TL;DR
Trezor confirmed that three Safe 5 wallets bought from reseller CryptoBilis contained extra circuit boards that copied information displayed on the device, including recovery words when shown. Firmware 2.13.1, released November 11, stops the implants Trezor has found from capturing data on updated devices, but cannot protect a backup captured earlier. Trezor says no affected owner has reported losing funds.
Trezor says it confirmed extra circuit boards in three Safe 5 wallets bought from CryptoBilis, a Southeast Asian reseller the company removed from its network on October 9. According to Trezor, the boards copied information shown on the devices, including recovery words during wallet backup or restoration; firmware 2.13.1, released November 11, blocks the implants it has found from capturing data on devices running the update. Trezor says no affected owner has reported losing funds, but the update cannot protect recovery information that may have been captured before installation.
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Trezor’s November 12 investigation report says its lab examined one Safe 5 after an owner reported an extra board. The company identified two more implanted devices from photographs provided by their owners. The three wallets were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor says the finding applies to three individual Safe 5 devices, not three different wallet models.
The additional board was fitted between the device’s main board and its screen. Trezor’s analysis says it copied information displayed on the screen, including recovery words when a backup was created or restored and a passphrase if one appeared. The implant encrypted the captured data and sent it over a mobile network to a server controlled by the attackers, according to the company. If it could not connect, it retained the data and retried later.
Trezor says the implant did not modify the wallet’s firmware or its Secure Element, the device’s security chip. The company released firmware 2.13.1 on November 11 for Safe 7, Safe 5, Safe 3 and Model T. It says the release stops the implants found so far from capturing anything on updated devices. However, Trezor cautions that installing the update cannot protect a backup captured earlier. The company says 48 CryptoBilis customers have come forward and that their devices are being checked.
Why a Captured Recovery Phrase Matters
A wallet’s recovery words can provide access to the funds associated with that wallet. If an attacker captured a user’s words, a firmware update on the device cannot make the copied information secret again. That is why Trezor’s advice to CryptoBilis buyers is to move funds to a new wallet with a new seed, rather than rely on the software fix alone.
The case also shows how a security problem can enter through the supply chain. Trezor says the extra board operated by observing the screen, while the device’s firmware and Secure Element remained unchanged. That distinction matters for buyers assessing what the company found: the reported issue involved physical tampering with the device, rather than a confirmed flaw in the wallet’s standard firmware or security chip.
The potential consequences are serious because recovery information can control funds, but the reported impact remains limited to the findings Trezor has disclosed. The company says no customer has reported a loss so far, and its checks found no evidence of tampering in other devices it examined. Those statements describe the investigation to date; they do not establish whether every CryptoBilis device has been checked.
Products Worth Considering
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, White Silver
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 24GB Memory, 1TB SSD, Wi-Fi 7, Space Black
As an affiliate, we earn on qualifying purchases.
How the CryptoBilis Case Developed
Trezor’s investigation followed reports involving another hardware wallet brand sold through the same reseller. According to Trezor’s account, Ledger began investigating customer fund losses linked to devices bought from CryptoBilis on October 9. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.”
CryptoBilis was also an authorized Trezor reseller. Trezor says it removed the company from its reseller network on October 9. On October 28, a Trezor customer in Indonesia reported an extra board in a Safe 5 bought from CryptoBilis in August through Tokopedia. Trezor had not yet examined the device, but issued a customer warning on October 30 while it investigated.
Trezor said it acted before lab confirmation because it did not want buyers to remain exposed while testing continued. The company’s lab later examined the reported wallet, and owners supplied photographs that led it to identify two further implanted Safe 5s. Trezor says it has found no evidence of tampering in the other devices it checked, including devices from its other regional resellers. It is working with SEAL 911, the Security Alliance’s emergency response service.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
What Checks Have Yet to Establish
Trezor has confirmed three implanted Safe 5 wallets, but its published account does not establish how many devices in total may have been affected or whether every CryptoBilis customer has been reached. The company says 48 buyers have come forward and their devices are being checked. It has not reported a final result for those checks.
The company has also not disclosed the identities of the attackers, how the extra boards were installed, or whether any captured data was accessed or used. Trezor says the implant sent encrypted data to a server controlled by the attackers, but its public account does not specify how much information was transmitted or what happened to it afterward. No reported fund losses is the status Trezor has given so far, not a guarantee that no data was captured.
The number of confirmed devices is a raw count. Trezor’s materials do not provide a baseline or a total number of CryptoBilis devices sold that would support a rate or comparison. The company says checks of other resellers in the region found no tampering, but the scope and final results of all ongoing checks remain unclear.
Buyer Checks and Seed Changes
Trezor says it is checking devices belonging to CryptoBilis customers who have come forward and is coordinating with SEAL 911. Buyers who obtained a Safe 5 through CryptoBilis should follow Trezor’s published guidance: move funds to a new wallet using a new seed. A new wallet backup should be created on a device the buyer trusts; reusing recovery words that may have been displayed on an implanted device would not address a possible earlier capture.
Owners should also install firmware 2.13.1 on supported devices, according to Trezor’s update guidance. The company says the firmware blocks the implants identified in its investigation from capturing data on updated wallets. Its stated limit remains relevant: the update does not undo an earlier capture. Buyers who suspect their device came from CryptoBilis can contact Trezor for the company’s checks and instructions.
The next public developments are likely to include results from the checks of the 48 customers who have come forward and any further findings about affected devices or captured data. Trezor has not stated when those checks will be complete. Until it provides more information, the number of affected wallets beyond the three confirmed and whether any captured information was misused remain open questions.
Key Questions
How many Trezor wallets did the company confirm were implanted?
Trezor confirmed implants in three Safe 5 devices bought from CryptoBilis between August 20 and September 23, 2026.
What information did the implant copy?
According to Trezor, the extra board copied information shown on the screen, including recovery words during backup or restoration and a passphrase if one appeared.
Does firmware 2.13.1 protect a recovery phrase already captured?
No. Trezor says the update blocks the implants it has found from capturing data on updated devices, but cannot protect a backup captured before installation.
Have customers reported losing funds?
Trezor says no owner of the three confirmed devices has reported losing funds. That is the company’s reported status so far; its checks of other CryptoBilis customers are ongoing.
What should a CryptoBilis buyer do?
Trezor advises CryptoBilis buyers to move funds to a new wallet with a new seed and install the firmware update on supported devices. Buyers can contact Trezor for checks and instructions.
Source: Thorsten Meyer AI
