Three modified Trezor Safe 5 wallets exposed recovery phrases through hidden display implants. The malicious circuitry transmitted sensitive information without compromising the Secure Elemen
A hardware wallet can run legitimate firmware, protect its private keys and still reveal the information needed to empty its accounts.
That is the central finding of Trezor’s investigation into three Safe 5 wallets distributed through Southeast Asian reseller CryptoBilis. Unauthorized circuitry placed between the main board and screen captured recovery information and transmitted it over a cellular network.
The affected owners have reported no losses. Nevertheless, Trezor’s precautionary warning covers customers who bought its devices from CryptoBilis since March 2026, including purchases through Tokopedia and Shopee.
For those buyers, the immediate priority is securing the assets, not inspecting the hardware.
Customers who have initialized a CryptoBilis wallet should transfer their cryptocurrency to accounts generated from a completely new recovery phrase.
Moving the old phrase to another device preserves the same underlying vulnerability. If an attacker obtained the backup, the original hardware is no longer needed to access the associated accounts.
Trezor recommends temporarily using a familiar software wallet or cryptocurrency exchange when another trusted hardware wallet is unavailable. Both alternatives carry their own risks, but they may reduce exposure while a replacement is arranged.
Unused devices should remain uninitialized, especially if the owner intends to restore an existing wallet.
The company is offering eligible customers replacements, although international shipping restrictions may require an alternative model with a price-difference refund, delivery to another country or a full refund.
Customers should retain the original device and initiate requests through official Trezor Support.
Trezor’s technical investigation, published November 12, identified an additional circuit board installed along the Safe 5’s display connection.
The implant operated as a passive observer. It did not modify the legitimate firmware or Secure Element, according to the manufacturer’s laboratory findings.
Instead, it recognized recovery words appearing during wallet creation and restoration. It could also capture passphrase information presented through the monitored interface.
The collected data was encrypted and transmitted to an attacker-controlled server through a cellular connection. When the connection failed, the implant retained the information and attempted transmission later.
This architecture creates an important distinction between private-key isolation and recovery-phrase confidentiality.
A Secure Element can prevent direct extraction of cryptographic material while a separate component captures the backup used to reconstruct that material elsewhere.
Trezor confirmed that the malicious boards followed the same basic design as implants previously discovered in Ledger devices, modified to work with the Safe 5 display.
The similarity establishes a shared attack method. It does not establish who installed the components or whether the same group targeted both manufacturers.
Trezor released firmware version 2.13.1 on November 11, introducing protection against the implants identified during its investigation.
The company has not disclosed the precise implementation of that countermeasure.
Its effectiveness also has a clear limit: a recovery phrase captured before the update remains compromised.
An attacker with a complete backup may restore the associated wallet independently. Where an additional passphrase is required, access also depends on obtaining that separate secret.
The appropriate response is therefore account migration using newly generated recovery information. Updating or replacing the original device does not change the keys derived from an existing phrase.
On October 9, Ledger started examining reported customer losses involving hardware wallets purchased through CryptoBilis. Trezor removed the reseller from its authorized network that day as a precaution.
By October 13, Trezor had announced a wider reduction in its reseller network. Affected partners were told they would receive no new stock and that their authorizations would end on January 1, 2027, with remaining inventory permitted to be sold until then.
That restructuring preceded the first reported Trezor implant.
The manufacturer’s security team received the Safe 5 disclosure on October 28 and published its initial customer advisory on October 30.
Subsequent examinations identified three modified devices purchased between August 20 and September 23. One was examined in Trezor’s laboratory, while the other two were identified through photographs supplied by their owners.
Forty-eight CryptoBilis customers had contacted the company following the warnings. Trezor has not disclosed a complete denominator of devices sold or examined, making an infection-rate estimate impossible.
The manufacturer has not identified where the unauthorized circuitry entered the distribution chain.
Its investigation has also found no comparable implants in other Trezor models or devices purchased from different resellers.
Those findings limit the confirmed scope of the incident, although they do not establish that every unexamined device is safe.
Trezor is working with SEAL 911, the Security Alliance’s emergency-response service, and says it will publish further findings if investigators identify additional compromised products or confirmed fund losses.
For customers, the most useful evidence is their purchase history. A device that appears normal, passes routine software checks or has the latest firmware cannot establish whether its recovery information was previously intercepted.
The outstanding investigative question is how modified devices entered an authorized reseller’s inventory and whether the same distribution weakness exposed additional customers.
The post How a Hidden Screen Tap Turned Trezor Backups Into a Liability appeared first on ETHNews.
