Trezor reported on November 12 that three Safe 5 hardware wallets purchased from CryptoBilis, a former authorized reseller in Southeast Asia, contained unauthorized hardware implants. The devices were bought between August 20 and September 23 through CryptoBilis directly or via its Tokopedia and Shopee stores.
The company examined the first reported implant in its laboratory and identified two others from owner photographs. Forty-eight customers contacted Trezor regarding potentially affected devices, which the company checked either in its lab or through internal photographs. Trezor stated it received no reports of customer funds lost to the implants.
Firmware Update and Technical Details
Trezor released firmware version 2.13.1 on November 11 to block the identified implants. The unauthorized hardware sits between the screen and main board, where it copies displayed information without modifying the device's firmware or Secure Element security chip. The implant records recovery words during wallet creation or restoration, as well as displayed passphrases—optional extra secrets used to access separate wallets.
The captured data is encrypted and transmitted over a mobile network to a server controlled by attackers. If a signal is unavailable, the implant stores data and continues attempting transmission. Trezor noted this attack method resembles implants previously found in some Ledger devices, where attackers purchased genuine devices, modified them, and resold them through Southeast Asian resellers.
Reseller Network Changes
Trezor cut its reseller network by approximately 80%, a reduction the company announced in October. The company described the removed partners as trustworthy and posing no immediate threat. Remaining resellers must now meet stricter requirements governing device sourcing, storage, and access.
Customer Replacement and Security Recommendations
Although the firmware update blocks capture by the identified implants, Trezor advised that previously exposed wallet backups remain compromised. The company continued recommending that CryptoBilis buyers transfer funds to newly created wallets, as replacing hardware while reusing the same recovery phrase leaves prior exposure intact.
Replacement eligibility covers all models purchased from CryptoBilis from March onward. Shipping restrictions may result in a different model with a price difference refund, delivery to another country, or a full refund. Customers should arrange replacements through official Trezor Support. The company warned that scammers could impersonate staff offering replacements or refunds, reiterating that it never requests recovery phrases.
Owners of suspected tampered devices were instructed to retain them and avoid setup or use pending support guidance. Trezor is working with SEAL 911, the Security Alliance's emergency response service for cryptocurrency incidents, and pledged a reward for the customer who first reported the implant.
