🔍 Read the full analysis: Trezor Confirms Safe 5 Implants: What The Fix Addresses on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Trezor confirmed implants in three Safe 5 hardware wallets bought from CryptoBilis, a reseller it removed from its network on October 9, 2026. The devices copied information displayed on their screens, including recovery words, and transmitted it over a mobile network. Trezor says firmware 2.13.1 blocks the implants it has identified, but cannot protect a backup captured before the update.
Trezor has confirmed that three Safe 5 hardware wallets bought from former reseller CryptoBilis contained extra circuit boards that copied information shown on the device screens, including wallet recovery words. The company says firmware 2.13.1, released November 11, blocks the implants it has identified, but cannot protect a recovery backup captured before the update.
Trezor said its laboratory examined one Safe 5 after an Indonesian customer reported an extra circuit board on October 28. Two further implanted devices were identified from photographs submitted by their owners. The three wallets were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor had removed CryptoBilis from its reseller network on October 9.
According to Trezor’s analysis, the implant sits between the wallet’s main board and screen. It copies information displayed on the screen, including recovery words shown during wallet setup or entered to restore a wallet, and a passphrase if one appears there. The implant encrypts the captured data and sends it over a mobile network to a server controlled by the attackers. If it cannot connect, Trezor says, it stores the data and tries again later.
Trezor says the implant leaves the device firmware and Secure Element—the dedicated security chip—unchanged. It released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. The company says the update stops the implants it has found from capturing data on updated devices. Trezor reports that no owner of the three confirmed devices has reported losing funds; 48 CryptoBilis customers have come forward, and their devices are being checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why Screen-Captured Recovery Words Matter
A recovery phrase can give someone control over a wallet, so copying it can expose funds even if the device’s software and security chip have not been altered. In this case, Trezor says the implant targets what the device displays, rather than changing the wallet’s firmware or interfering with its Secure Element. That distinction matters: the presence of unchanged software or a functioning security chip does not, by itself, address the separate hardware circuit described by Trezor.
The incident also puts attention on the route a device takes before reaching its buyer. The confirmed wallets were sold through one reseller that Trezor says it removed from its network. The company says it has found no tampering in other devices it has checked, including devices from its other resellers in the region. That is a report about the checks completed so far, not a guarantee about every device sold through every channel.
For owners, the central issue is whether a recovery phrase might have appeared on an affected device before its software update. Trezor warns that the update cannot protect a backup already captured. The company has not reported customer fund losses in the confirmed cases, but the risk described is unauthorized access to captured recovery information.
Popular right now
TCL 65-Inch 4K UHD Smart LED TV (65S425)
Dyson V8 Cyclone Cordless Vacuum
Ninja Foodi DZ201 8-Quart DualZone 6-in-1 Air Fryer
As an affiliate, we earn on qualifying purchases.
From CryptoBilis Report to Confirmation
The case began with reports involving a different hardware-wallet brand. Trezor says Ledger began investigating fund losses among customers who bought wallets from CryptoBilis on October 9. Ledger later reported physical tampering and, in an October 15 statement, described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis was also an authorized Trezor reseller at the time; Trezor says it removed the company from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra circuit board in a Safe 5 bought from CryptoBilis in August through Tokopedia. Trezor issued a warning on October 30 before examining the device, saying it did not want to leave customers exposed while laboratory checks were pending. The company announced laboratory confirmation of the reported device, along with two more identified from owner-submitted photographs, on November 12.
Trezor says its checks of other devices and devices from other regional resellers found no evidence of tampering. It has also said it cut its reseller network by about 80 percent, though the source material does not specify when that reduction took place or how the company calculated it. Trezor is working with SEAL 911, the Security Alliance’s emergency response service.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
Scope of Checks and Possible Exposure
The confirmed number is three individual Safe 5 devices, not three wallet models. Trezor says 48 CryptoBilis customers have come forward and their devices are being checked, but the source material does not give the number of checks completed or their results. It is not clear whether additional implanted devices will be identified.
Trezor says none of the owners of the three confirmed devices has reported losing funds. That does not establish whether the implant’s transmissions were received or whether captured recovery information was accessed or used. The material does not identify the attackers, their server, how many recovery phrases may have been sent, or whether any affected phrase was subsequently used.
The company says firmware 2.13.1 stops the implants it has found, but no independent verification of that claim is provided in the source material. Trezor’s description of the implant and the update’s effect should therefore be understood as the company’s findings and assessment. The available information also does not describe a user-run test that can reliably detect the extra hardware.
Customer Device Checks Continue
Trezor says it is checking devices belonging to customers who have come forward and is working with SEAL 911. Owners who bought a wallet from CryptoBilis should follow Trezor’s current official guidance, including its advice on the firmware update and any steps it provides for checking a device. The source material does not give a deadline or a final count for those checks.
Customers should distinguish the update’s stated protection from the separate question of whether a recovery phrase may have been displayed on a compromised device before updating. Trezor says firmware 2.13.1 blocks the implants it has found, not that it can reverse earlier capture. Further company updates on the customer checks, any additional affected devices and the investigation’s findings will clarify the known scope.
Key Questions
How many Trezor devices has the company confirmed were implanted?
Trezor confirmed three Safe 5 devices. They were individual wallets of the same model, bought from CryptoBilis between August 20 and September 23, 2026.
What information did the implant capture?
Trezor says it copied information shown on the wallet screen, including recovery words during wallet creation or restoration and a passphrase if one appeared there. It encrypted the information and sent it over a mobile network, retrying if it could not connect.
What does firmware 2.13.1 do?
Trezor says the November 11 update blocks the implants it has identified from capturing information on devices running the firmware. It is available for the Safe 7, Safe 5, Safe 3 and Model T, according to the company.
Can the update protect a recovery phrase captured before installation?
No. Trezor says the update cannot protect a wallet backup that was captured before the update. The company has not reported fund losses among owners of the three confirmed devices, but says customer checks are continuing.
Have other devices or customers been affected?
Trezor says its checks of other devices, including devices from its other regional resellers, found no evidence of tampering. It has not given final results for all CryptoBilis customers: 48 have come forward, and their devices are being checked.
Source: ThorstenMeyerAI.com
