Overview
- Trezor confirmed that three Safe 5 hardware wallets sold through Southeast Asian reseller CryptoBilis contained hidden cellular implants, with the devices purchased between August 20 and September 23, 2026.
- The implant is an extra circuit board placed between the Safe 5 main board and its display that watches on‑screen activity, copies recovery words and passphrases, encrypts them, and transmits them over mobile networks to attacker servers.
- Trezor released firmware version 2.13.1 on November 11, 2026 to change the device’s screen command sequence and block the known implants from capturing new data, but the company warns the update cannot protect recovery phrases already captured.
- Since first flagging a suspected implant in late October, Trezor has heard from 48 CryptoBilis buyers, inspected devices in its lab or from photos, confirmed only three implanted units so far, reported no customer fund losses, and removed CryptoBilis as an authorized seller on October 9.
- The case follows earlier confirmed implants in Ledger devices tied to the same reseller and has prompted Trezor to cut its global reseller network by roughly 80%, tighten sourcing and storage rules, and offer replacements or refunds to buyers who purchased from CryptoBilis since March 2026.