🔍 Read the full analysis: The Hidden Implant Issue In Trezor Safe 5 Wallets, Explained on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Trezor says it confirmed implants in three Safe 5 hardware wallets purchased through CryptoBilis, a reseller it removed from its network on October 9, 2026. The implants copied recovery words and passphrases displayed on the devices and transmitted them over a mobile network; firmware 2.13.1 blocks the identified implants, but cannot undo prior captures. Trezor says no affected owner has reported losing funds, and it is checking devices from customers who have come forward.
Trezor said its lab examined a Safe 5 after a customer in Indonesia reported an extra board inside a device bought from CryptoBilis in August. The company confirmed the implant on November 12 and identified two more affected Safe 5s from photos sent by their owners. All three were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. The count refers to three individual Safe 5 devices, not three different wallet models.
According to Trezor’s analysis, the implant sits between the wallet’s main circuit board and its screen. It copies information displayed there, including recovery words when a wallet backup is created or an existing wallet is restored, and a passphrase if one appears. The implant encrypts the captured information and sends it over a mobile network to a server controlled by the attackers; if it cannot connect, Trezor says, it stores the data and tries again later.
Trezor says the implant does not alter the wallet’s firmware or Secure Element, its dedicated security chip. The company released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T, saying the update stops the implants found so far from capturing information on devices running the new version. That protection does not recover or secure a backup already copied. Trezor says 48 CryptoBilis customers have come forward and their devices are being checked; it reports no customer losses so far.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
A Compromised Screen Changes the Risk
The case targets a point hardware-wallet owners rely on for security: the device’s own screen. Wallet users commonly check transaction details or enter recovery information on the device rather than trusting a connected computer. Here, according to Trezor, the implant was positioned to observe what the screen displayed. That means an unchanged firmware version or Secure Element does not, by itself, rule out this type of physical tampering.
The immediate concern is any recovery phrase or passphrase captured before the update. Firmware 2.13.1 may stop the identified implants from collecting more information, but it cannot make previously copied secrets private again. Trezor’s account does not confirm that attackers used any captured information or accessed funds. The company says affected owners have not reported losses, a status update that is not proof that no information was transmitted or retained.
The incident also highlights the risk of buying security hardware through distribution channels that may be harder for the manufacturer to monitor after products leave its control. Trezor says it has cut its reseller network by about 80%. The figure describes a change to its network, not a measure of affected devices or customer losses.
Popular right now
Dyson V8 Cordless Vacuum
eufy E25 Robot Vacuum and Mop with HydroJet Roller Mop, 20,000 Pa Suction
Bose QuietComfort Wireless Headphones – Twilight Blue (Limited Edition)
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
The Trezor case emerged after a separate investigation involving CryptoBilis and another wallet brand. According to Trezor’s account, Ledger began investigating fund losses among customers who had bought hardware wallets from CryptoBilis on October 9. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis was also an authorized Trezor reseller at the time; Trezor says it removed the reseller from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra circuit board inside a Safe 5 bought through CryptoBilis and Tokopedia. Trezor had not yet examined that device, but said it issued a warning on October 30 rather than wait for lab confirmation because buyers could remain exposed. The company’s lab confirmation followed on November 12, after examining the reported wallet and reviewing images of two other devices.
Trezor says the devices it has checked from other resellers in the region showed no evidence of tampering. It is working with SEAL 911, the Security Alliance’s emergency response service. These findings apply to the checks reported so far; they do not establish that every device sold through every channel has been examined.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
The Scope of Captured Data
Trezor has confirmed three implanted Safe 5 devices, but the supplied information does not establish how many more, if any, may have been altered. The company says 48 CryptoBilis customers have come forward and their devices are being checked; it has not reported the outcome of all those inspections. It also says checks of devices from other regional resellers found no evidence of tampering, without providing a complete account of the number tested.
It is not clear whether the attackers received or used data from any of the three confirmed wallets, or whether any recovery words or passphrases were captured in practice. Trezor says the implant was designed to store and transmit displayed information, and says no owners have reported losing funds. The source material does not give a count of transmitted records or details about the attackers’ identity, server, or access to the captured data.
The firmware update addresses the implants Trezor has found. The company has not established in the supplied material that it would block every possible form of hardware tampering, nor does the update alone establish whether a particular wallet has been physically altered.
Device Checks and Customer Guidance
Trezor says it is checking devices belonging to the 48 CryptoBilis customers who have come forward and is working with SEAL 911. Customers with a device bought through CryptoBilis should follow Trezor’s latest guidance and contact the company through its official support channels to ask about inspection and next steps. The source material does not specify a completed inspection schedule or a final count of affected devices.
Owners of Trezor Safe 7, Safe 5, Safe 3 and Model T devices can install firmware 2.13.1, which Trezor says blocks the implants it has identified from capturing information. Updating does not resolve the risk if a recovery phrase or passphrase was copied earlier. Trezor’s warning makes that distinction clear, but the supplied material does not give case-specific instructions for replacing a potentially exposed wallet backup.
The next meaningful developments are the results of the customer device checks and any further findings about the confirmed implants or possible data access. Until those checks are reported, the number of affected devices beyond the three confirmed Safe 5s remains unknown.
Key Questions
How many Trezor wallets did the company confirm were implanted?
Trezor confirmed implants in three individual Safe 5 devices. It has not confirmed three affected wallet models.
What information could the implant capture?
According to Trezor, it copied information shown on the device screen, including recovery words when creating or restoring a wallet and a passphrase if displayed. It encrypted the information and attempted to send it over a mobile network.
Does firmware 2.13.1 protect an already exposed recovery phrase?
No. Trezor says the update blocks the implants it has found from capturing information on updated devices, but cannot protect a backup captured before installation.
Have any owners reported losing funds?
Trezor says no owner of the three confirmed implanted devices has reported losing funds. The company has not said whether any captured information reached the attackers or was used.
What should a CryptoBilis customer do?
Follow Trezor’s current guidance and contact the company through its official support channels about having the device checked. Trezor says 48 CryptoBilis customers have come forward and their devices are being examined.
Source: ThorstenMeyerAI.com
