Hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by the Southeast Asian reseller CryptoBilis contained malicious hardware implants built to steal wallet recovery phrases and send them to attackers over cellular networks. The findings follow an October warning, when a customer found an unauthorized circuit board inside a Safe 5 purchased from the reseller. Trezor later examined that device in its laboratory and identified two more compromised wallets from photographs submitted by their owners.

How the implant works

According to Trezor’s analysis, the implant is an additional circuit board installed between the Safe 5’s main board and its display. It monitors screen activity without modifying the legitimate firmware or the Secure Element. When recovery words appear, either while creating a new wallet backup or restoring an existing one, the implant captures them. It can also capture passphrases shown on screen, encrypt the data, and transmit it to an attacker-controlled server. If no connection is available, the implant stores the data and retries until transmission succeeds.

Scope of the incident

  • All three confirmed devices were purchased from CryptoBilis between August 20 and September 23, 2026.
  • Trezor says 48 CryptoBilis customers contacted the company after its October warning, with devices checked physically or through photographs.
  • Devices from other regional resellers showed no evidence of tampering.
  • No affected customers have reported losing funds.

Trezor notes that the confirmed implants resemble those previously found in Ledger devices sold through the same reseller, which have been linked to cryptocurrency thefts.

Fix and recommended actions

Trezor released firmware version 2.13.1 on November 11, which includes protections that prevent the implants from capturing data on updated devices. The company warns, however, that the update cannot protect recovery phrases captured before installation. Customers who bought Trezor devices from CryptoBilis are advised to move their cryptocurrency to a newly created wallet with a new recovery phrase.

Supply-chain response

Trezor has reduced its global reseller network by roughly 80 percent. The company says the removed resellers were trustworthy but did not meet newly introduced supply-chain security requirements, which now govern how devices are sourced, stored, and accessed. Trezor is offering replacement devices to anyone who purchased a Trezor wallet from CryptoBilis since March 2026, including customers whose devices have not been confirmed as compromised.