🔍 Read the full analysis: Hidden Implants In Safe 5 Wallets: What Trezor’s Response Covers on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor says it confirmed implants in three Safe 5 wallets bought through former reseller CryptoBilis. The devices could capture recovery words and passphrases shown on screen and send them over a mobile network; firmware 2.13.1 blocks the identified implants, but cannot protect information captured before installation. Trezor says no owners of the three confirmed devices have reported losing funds.
Trezor says it has confirmed implants in three Safe 5 hardware wallets bought through former Southeast Asian reseller CryptoBilis, devices that could copy recovery words displayed on screen and send them to an attacker-controlled server. The company says firmware 2.13.1, released November 11, blocks the implants it has identified, but cannot protect a recovery backup captured before the update; no owners of the three confirmed devices have reported losing funds.
Trezor’s laboratory examined one Safe 5 reported by a customer and identified two more implanted devices based on photographs provided by their owners. The three were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor says it has not found evidence of tampering in other devices it has checked, including devices from other regional resellers.
According to Trezor’s analysis, the implant is an extra circuit board fitted between the Safe 5’s main board and screen. It copies information shown on the display, including recovery words when a wallet is created or restored and a passphrase if one appears. It encrypts the captured data and sends it over a mobile network; if it cannot connect, Trezor says, it stores the information and retries later.
Trezor says the implant does not change the wallet’s firmware or its Secure Element, the device’s security chip. The company released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. It says the update stops the implants it has found from capturing information on devices running the software. Trezor also reports that 48 CryptoBilis customers have come forward and that their devices are being checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Recovery Words Are the Target
A hardware wallet is designed to keep the recovery information controlling a user’s funds out of reach of other devices. If a recovery phrase is copied, an attacker may be able to use it to access the associated wallet, even if the hardware wallet itself continues to operate normally. Trezor says the implant collected information from the screen, the point at which users view or enter recovery words.
The implant’s reported placement also affects how owners should interpret a normal software check. Trezor says the firmware and Secure Element were left unchanged, so those components alone would not reveal the added circuit board. This is an implication of the company’s description, rather than a separate finding that Trezor has presented as a user test. Its response has focused on the devices’ purchase source and reseller history, as well as the firmware fix.
The scope confirmed so far is limited: three individual Safe 5 devices, not three different wallet models. Trezor says none of their owners has reported a loss, but that does not establish whether any captured information was accessed or whether all affected devices have been located. The case underscores why provenance matters for hardware that stores access credentials, while leaving the extent of exposure under investigation.
Products Worth Considering
FLEXISPOT Electric Adjustable Workbench, 48 x 30 in, Maple
Canon PIXMA TR160 Wireless Portable Color Inkjet Printer
Dell UltraSharp U2424H 24-Inch FHD Monitor
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Confirmation
Trezor’s account places the case within a broader investigation involving CryptoBilis. On October 9, according to Trezor, Ledger began investigating reported fund losses among customers who had bought wallets from the reseller, which had been authorized to sell both brands. Trezor removed CryptoBilis from its reseller network that day. Ledger later said some devices sold through the channel had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.”
On October 28, a Trezor customer in Indonesia reported an extra circuit board in a Safe 5 bought from CryptoBilis through Tokopedia. Trezor issued a warning on October 30 before its laboratory had examined the device. The company said it acted because waiting for lab confirmation could leave other CryptoBilis customers exposed. On November 12, it announced that its lab had confirmed the reported device and that two additional implanted Safe 5s had been identified from owner-submitted photographs.
Trezor says it is working with SEAL 911, the Security Alliance’s emergency response service, and has reduced its reseller network by about 80%. The company has not described that reduction as a direct count of compromised sellers; it is a wider change to its distribution arrangements reported alongside the investigation.
““It only listens.””
— Trezor
How Many Devices Were Affected?
The confirmed count remains three Safe 5 wallets. Trezor has not said that this is the total number of implanted devices, and checks of 48 customers who have come forward are ongoing. The company says other devices it checked showed no evidence of tampering, but it has not published the full number of devices examined or the methods used for those checks.
It is also unclear whether the attackers received or accessed data from the three confirmed devices, or whether any recovery words were captured before the firmware update. Trezor says no owner of those devices has reported losing funds; it has not said that this rules out the capture of information. The source and identity of the attackers, the number of people involved and the full route by which the implants entered the distribution channel have not been established publicly.
Customer Checks and Firmware Rollout
Trezor says it is checking devices belonging to CryptoBilis customers who have contacted the company and working with SEAL 911. Owners who bought a wallet through CryptoBilis should follow Trezor’s published guidance and contact the company about their device’s history. Trezor’s update is available for the Safe 7, Safe 5, Safe 3 and Model T, but the company warns that installing it cannot undo any earlier capture of a recovery backup.
The next public developments to watch are the results of customer-device checks and any further information from Trezor or investigators about the number and distribution of affected devices. Until those findings are released, the confirmed scope should be described as three Safe 5s, with the wider extent still under review.
Key Questions
Which Trezor wallets were confirmed to contain implants?
Trezor confirmed three individual Safe 5 devices. It has not reported confirmed implants in other Trezor models.
What information could the implant capture?
According to Trezor, it copied information shown on the screen, including recovery words during wallet creation or restoration and a passphrase if one appeared. It encrypted the data and attempted to send it over a mobile network.
Does firmware 2.13.1 protect information captured earlier?
No. Trezor says the update blocks the implants it has identified from capturing information on devices running the firmware, but it cannot protect a backup captured before the update.
Have the owners of the confirmed devices lost funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not said whether any captured information was accessed, and checks of other customer devices are ongoing.
What should CryptoBilis customers do?
Trezor says it is checking devices belonging to customers who have come forward. CryptoBilis customers should consult Trezor’s published guidance and contact the company about their device; an update cannot reverse any earlier capture of recovery information.
Source: ThorstenMeyerAI.com
