🔍 Read the full analysis: How Trezor Is Responding To Hidden Implants In Safe 5 Wallets on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor says it confirmed hidden circuit-board implants in three Safe 5 wallets sold through former reseller CryptoBilis. The company says firmware 2.13.1 stops the implants it found from capturing screen data, but cannot protect recovery words collected before installation; no owners have reported losing funds.
Trezor has confirmed implants in three Safe 5 hardware wallets bought through former reseller CryptoBilis, saying the added circuit boards copied information displayed on the devices, including wallet recovery words. The company says its November 11 firmware update, version 2.13.1, stops the implants it found from capturing data on updated devices, but cannot undo any information collected before the update.
Trezor said its laboratory examined a Safe 5 after an Indonesian customer reported an extra circuit board on October 28. The company also identified two more affected devices from photographs provided by their owners. The three wallets were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor said CryptoBilis was removed from its reseller network on October 9.
According to Trezor’s analysis of the implant’s firmware, the board sits between the wallet’s main board and screen. It copies information shown on the display, including recovery words during wallet creation or restoration and a passphrase if one appears there. The implant encrypts the captured data and sends it over a mobile network to a server controlled by the attackers. If it cannot connect, Trezor says, it stores the data and retries later.
Trezor says the implant does not alter the wallet’s firmware or Secure Element, the dedicated security chip. The company released firmware 2.13.1 for the Safe 7, Safe 5, Safe 3 and Model T on November 11. It says the update prevents the implants it has found from capturing data on devices running the new firmware. Trezor reported that no owner of the three confirmed devices has reported losing funds; it said 48 CryptoBilis customers had come forward and their devices were being checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Recovery Words Were the Target
The case targets information that can provide access to a wallet, rather than relying on a change to the wallet’s software. If recovery words were captured, an attacker could potentially use them to restore a wallet elsewhere; a passphrase could also matter when one is used. Trezor has not said that any of the three owners’ funds were taken, and the reported outcome so far is no customer loss reported.
The implant’s placement also complicates routine checks. Trezor says the firmware and security chip remain unchanged, while the added board is placed in the screen’s connection path. That means a check of the software or security chip alone may not reveal this physical modification. This is an implication of the company’s description, not a separate finding attributed to Trezor. Its guidance emphasizes purchase source and device checks rather than a user test that can reliably rule out an implant.
The broader concern is the route a device takes before reaching a buyer. A wallet can leave its manufacturer’s control and pass through sellers or other distribution channels. In this case, Trezor says the affected units came through a reseller it later removed. The incident shows why buyers may need clear guidance on affected sales channels, whether their own device is implicated, and what steps to take if recovery information may have been exposed.
Popular right now
Roborock Qrevo S Pro Robot Vacuum and Mop, 18,500 Pa Suction
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Confirmation
Trezor’s investigation followed a report involving another hardware-wallet brand. According to Trezor, Ledger began investigating customer fund losses linked to wallets bought from CryptoBilis on October 9, 2026. Ledger, which had authorized the reseller in Southeast Asia, said on October 15 that it was dealing with “an attack on the distribution channel after the devices left our control” and confirmed that some devices had been physically tampered with.
CryptoBilis was also an authorized Trezor reseller. Trezor removed it from its network on October 9. After the Safe 5 customer reported an extra board on October 28, Trezor issued a warning on October 30, before its laboratory had examined the device. The company said it acted because waiting for lab confirmation would leave buyers exposed. Lab confirmation of the reported device, alongside the two additional cases identified from customer photos, came on November 12.
Trezor says every other device it has checked showed no evidence of tampering, and its checks of devices from other resellers in the region found none. The company is working with SEAL 911, the Security Alliance’s emergency response service. It also says it has reduced its reseller network by about 80%, though the source material does not specify when that reduction was completed or how the company calculated it.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
Exposure and Checks Still Ongoing
The confirmed count remains three individual Safe 5 devices, not three wallet models. Trezor says 48 CryptoBilis customers have come forward and their devices are being checked, but the available information does not establish how many of those checks are complete or whether further implanted units will be found. The company also says no other devices it checked showed tampering; that does not establish that every CryptoBilis sale or every device in the region has been examined.
It is not clear whether the implants captured recovery information from each of the three wallets, whether attackers accessed or used any captured data, or how many devices may have been altered overall. Trezor says no owner has reported losing funds, which describes reports received so far and does not establish what may happen later. The source material also does not describe a reliable inspection method available to ordinary users that would rule out the added board.
Firmware 2.13.1 is described as blocking the implants Trezor has found, not as erasing data already captured or as a guarantee against other forms of tampering. Anyone who believes recovery words may have been exposed should follow Trezor’s current official guidance; the supplied information does not set out a specific recovery procedure.
Device Reviews and Firmware Rollout
Trezor says it is checking devices brought forward by CryptoBilis customers and working with SEAL 911. Buyers should look for the company’s latest notices and confirm that their supported device is running firmware 2.13.1, released November 11 for the Safe 7, Safe 5, Safe 3 and Model T. The update addresses the implants Trezor identified, according to the company, but does not resolve possible exposure that occurred before installation.
The next clear indicators will be whether Trezor reports additional confirmed devices, completes more of the customer checks, or issues further advice about wallets purchased through CryptoBilis. The company has not provided a final count of potentially affected units or a date for completing its checks. Its current public findings therefore remain limited to three confirmed Safe 5s and the devices examined so far.
Key Questions
How many Trezor wallets have confirmed implants?
Trezor has confirmed three individual Safe 5 devices. It identified two through owner-submitted photographs and examined a third in its laboratory.
What information did the implant copy?
According to Trezor, it copied information displayed on the wallet screen, including recovery words during wallet backup or restoration and a passphrase if one appeared on the screen.
Does firmware 2.13.1 protect recovery words captured earlier?
No. Trezor says the update stops the implants it found from capturing data on updated devices, but cannot protect a backup captured before the update.
Have the owners reported losing funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not said whether captured information was accessed or used.
Were all CryptoBilis devices affected?
That is not known. Trezor confirmed three Safe 5s and said checks of 48 customers’ devices were underway. It has not given a final count of affected devices or completed checks.
Source: ThorstenMeyerAI.com
