Overview
- Trezor confirmed on November 12 that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis carried unauthorized circuit boards that read recovery phrases from the device display and send them over mobile networks.
- Engineers found the implants sit between the Safe 5 main board and its screen so they do not change the device firmware or secure element and can pass normal authenticity checks without detection.
- Trezor released firmware 2.13.1 on November 11 to block the implants from capturing future backups but warned the update cannot protect recovery phrases that may already have been exfiltrated.
- The company has inspected 48 customer‑reported devices so far, has confirmed no tampering outside the three Safe 5 units sold through CryptoBilis, and has cut about 80% of its reseller network and tightened partner controls.
- Investigations and forensic tracing continue and the episode highlights broader risks in hardware‑wallet supply chains, urges affected buyers to contact Trezor support for replacements or refunds, and signals cross‑vendor coordination after similar implants were linked to Ledger devices sold by the same reseller.