Trezor has confirmed that three Safe 5 hardware wallets sold through former reseller CryptoBilis contained hidden circuit-board implants designed to capture recovery phrases and send them over a mobile network.
The company said all three devices were purchased between August 20 and September 23, 2026, and none of their owners has reported losing funds.
The confirmation follows Trezor’s October 30 warning to CryptoBilis buyers, issued after an Indonesian customer reported a suspected implant. In a November 12 investigation update, Trezor said 48 buyers have contacted the company since then. Its lab examined one affected wallet, while the other two were identified from photos supplied by their owners. The company said it has found no evidence of tampering in devices from other resellers or in other Trezor models.
Trezor’s analysis found an extra circuit board fitted between the Safe 5’s main board and screen. The implant copies information displayed on the wallet, including recovery words shown during backup creation or entered when restoring an existing wallet. It also captures passphrases displayed on the screen, encrypts the data and sends it to an attacker-controlled server over a cellular connection. If the connection fails, it stores the captured information and retries later.
Trezor released firmware 2.13.1 on November 11, saying the update stops the implants found so far from capturing information on updated devices. The company warned that the update cannot protect a recovery phrase captured before installation. Trezor also said it had cut its reseller network by about 80% and tightened requirements for the remaining partners. Its investigation remains ongoing. The firmware changelog lists version 2.13.1 for the Safe 5 and other supported models.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
