Trezor has confirmed that malicious hardware implants were present in three Safe 5 wallets sold through Southeast Asian reseller CryptoBilis, broadening an investigation into compromised devices capable of stealing recovery phrases — the secret phrases that restore and control access to a wallet — and transmitting them to attackers.

According to the company's investigation update, the three affected wallets were purchased between August 20 and September 23, 2026, through CryptoBilis storefronts on Tokopedia and Shopee or directly from the reseller. Trezor examined one device in its laboratory and identified the other two through photographs supplied by their owners.

Since the investigation began, Trezor has received reports from 48 CryptoBilis customers. No additional implants have been identified among the devices examined so far, and no customers have reported losing funds.

Alongside its findings, Trezor released firmware version 2.13.1 on November 11 to neutralize the identified implants. The company has also cut its authorized reseller network by approximately 80%, introducing stricter controls over how devices are stored, handled, and distributed — the steps in the supply chain that occur after a wallet leaves Trezor's production line and before it reaches a buyer, outside the manufacturer's direct oversight.

Hidden Hardware Captured Recovery Phrases

The attack relied on an extra circuit board concealed between the Safe 5's main board and its touchscreen. Fitted with a cellular modem and antenna, the component could secretly copy information shown on the device's screen, including recovery phrases and passphrases.

Captured data was encrypted and transmitted over mobile networks to a server controlled by the attacker. When no connection was available, the implant stored the information and repeatedly attempted transmission until it succeeded.

The modification operated independently of the wallet's firmware and Secure Element, meaning attackers could gather sensitive information without altering the device's signing software. That distinction is significant because hardware wallets are built on the premise that secrets remain isolated within their own components; in this case, the data was siphoned out through added hardware rather than by breaking the signing software itself.

The discovery follows a separate wallet-drain investigation centered on Ledger devices sold through the same retailer, where similar hidden components were used to intercept recovery phrases during wallet initialization. Trezor removed CryptoBilis from its authorized reseller network on October 9, after Ledger began examining compromised devices distributed by the reseller. The manufacturer subsequently announced plans to shrink its reseller network before receiving the first report involving one of its own products on October 28.

Firmware Update Does Not Erase Previous Exposure

Firmware 2.13.1 prevents the identified implants from capturing further information on updated devices, but it cannot protect recovery phrases or passphrases already collected before installation. Customers who purchased any Trezor wallet through CryptoBilis from March 2026 onward — a window stretching back several months before the confirmed implant purchases — have therefore been instructed to move their assets to a new wallet secured by a freshly generated recovery phrase. Simply updating the firmware, or restoring an existing recovery phrase on another device, does not remove the potential exposure, since a phrase that has already been copied remains compromised wherever it is later used.

Those customers qualify for replacement devices through Trezor Support. Depending on shipping restrictions, the company may provide an alternative model, arrange delivery to another country, or issue a refund.

Trezor has found no evidence of compromised devices from other resellers, nor implants affecting models beyond the Safe 5. The investigation remains ongoing, with assistance from the Security Alliance's SEAL 911 emergency response service, an industry initiative that connects crypto theft victims with incident responders. The company has not indicated when the review will conclude.

The company has also cautioned customers to watch out for fraudulent replacement offers and phishing attempts, stressing that its support team will never ask for recovery phrases or private keys and that official Trezor channels remain the reliable source for updates on the case.