Trezor has confirmed malicious hardware implants in three Safe 5 wallets sold through Southeast Asian reseller CryptoBilis, expanding an investigation into compromised devices capable of stea
Trezor has confirmed malicious hardware implants in three Safe 5 wallets sold through Southeast Asian reseller CryptoBilis, expanding an investigation into compromised devices capable of stealing recovery phrases and transmitting them to attackers.
The three affected wallets were purchased between August 20 and September 23, 2026, through CryptoBilis stores on Tokopedia and Shopee or directly from the reseller. Trezor examined one device in its laboratory and identified the other two through photographs provided by their owners.
The company has received reports from 48 CryptoBilis customers since the investigation began. No additional implants have been identified among the devices examined, and no customers have reported losing funds.
Trezor also released firmware version 2.13.1 on November 11 to neutralize the identified implants and reduced its authorized reseller network by approximately 80%, introducing stricter controls over how devices are stored, handled and distributed.
The attack involved an additional circuit board concealed between the Safe 5’s main board and touchscreen. Equipped with a cellular modem and antenna, the component could secretly copy information displayed on the device, including recovery phrases and passphrases.
Captured information was encrypted and transmitted over mobile networks to an attacker-controlled server. If a connection was unavailable, the implant stored the information and repeatedly attempted transmission until successful.
The modification operated independently of the wallet’s firmware and Secure Element, allowing attackers to collect sensitive information without altering the device’s signing software.
The discovery follows the CryptoBilis wallet-drain investigation involving Ledger devices, where similar hidden components were used to intercept recovery phrases during wallet initialization.
Trezor removed CryptoBilis from its authorized reseller network on October 9 after Ledger began investigating compromised devices distributed through the same retailer.
The manufacturer subsequently announced plans to reduce its reseller network before receiving the first report involving one of its own products on October 28.
Firmware 2.13.1 prevents the identified implants from capturing additional information on updated devices, but it cannot protect recovery phrases or passphrases already collected before installation.
Customers who purchased any Trezor wallet through CryptoBilis from March 2026 onward have therefore been instructed to transfer their assets to a new wallet using a freshly generated recovery phrase. Simply updating the firmware or restoring an existing recovery phrase on another device does not eliminate the potential exposure.
Those customers are eligible for replacement devices through Trezor Support. Depending on shipping restrictions, the company may provide an alternative model, arrange delivery to another country or offer a refund.
Trezor has found no evidence of compromised devices from other resellers or implants affecting models beyond the Safe 5. Its investigation remains ongoing, with additional assistance from the Security Alliance’s SEAL 911 emergency response service.
The company has also warned customers against fraudulent replacement offers and phishing attempts, emphasizing that its support team will never request recovery phrases or private keys.
The post Trezor Confirms Safe 5 Implants, Cuts Resellers by 80% appeared first on Crypto Adventure.
