Trezor has confirmed that three of its Safe 5 hardware wallets carried malicious hardware implants capable of stealing recovery phrases and transmitting them to attackers over cellular networks. All three devices were bought from CryptoBilis, a reseller in Southeast Asia, between August 20 and September 23, 2026. The disclosure follows an October report in which a customer found an unauthorized circuit board inside a Safe 5 purchased from the Indonesian reseller. Trezor said it has examined the original device in its laboratory and identified the two other compromised wallets from photographs supplied by their owners.
The company said 48 CryptoBilis customers have contacted it since its October warning, and their devices are being checked either in the lab or through images of their internal components. Trezor also inspected devices from other resellers in the region and found no signs of tampering. Confirmed implants remain limited to Safe 5 units sold through CryptoBilis, and no affected customers have reported losing funds.
According to Trezor, its engineers analyzed the implant's firmware and found the added hardware can capture information shown on or entered into the wallet's screen. The implant is a separate circuit board placed between the Safe 5's main board and its display, which lets it watch screen activity without altering the device's legitimate firmware or Secure Element. It collects recovery words when they appear during new wallet backup creation or restoration of an existing wallet, and it can also capture passphrases. The stolen data is encrypted and sent over a mobile network to a server controlled by the attacker; if no connection is available, the implant retains the data and keeps retrying transmission.
Trezor released firmware version 2.13.1 on November 11, which it says includes protections that stop the implants it found from capturing anything on devices running it, rendering the current batch useless. The company cautioned that the update cannot protect recovery phrases that were captured before it was installed. It advises anyone who bought a Trezor device from CryptoBilis to move their cryptocurrency to a newly created wallet with a new recovery phrase, even though no Trezor customers have reported stolen funds.
The implants come after confirmed hardware implants in Ledger devices sold through CryptoBilis, which have been tied to cryptocurrency thefts. Trezor has cut its global reseller network by roughly 80% in response to the supply-chain attacks, a reduction it had already planned in October after the Ledger reports and before it knew of implants in its own devices. Trezor said the removed resellers were trustworthy and posed no threat but did not meet stricter supply-chain security requirements now being introduced, and remaining partners face tighter controls on how devices are sourced, stored, and accessed.
Trezor is offering replacement devices to anyone who bought a Trezor wallet from CryptoBilis since March 2026, including customers whose devices have not been confirmed as compromised. The company said it has found no evidence of implants from other resellers and has received no reports of funds stolen through the affected Safe 5 wallets. For U.S. buyers, the confirmed cases trace to a single overseas reseller, and Trezor directs CryptoBilis customers to migrate funds regardless of where they are located.
More cybersecurity news from TechManNews.
