🔍 Read the full analysis: Can Trezor’s Fix Stop Hidden Implants In Safe 5 Wallets? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Trezor says it confirmed implants in three Safe 5 hardware wallets sold through former reseller CryptoBilis. The company released firmware 2.13.1, which it says blocks the implants it identified, but cannot protect recovery words already captured; no owners of the three confirmed devices have reported losing funds.
Trezor says it has confirmed hidden circuit-board implants in three Safe 5 wallets sold through former reseller CryptoBilis, and that its November 11 firmware update, version 2.13.1, blocks the implants it has identified from capturing data on updated devices. The company says none of the three owners has reported losing funds, but warns the update cannot protect recovery words captured before installation.
According to Trezor’s investigation, each implant was fitted between the wallet’s main board and its screen. The company says the added board copied what appeared on the display, including recovery words shown during wallet creation or entered during recovery, and a passphrase if one appeared there. It encrypted the captured information and sent it over a mobile network to a server controlled by the attackers. If it could not connect, it stored the data and retried later.
Trezor says the implant did not alter the Safe 5’s firmware or its Secure Element, the device’s security chip. The three affected devices were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor said it confirmed one device in its lab and identified two others from owner-provided photographs.
The company released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says the update prevents the implants it has found from capturing anything on devices running the new firmware. It also says it has received contact from 48 CryptoBilis customers and is checking their devices. That figure refers to customers who came forward, not to confirmed infected wallets.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why Screen-Based Theft Matters
The reported design targets information at the point where a user may trust the device’s display. Trezor’s account says the implant copied screen contents while leaving the firmware and security chip unchanged. That means, according to the company’s findings, checks focused on those components would not by themselves establish that a device has no added hardware.
The practical risk is that a captured recovery phrase can provide a way to access the wallet it protects. Updating firmware can stop the identified implant from collecting further information, according to Trezor, but it cannot retrieve or invalidate a phrase that may already have been copied. Users whose devices may have come through the affected reseller therefore need to follow Trezor’s guidance rather than assume that installing the update resolves any earlier exposure.
The case also has implications for how hardware-wallet makers and customers assess supply chains. Trezor has said it removed CryptoBilis from its reseller network on October 9 and reduced its reseller network by about 80%. That response underlines that a device’s route to market can be part of its security, not just the software and components inside it.
Popular right now
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Milk Frother, Silver
Dyson V8 Cordless Vacuum
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
The Trezor case followed reports involving another wallet brand. According to Trezor, Ledger began investigating customer fund losses linked to wallets bought from CryptoBilis on October 9. Ledger said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis had also been an authorized Trezor reseller; Trezor says it removed the company from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra board inside a Safe 5 bought from CryptoBilis through Tokopedia. Trezor issued a warning on October 30 before it had examined the device, saying it did not want buyers to remain exposed while laboratory work was pending. The company reported lab confirmation on November 12, along with two further devices identified from photographs sent by their owners.
Trezor says devices it has checked outside the three confirmed cases showed no evidence of tampering, and that its checks of devices from other regional resellers found none either. It is working with SEAL 911, the Security Alliance’s emergency-response service. Those findings describe the checks completed so far and do not establish the condition of every CryptoBilis device.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
How Many Devices Were Exposed
The confirmed count is three individual Safe 5 devices, not three wallet models or three separate product lines. The number of CryptoBilis devices that may have been modified is not known. Trezor says 48 customers have come forward and that their devices are being checked; it has not said how many of those checks are complete or published a final total.
Trezor reports that no owner of the three confirmed devices has lost funds. That is not the same as proof that no recovery information was captured or that no future loss is possible. The company’s source material does not specify how many phrases, passphrases or other screen contents were successfully transmitted, whether the attackers accessed the data, or who controlled the receiving server.
The protection claim is also limited to the implants Trezor has found. The published information does not establish that the update detects every possible hardware modification, nor does it provide a user-run test that can definitively rule out an implant. Trezor says devices from its other checked resellers showed no evidence of tampering, but the scope and completeness of those checks remain important to interpreting that reassurance.
Device Checks and Recovery Guidance
Trezor says it is continuing to check devices from customers who bought through CryptoBilis, alongside its work with SEAL 911. Customers should consult Trezor’s current official notices and install firmware 2.13.1 on supported devices, while recognizing that the update addresses future capture by the implants the company identified—not information already taken.
Further updates may clarify how many of the 48 reported customers’ wallets have been examined, whether any additional devices are confirmed, and what guidance Trezor gives to owners whose recovery words may have appeared on an affected screen. Until those details are published, the extent of exposure and the attackers’ access to captured data remain unresolved.
Key Questions
What did Trezor find inside the Safe 5 wallets?
Trezor says three Safe 5 devices contained an extra circuit board fitted between the main board and the screen. The company says the implant copied information shown on the display and transmitted encrypted data over a mobile network.
Does firmware 2.13.1 remove an implant?
Trezor says the update stops the implants it has identified from capturing information on devices running the firmware. Its published description does not say that the update physically removes an added board.
Can the update protect recovery words captured earlier?
No. Trezor says firmware 2.13.1 cannot protect a wallet backup captured before the update. The company has not said how many phrases, if any, were successfully transmitted or accessed.
Have customers lost funds in the confirmed cases?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not stated that no information was captured, and it is still checking devices from other customers.
How many CryptoBilis customers are being checked?
Trezor says 48 customers have come forward and that their devices are being checked. That is a count of customers who contacted the company, not a count of confirmed implanted devices.
Source: ThorstenMeyerAI.com
