Trezor Finds Implants in Three Safe 5 Wallets, Cuts Reseller Network 80%
Trezor disclosed on November 12 that three Safe 5 hardware wallets sold through reseller CryptoBilis contained hidden cellular circuit boards, and that it cut its reseller network by roughly 80%. Firmware 2.13.1, released a day earlier, is designed to stop the implants from capturing recovery words, but Trezor says affected users should still move funds to a new wallet with a new seed.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Three Confirmed Implants
Trezor has confirmed that three Safe 5 hardware wallets were physically tampered with before reaching customers, according to its November 12 investigation update. Each device carried an extra circuit board with a cellular module and antenna, placed between the main board and the screen. The devices were sold through CryptoBilis, a Southeast Asian reseller, between August 20 and September 23, 2026.
Source counts differ on how the confirmations were made. Crypto Briefing reports that Trezor examined one affected unit in its laboratory and relied on photographs for the other two. Crypto.news reports the same split, noting that the first device was examined in Trezor's lab and the other two were identified from photographs supplied by owners. Both reports say 48 devices were inspected in total, with only three found to carry implants.
Scope and Sales Channel
Trezor says its wider investigation found no tampering in any other Safe 5 units or in devices from other resellers in the region, and found no implant in any other Trezor model. The company describes the breach as confined to the CryptoBilis sales channel rather than its own manufacturing line. Crypto.news adds that the three devices were bought through CryptoBilis's Tokopedia and Shopee stores or directly from the reseller, and that Trezor has heard from 48 CryptoBilis buyers since its October appeal.
How the Implant Worked
According to Trezor's embedded engineering team, which extracted and analyzed the implant's firmware, the device sat between the Safe 5's main board and screen and copied information displayed on the screen without altering the wallet's own firmware or Secure Element. It recognized recovery words shown during backup creation and during wallet restoration, and could capture passphrases shown the same way. Captured data was encrypted and sent over a mobile network to an attacker-controlled server, with retries when no connection was available.
Firmware Fix and Customer Guidance
Firmware version 2.13.1 shipped on November 11. Trezor says the update stops the implant from capturing information on devices running it. Crypto.news explains that engineers changed the order of commands sent to the display so that the implant's trigger sequence no longer fires. Trezor has not reported any customer financial losses.
Trezor's guidance for CryptoBilis buyers did not change with the update. The company says those customers should still move funds to a newly created wallet with a new seed phrase, because recovery words captured before installation could already be exposed. Earlier advice told customers not to import an old recovery phrase into another wallet, and not to set up a device bought from CryptoBilis or enter an existing backup on it.
Reseller Network Overhaul and Timeline
Trezor removed CryptoBilis as an authorized reseller on October 9, 2026, after reports of tampered Ledger wallets sold through the same business. The investigation that followed began with a responsible disclosure on October 28, flagging a Safe 5 bought in August from Tokopedia. Trezor issued its first warning about a suspected Trezor implant on October 30.
Trezor has also cut its authorized reseller network by approximately 80%. Crypto.news reports that the removed resellers were trustworthy and posed no immediate threat, but did not meet stricter handling requirements now applied to remaining partners covering how devices are sourced, stored, and accessed.
Why It Matters
For Traders
Holders of Safe 5 units bought from CryptoBilis face a near-term need to migrate funds, which may matter for any position tied to Trezor-related custody flows.
For Investors
The breach is confined to one reseller channel and Trezor reports no losses, but the 80% network cut signals a tighter, costlier distribution model for hardware wallet vendors.
For Builders
The implant defeated trust in the display path, so teams shipping hardware signing flows should audit how sensitive seed words are rendered and whether command ordering can be exploited.
This article is for information only and is not financial advice. Read the full disclaimer.
