Trezor confirmed that three Trezor Safe 5 wallets sold by Southeast Asian reseller CryptoBilis contained hardware implants that could steal recovery phrases. On November 11, the company released firmware version 2.13.1 to stop the implants from capturing new information. As of November 13, none of the affected owners had reported losing funds.
All three owners bought their wallets from CryptoBilis between August 20 and September 23, 2026. The investigation began in October, when a customer found an unexpected circuit board inside a wallet. Trezor examined that device in its laboratory and identified two more implants from photographs that other owners submitted.
How the implants captured wallet recovery words
The extra hardware monitored the wallet’s display while leaving its original firmware and security chip intact. It could record recovery words when an owner created a backup or restored a wallet. It could also capture passphrases that appeared on the screen.
The implants could send the captured information to the attackers over a mobile network. If a device lacked coverage, the implant retained the data and tried again later. That capability matters because anyone who obtains the necessary recovery phrase and passphrase can restore the wallet on another device.
The firmware update blocks future capture by the implants Trezor examined. However, any recovery words they recorded before installation may still be in the attackers’ possession. Trezor therefore advises customers who bought a wallet from CryptoBilis to move their cryptocurrency to a newly created wallet with a fresh recovery phrase.
Replacement offer extends beyond the three confirmed cases
Following the October warning, 48 CryptoBilis customers contacted Trezor. The company assessed devices through laboratory inspections or photographs of their internal components. It also inspected wallets from other resellers in the region and found no evidence of tampering. Its replacement offer covers anyone who bought a Trezor wallet from CryptoBilis from March 2026 onward, including owners whose devices showed no signs of an implant.
Trezor has also cut its global reseller network by about 80%. It first announced plans to reduce the network in October, after reports linked tampered Ledger wallets from CryptoBilis to cryptocurrency thefts. According to Trezor, the resellers it removed fell short of its stricter supply-chain requirements. The remaining partners must follow tighter rules on where they obtain wallets, how they store them and who can access them before sale.
0 responses to “Trezor Safe 5 update blocks implants found in three wallets”