Trezor confirmed on November 12 that three Safe 5 hardware wallets sold by reseller CryptoBilis contained malicious implants designed to capture recovery phrases and passphrases displayed on the device screen. No customers reported losses at the time of the announcement.
The affected devices were sold between August 20 and September 23 through CryptoBilis directly or via its Tokopedia and Shopee storefronts. Trezor examined one device in its laboratory and identified two others based on customer photos. Approximately 48 buyers had contacted the company by press time, with verification still ongoing. Trezor stated that no confirmed cases involved other wallet models or resellers.
Company Response and Customer Guidance
Trezor released a firmware update designed to prevent the implants from intercepting display communications. The company explained that the firmware could monitor communication between the microcontroller and display, and had altered the command sequence required to trigger the implant.
Despite the firmware fix, Trezor urged customers to move their cryptocurrency to new wallets using fresh recovery phrases, noting that "the update can't protect a wallet backup that was captured before it." Customers who purchased Trezor devices from CryptoBilis from March 2026 onward were advised to take this precaution.
Trezor also recommended that buyers with unused devices leave them unconfigured. Eligible customers could contact Trezor Support for a replacement or refund.
Reseller Network Overhaul
Trezor dropped CryptoBilis as a reseller on October 9 following reports of tampered Ledger devices sold through the distributor. After a customer flagged a suspected Safe 5 implant on October 28, Trezor issued a warning two days later announcing that it had cut its reseller network by approximately 80% and implemented stricter controls on sourcing, storage, and access procedures.
