Overview
- Trezor said a responsible disclosure on October 28 prompted an inspection of 48 Safe 5 units and confirmed three devices sold through CryptoBilis between August 20 and September 23 carried extra circuit boards with cellular modules.
- The unauthorized boards were placed between each device’s main board and display so they could record recovery phrases shown during setup and transmit them over mobile networks.
- Trezor shipped firmware version 2.13.1 on November 11 to change the device’s display command sequence and prevent the implants from capturing future on‑screen secrets.
- The company has advised buyers who purchased from CryptoBilis to move funds to new wallets with fresh seed phrases, to leave unused devices uninitialized, and to contact support for replacement or refund options; Trezor reports no customer losses so far.
- The discovery follows earlier reports of similar implants linked to CryptoBilis on Ledger units and has led Trezor to cut about 80% of its reseller network and tighten sourcing, storage, and access controls across its channels.