Hardware wallet maker Trezor has cut its authorized reseller network by roughly 80% after malicious hardware implants were discovered in three Safe 5 cryptocurrency wallets. Alongside the restructuring, the company shipped a firmware update intended to stop the implants from capturing sensitive wallet information.

In an investigation update published on November 12, 2026, Trezor confirmed that all three compromised devices originated from CryptoBilis, a former reseller in Southeast Asia. Although no customer has reported losing cryptocurrency, the company continues to recommend moving funds into newly created wallets. Trezor detailed its findings in an official investigation update.

Three Compromised Wallets Confirmed

The implants were found in Safe 5 units purchased between August 20 and September 23, 2026, either directly from CryptoBilis or through its storefronts on the Tokopedia and Shopee marketplaces. Trezor physically examined one compromised wallet in its laboratory and identified the two remaining implants from photographs submitted by customers.

After Trezor issued its initial warning in October, 48 CryptoBilis customers contacted the company for assistance. Investigators have found no evidence of tampering in devices purchased from other resellers or in other Trezor models, though the investigation remains ongoing.

How the Implants Harvest Wallet Data

The malicious component is an additional circuit board fitted between the Safe 5's main board and its display. It covertly captures information shown on the screen, including wallet recovery phrases and passphrases, then encrypts the stolen data and transmits it over a mobile network to an attacker-controlled server. If connectivity fails, the implant stores the data and attempts transmission later.

A recovery phrase is the master backup of a hardware wallet: it can regenerate the wallet's keys on any compatible device, which means capturing it amounts to capturing control of the funds it protects, even if the device itself is never touched again.

Notably, the implant does not modify the wallet's original firmware or Secure Element, meaning the device's core security components remain unchanged — a detail that makes the attack particularly concerning, since the modification operates outside the cryptographic core those components protect, harvesting what the screen displays rather than altering the wallet's internal operations.

Firmware Fix and Tighter Supply-Chain Controls

Trezor released firmware version 2.13.1 on November 11 to block the identified implants from capturing additional information. Because the update cannot protect recovery phrases that attackers may already have obtained, the company advises CryptoBilis customers to transfer their cryptocurrency into new wallets with newly generated recovery phrases. The two measures address different risks: the firmware patch stops further capture once installed, while the new wallet protects funds if a recovery phrase has already been exposed. Customers who purchased Trezor devices from CryptoBilis since March 2026 also qualify for replacements.

In parallel, Trezor has removed approximately four-fifths of its reseller network and introduced stricter requirements for device sourcing, storage, and handling. The company emphasized that the dropped partners were not necessarily security threats; the restructuring is designed to strengthen supply-chain protection and reduce opportunities for future hardware tampering. For buyers, the episode is a reminder that a hardware wallet's security depends not only on its cryptography but on the physical path a device travels from factory to purchaser — a path that, when it runs through third-party sellers and marketplace storefronts, sits outside the manufacturer's direct oversight.