Trezor Cuts 80% of Resellers After Three Safe 5 Implants

BitcoinWorldTrezor Cuts 80% of Resellers After Three Safe 5 Implants

Trezor confirmed on Nov. 12, 2026 that three Safe 5 hardware wallets sold by former reseller CryptoBilis contained hardware implants, and the company has since cut its reseller network by roughly 80%, Crypto.news reported. The devices were bought between Aug. 20 and Sept. 23, 2026 through CryptoBilis directly or its Tokopedia and Shopee stores; Trezor examined the first in its own laboratory and identified the other two from photographs supplied by their owners.

Trezor cut about 80% of its reseller network and released firmware 2.13.1 after three Safe 5 wallets from CryptoBilis were found with implants. The update blocks the implants on devices running it, but recovery phrases captured before installation remain exposed, so affected buyers are told to move funds to a new wallet with a new seed.

Key facts

• Trezor’s Nov. 12 investigation update said three Safe 5 wallets bought from CryptoBilis contained implants and that all three were purchased between Aug. 20 and Sept. 23, 2026.
• Firmware version 2.13.1, released Nov. 11, blocks the identified implants but cannot protect recovery phrases already captured.
• Trezor removed CryptoBilis as an authorized reseller on Oct. 9 after reports of tampered Ledger wallets sold through the same business.
• Any customer who bought a Trezor from CryptoBilis from March 2026 onward qualifies for a replacement or refund.
• No customer has reported losing funds, and no implant has been confirmed outside CryptoBilis or in another Trezor model.

How the implant worked and why the firmware update is not enough

The implant was not a modification to Trezor’s firmware or its Secure Element. According to the technical account, it was an extra circuit board placed between the Safe 5’s main board and its screen. It listened to the communication between the microcontroller and the display, copied the recovery words shown when a wallet backup is created or when an existing wallet is restored, and could capture passphrases displayed on screen in the same way. Captured data was encrypted and sent over a mobile network to an attacker-controlled server, with the implant storing data and retrying when no connection was available.

Trezor engineers instead changed the order of the commands sent to the display so the implant’s trigger sequence no longer occurs. In an exchange on X, the company explained that the firmware can listen to the communication between the MCU and the display and that reordering those commands defeats the trigger. But that only stops future capture. Any recovery phrase displayed on an affected wallet before the update is still compromised, which is why CryptoBilis buyers are told to create a new wallet with a new seed rather than import the old phrase into another hardware or software wallet.

Customers who have not set up a CryptoBilis-purchased device are advised not to configure it and not to enter an existing wallet backup. Trezor also noted that the implants produce no obvious external differences. Opening a wallet can damage it, and the company said a well-made implant is hard to spot even with reference photographs.

An 80% reseller cut and stricter handling rules

The reseller reductions are not a response to confirmed tampering at those other partners. Trezor described the removed resellers as trustworthy and said they posed no immediate threat; they simply did not meet the stricter sourcing, storage and access requirements being introduced across the remaining network. Inspections of wallets from other resellers in the region found no evidence of tampering.

Since its October appeal for customers to come forward, Trezor has heard from 48 CryptoBilis buyers, with checks carried out through laboratory examinations or photographs of device internals. Every other device examined showed no sign of tampering.

The replacement window extends beyond the purchase dates of the three identified units. Shipping restrictions may require a different model with the price difference refunded, delivery to an address in another country, or a refund. Trezor warned that scammers may impersonate support staff offering replacements or refunds and that its staff will never ask customers to share recovery phrases.

AMBCrypto reported that a customer flagged a suspected Safe 5 implant on Oct. 28, two days before Trezor’s first public warning; Crypto.news describes that first warning as following on Oct. 30. AMBCrypto also noted that Trezor had not confirmed any customer losses at its publication time on Nov. 13. The two reports agree on the three affected devices, the firmware mechanism and the fresh-seed advice.

Why it matters

Hardware wallets are marketed as protection against online attacks, but this incident shows that the supply chain around the device is a separate attack surface. A buyer who purchases from a reseller is trusting that intermediary’s handling, storage and access controls, not only the manufacturer’s firmware. Trezor’s decision to shrink its reseller network reflects that trust being moved upstream, and the company’s own comparison to the earlier Ledger tampering reports through CryptoBilis suggests the pattern is not isolated to one brand.

For individual holders, the practical lesson is that a compromised seed is not repaired by patching the device. A new wallet with a new seed is the only way to restore separation between the user’s keys and an attacker who may already hold the old phrase.

What to watch

Trezor said checks on the 48 CryptoBilis buyers who came forward were still ongoing at AMBCrypto’s publication time, so any change in that count or in the number of confirmed implants would be the next significant update. Eligible CryptoBilis buyers should also watch for official Trezor Support communication, given the company’s warning about impersonation scams.

Frequently Asked Questions

How many Trezor Safe 5 wallets had implants?

Trezor confirmed three Safe 5 wallets bought from CryptoBilis between Aug. 20 and Sept. 23, 2026 contained implants. One was examined in Trezor’s lab and the other two were identified from owner-supplied photographs.

Does firmware version 2.13.1 make affected wallets safe?

It prevents the identified implants from capturing information on devices that run the update, but Trezor says it cannot protect a recovery phrase that was already captured. CryptoBilis buyers are still advised to create a new wallet with a new seed.

Who qualifies for a Trezor replacement?

Customers who bought a Trezor from CryptoBilis from March 2026 onward are eligible for a replacement, refund, or delivery to another country where shipping is restricted. Trezor advises going through Trezor Support directly and warns that scammers may impersonate support.

Were any customers affected outside CryptoBilis?

No. Trezor said inspections of wallets from other resellers in the region found no tampering, and no implant has been confirmed in another Trezor model or reseller.

This post Trezor Cuts 80% of Resellers After Three Safe 5 Implants first appeared on BitcoinWorld.