers or what it will cost.

More consequential is the channel decision. Trezor has cut its reseller network by about 80%. The company called the dropped partners trustworthy, but said they fell short of new rules on how devices are sourced, stored and handled. It now advises buying directly from trezor.io.

The sequence matters. Three confirmed implants in one reseller's stock triggered an 80% reduction in the distribution network. That ratio suggests Trezor could not verify where the tampering occurred in the supply chain, or how far it might extend, so it removed the uncertainty instead of measuring it.

What remains unresolved?

No customer has reported lost funds as of the announcement. The implant's server, its operator, and the point in the supply chain where the boards were inserted all remain unidentified in Trezor's public statements. The company's replacement program and firmware patch address the devices it has seen, and its investigation continues to define what it has not.