🔍 Read the full analysis: Trezor Confirms Hidden Implants In Three Safe 5 Wallets: The Fix At A Glance on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Trezor says it confirmed hardware implants in three Safe 5 wallets bought through former reseller CryptoBilis. The implant can copy recovery words and passphrases displayed on the device and transmit them over a mobile network; firmware 2.13.1 blocks the identified implants, but cannot protect backups captured before installation of the update. Trezor says no owners have reported lost funds.
Trezor has confirmed hardware implants in three of its Safe 5 wallets, saying the devices were bought from former authorized reseller CryptoBilis and that the implant could copy recovery words and passphrases shown on the screen. The company says firmware 2.13.1 blocks the implants it has identified, but cannot protect information captured before the update was installed; it reports no customer losses so far.
Trezor said its laboratory examined one tampered Safe 5 after an owner reported finding an extra circuit board inside. The company also identified two more implanted devices from photographs supplied by owners. All three were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. They are three individual devices of the same model, not three different Trezor models.
According to Trezor’s analysis, the implant is a circuit board fitted between the wallet’s main board and its screen. It copies information displayed there, including recovery words during wallet setup or recovery and a passphrase if one appears. Trezor says the implant encrypts the captured information and sends it over a mobile network to a server controlled by the attackers. If it cannot connect, it stores the data and tries again later.
Trezor says the implant does not alter the device firmware or its Secure Element, the dedicated security chip. The company released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. It says the update prevents the implants it has found from capturing information on devices running that firmware. Trezor also says none of the three owners has reported losing funds, and that 48 CryptoBilis customers have come forward to have their devices checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why Screen Capture Threatens Wallet Backups
A hardware wallet is intended to keep the secret used to access funds separated from internet-connected devices. The reported implant targets information at the point where a user sees it on the wallet screen. That means recovery words or a passphrase could be exposed even if the device’s firmware and security chip remain unchanged, according to Trezor.
The update addresses future capture by the identified implants, but it cannot retrieve or invalidate information already copied. Trezor warns that firmware 2.13.1 cannot protect a backup captured before the update. That distinction matters to owners of affected devices: installing the software is not, by itself, a way to know whether information was previously taken or to undo that exposure.
The case also shows why the purchase channel is central to Trezor’s response. A genuine-looking device or software check may not reveal an added component that leaves the firmware and Secure Element untouched, according to the company’s description. Readers should distinguish that technical account from a broader conclusion: Trezor has confirmed three affected Safe 5s, not that all devices sold by CryptoBilis or all devices in the region were tampered with.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Vari Ergo Electric Standing Desk, 54×26, Light Wood/White
Samsung 27-Inch S3 FHD IPS Monitor, 120Hz
As an affiliate, we earn on qualifying purchases.
CryptoBilis Reports Prompted the Investigation
Trezor removed CryptoBilis from its reseller network on October 9, 2026. The company said the move followed reports involving Ledger customers who had bought wallets from the same Southeast Asian reseller. Ledger said on October 15 that some devices sold through CryptoBilis had been physically tampered with, describing the incident as “an attack on the distribution channel after the devices left our control.” That statement concerns Ledger devices; Trezor’s later findings relate to three Safe 5s.
On October 28, an Indonesian Trezor customer reported an extra circuit board in a Safe 5 bought through CryptoBilis on Tokopedia. Trezor warned customers on October 30 while it was still awaiting physical examination of the device. It said it acted on the report because waiting for laboratory confirmation could leave buyers exposed. The lab confirmation and identification of two additional devices followed on November 12.
Trezor says the other devices it has checked showed no evidence of tampering, and checks of devices from its other regional resellers found none. The company is working with SEAL 911, an emergency response service operated by the Security Alliance. It has also said it cut its reseller network by about 80%; the source material does not specify the exact period or method used to calculate that reduction.
““It only listens.””
— Trezor
How Many Buyers May Be Affected
The full number of affected devices remains unknown. Trezor has confirmed three Safe 5s and says 48 CryptoBilis customers have come forward, but the source material does not state how many of those devices have been examined or whether the confirmed three represent the complete extent of the tampering.
It is also unclear whether any captured recovery words or passphrases were accessed or used by the attackers. Trezor says none of the three owners has lost funds, but that does not establish whether information was transmitted or whether other customers’ devices are affected. The company has not provided details in the supplied material about the attackers’ identities, the server receiving the data, or how long the implants may have been operating.
Trezor’s statement that checked devices from other resellers showed no tampering is limited to those checks; it is not a finding that every device in the region has been inspected. The number of unexamined CryptoBilis devices and the results of ongoing checks are not specified.
Device Checks and Firmware Protection
Trezor says it is checking devices reported by CryptoBilis customers and coordinating with SEAL 911. Owners with devices from the reseller should follow Trezor’s current guidance and contact the company for instructions on device checks. The available source material does not give a detailed step-by-step process for identifying an implant, so users should not assume that a software or firmware check alone can rule out physical tampering.
Trezor says firmware 2.13.1 is available for the Safe 7, Safe 5, Safe 3 and Model T and blocks the implants it has identified on devices running it. That protection applies to future capture by the known implants; it does not recover information already copied. Further updates on the customer checks, the number of devices examined and any reported losses would clarify the scale of the incident.
Key Questions
How many Trezor wallets were confirmed to contain implants?
Trezor confirmed three individual Safe 5 devices. The company identified one after examining a reported device and two more from owner-submitted photographs.
What information could the implant capture?
According to Trezor, it copied information shown on the screen, including recovery words and any passphrase displayed. The company says the implant encrypted the data and sent it over a mobile network.
Does firmware 2.13.1 protect information already captured?
No. Trezor says the update blocks the implants it has identified from capturing information on devices running the firmware, but cannot protect a backup copied before installation.
Have customers reported losing funds?
Trezor says none of the three affected device owners has reported losing funds. It has not stated in the supplied material whether the captured information was accessed or used.
Where were the confirmed devices purchased?
Trezor says all three were bought from former authorized reseller CryptoBilis between August 20 and September 23, 2026, through its Tokopedia or Shopee stores or directly from the company.
Source: ThorstenMeyerAI.com
