TL;DR
Trezor confirmed that three Safe 5 wallets bought through CryptoBilis contained an extra circuit board that copied information displayed on the screen, including recovery words. The company says firmware 2.13.1 blocks the implants it has found from capturing information, but cannot protect a backup captured before installation; no customer losses have been reported to Trezor.
Trezor says three Safe 5 hardware wallets bought from former reseller CryptoBilis contained an extra circuit board that copied information displayed on the device screen, including recovery words. The company released firmware 2.13.1 on November 11, which it says stops the implants found so far from capturing information, but the update cannot protect recovery data that may have been captured earlier.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Trezor’s investigation found the extra board fitted between the main board and the screen. The company says it copied what appeared on the screen when users created or restored a wallet backup, including recovery words and a passphrase if one was displayed. The implant encrypted the captured information and sent it over a mobile network to a server controlled by the attackers. If it could not connect, it retained the data and tried again later, according to Trezor.
The affected devices were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor says its lab examined one device reported by a customer and identified two more implanted Safe 5s from photos their owners supplied. The company says the implant left the wallet firmware and Secure Element, its dedicated security chip, unchanged.
Trezor released firmware 2.13.1 for the Safe 7, Safe 5, Safe 3 and Model T. It says the update prevents the implants it has found from capturing information on updated devices. Trezor reports that no customer has told it they lost funds in this case. It says 48 CryptoBilis customers have come forward and their devices are being checked.
Why Captured Recovery Words Matter
A recovery phrase can give someone control over the wallet it backs up. Trezor’s description of the implant therefore points to a risk that persists beyond the device itself: if a phrase was recorded before the update, installing new firmware does not make that phrase secret again. The company’s warning distinguishes between stopping further collection and addressing information that may already have been taken.
Trezor advises CryptoBilis buyers to move funds to a new wallet with a new seed. That advice applies even though Trezor says it has received no reports of customer losses. The company has not said that all CryptoBilis devices are compromised; its confirmed finding concerns three Safe 5 units, while checks of other devices have not shown evidence of tampering so far.
The case also highlights the security role of distribution. A hardware wallet may leave its maker’s control before reaching a buyer, and physical changes made during that period can be difficult for customers to detect. Trezor says it has cut its reseller network by about 80 percent, a change it links to the investigation. The source material does not provide further detail on how the new network will be monitored.
Products Worth Considering
Samsung 37-inch Odyssey G7 4K UHD Curved Gaming Monitor
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
LG UltraGear 45GX950A-B 45-Inch 5K2K Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From CryptoBilis Warning to Confirmation
The investigation followed reports involving another wallet brand. According to Trezor, on October 9 Ledger began investigating fund losses among customers who bought hardware wallets from CryptoBilis, then an authorized Ledger reseller in Southeast Asia. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger described the case as “an attack on the distribution channel after the devices left our control.” Trezor also removed CryptoBilis from its reseller network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra board inside a Safe 5 bought from CryptoBilis through Tokopedia. Trezor said it treated the disclosure as credible before it had examined the device and warned customers on October 30. The company said it did not want buyers to remain exposed while awaiting laboratory confirmation. Its November 12 investigation update confirmed the implant in three devices.
Trezor says the other devices it has checked showed no signs of tampering, and that checks of devices from other resellers in the region found none. It is working with SEAL 911, an emergency response service run by the Security Alliance. Those findings describe the checks conducted to date; the source material does not give a total number of devices examined.
““It only listens.””
— Trezor
Scope of the Device Checks
The confirmed finding covers three individual Safe 5 wallets, not three different wallet models. Trezor has not said how many CryptoBilis devices it has examined overall, how many remain to be checked, or whether it has identified the people responsible. The company says 48 customers have come forward, but that figure is not a count of confirmed implanted devices.
It is also not clear whether any recovery phrases were captured from the three wallets. Trezor says no owners have reported losing funds, which does not establish whether data was collected or whether it could be used. The company’s account says the implant could retain captured data when offline and retry transmission, but the source material does not say whether investigators recovered data from the attackers’ server.
Trezor says its checks have not found tampering in other devices examined, including devices from other regional resellers. The scale and methods of those checks are not specified, so their results should be read as the company’s findings to date.
Device Reviews and Buyer Guidance
Trezor says it is checking devices from customers who have come forward and is working with SEAL 911. Buyers who obtained a wallet from CryptoBilis should follow the company’s guidance: move funds to a new wallet backed by a new recovery seed. Anyone with an affected device should consult Trezor’s current instructions rather than assume a firmware update reverses any earlier capture.
Firmware 2.13.1 is available for four listed Trezor models. Trezor says it blocks the implants found so far from capturing information on devices running the update. The company has not described a date for completing the customer device checks or provided a further update schedule. The investigation’s next public developments may clarify how many devices were examined and whether investigators found evidence that captured information was transmitted or accessed.
Key Questions
How many Trezor wallets did the investigation confirm were implanted?
Trezor confirmed three Safe 5 devices. They were bought through CryptoBilis between August 20 and September 23, 2026.
What information could the implant copy?
Trezor says it copied information shown on the screen, including recovery words when a wallet was backed up or restored, and a passphrase if one appeared there.
Does firmware 2.13.1 protect a recovery phrase already captured?
No. Trezor says the update stops the implants it has found from capturing information on updated devices, but cannot protect a backup captured before the update.
Have customers reported losing funds?
Trezor says no customer has reported losing funds in this case so far. It has not said whether any recovery phrases were captured or transmitted.
Source: Thorsten Meyer AI
