🔍 Read the full analysis: What’s Changed After Trezor Found Hidden Implants In Three Safe 5 Wallets? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor confirmed that three Safe 5 hardware wallets bought through former reseller CryptoBilis contained extra circuit boards that captured recovery words shown on the screens and sent the data over a mobile network. Firmware 2.13.1, released November 11, blocks the implants Trezor has identified, but cannot protect a backup captured before installation; the company says no owners have reported losing funds.
Trezor has confirmed three Safe 5 hardware wallets contained hidden circuit boards designed to copy recovery information shown on the devices’ screens and transmit it over a mobile network. The wallets were bought through CryptoBilis, a reseller Trezor removed from its network on October 9; firmware released November 11 blocks the implants Trezor has identified, but cannot undo exposure that occurred before the update.
Trezor said its lab examined one device after an Indonesian customer reported an extra circuit board through the company’s responsible disclosure program on October 28. The company identified two additional implanted Safe 5 devices from photographs sent by their owners. The three wallets were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores and directly from the reseller.
According to Trezor’s analysis, the board sits between the wallet’s main board and screen. It copies information displayed there, including recovery words shown when creating a backup or entered when restoring a wallet, and a passphrase if one appears on the screen. Trezor said the implant encrypts the captured information and sends it to a server controlled by the attackers over a mobile network; if it cannot connect, it stores the data and tries again. The company says the implant does not alter the wallet’s firmware or Secure Element.
Trezor released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. The company says the update prevents the implants it has found from capturing information on devices running the new firmware. It also says no owner of the three confirmed devices has reported losing funds. Forty-eight CryptoBilis customers have come forward, and Trezor says their devices are being checked; it did not say that all 48 devices had been examined.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why Recovery Words Were Exposed
The case targets information that can give someone control of a wallet, rather than a visible flaw in the device’s software. A recovery phrase can be used to restore access to a wallet, so its capture may put associated funds at risk even if the wallet itself continues to work normally. Trezor says the implant also captures a passphrase if it appears on the screen.
The reported method also complicates checks focused on software integrity. Trezor says the implants leave firmware and the Secure Element unchanged, while adding hardware along the display path. That means, as an implication of the company’s description, a software check alone may not reveal this kind of physical modification. Trezor’s response has emphasized where a customer bought a wallet and whether it might be affected, rather than offering a user-run test that it says can identify the implant.
The immediate confirmed scope is limited: three Safe 5 devices have been identified, not three different wallet models. Trezor says its checks of other devices, including devices from other regional resellers, found no evidence of tampering. The update addresses the identified implant behavior, but any recovery information copied before the update may remain exposed.
Products Worth Considering
Samsung Galaxy Tab A11+ Kids Edition, 128 GB Android Tablet, Royal Blue
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
Jackery Solar Generator 1000 v2 with 100W Solar Panel
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Findings
The concern emerged after a separate investigation involving CryptoBilis and Ledger customers. Trezor says Ledger began investigating customer fund losses linked to wallets bought from CryptoBilis on October 9. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.”
CryptoBilis was also an authorized Trezor reseller. Trezor says it removed the company from its reseller network on October 9. After the October 28 report of a modified Safe 5, Trezor warned customers on October 30, before its laboratory had examined the reported device. It said it did so because waiting for lab confirmation would leave buyers exposed in the meantime. The company’s lab confirmation followed on November 12.
Trezor says it has reduced its reseller network by about 80% and is working with SEAL 911, the Security Alliance’s emergency response service. These measures follow the company’s finding that the confirmed devices came through a distribution channel rather than a compromise it says changed the wallet firmware or security chip.
““It only listens.””
— Trezor
How Many Devices Were Affected
The confirmed count remains three implanted Safe 5 devices. Trezor has not reported the outcome of checks on all 48 customers who came forward, nor provided a total number of CryptoBilis devices sold during the relevant period. It is not clear whether additional implanted wallets will be found as those checks continue.
Trezor says no owners of the three confirmed devices have reported losing funds. That is a statement about reports received by the company, not proof that no recovery information was copied or that no later loss could occur. The company has not disclosed how many recovery phrases or passphrases the attackers received, whether the attackers accessed or used any captured information, or who controlled the receiving server.
The source of the implants and the full route by which they entered the devices have not been established in the information Trezor provided. The company says the implant works similarly to those found in Ledger devices, adapted to the Safe 5 display; the shared reseller connection does not by itself establish who carried out the tampering or whether the same people were responsible.
Customer Checks and Firmware Updates
Trezor says it is checking devices belonging to CryptoBilis customers who have come forward and is working with SEAL 911. Customers concerned about a Safe 5 bought through the reseller should follow Trezor’s current guidance and contact the company for assessment; the source material does not describe a reliable self-test that customers can use to rule out physical tampering.
For devices running supported firmware, Trezor says installing version 2.13.1 blocks the implants it has identified from capturing information. The update does not recover or secure a backup already copied. Trezor has not announced a completion date for the customer checks or provided a final count of affected devices, so the scale of the incident may change as the investigation continues.
Key Questions
What did Trezor find inside the three Safe 5 wallets?
Trezor says each contained an extra circuit board between the main board and screen. The board copied recovery words and other information displayed on the screen, then encrypted and transmitted it over a mobile network.
Does the finding affect three Trezor models?
No. Trezor confirmed three individual Safe 5 devices. The company says firmware 2.13.1 is available for the Safe 7, Safe 5, Safe 3 and Model T, but the confirmed implanted devices were Safe 5 wallets.
Does firmware 2.13.1 protect a recovery phrase captured earlier?
No. Trezor says the update blocks the implants it has found from capturing information on updated devices, but it cannot protect a backup already captured before the update.
Have customers reported losing funds from the three confirmed wallets?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not said whether attackers accessed or used any information the implants may have captured.
Are all devices bought through CryptoBilis confirmed to be affected?
No. Trezor has confirmed three implanted devices and says 48 customers have come forward for checks. It has not reported that all those customers’ devices are affected or completed the checks.
Source: ThorstenMeyerAI.com
