Hardware crypto wallet manufacturer Trezor has published the results of an investigation into malicious hardware implants in Safe 5 devices purchased from the reseller CryptoBilis.
The company confirmed three cases of interference and released a firmware update that blocks data collection by the identified modules. The incident concerns the security of private keys and seed phrases that provide access to users' cryptocurrency assets.
According to Trezor, all three devices were purchased between August 20 and September 23, 2026, through CryptoBilis stores on Tokopedia and Shopee or directly from a reseller. The company examined one wallet in its own laboratory, and identified the other two from photographs of internal components sent by the owners.
TOP 15 cold wallets: understanding what they are and choosing the best wallet
07.07.2026
Read
Following October reports of possible tampering, Trezor asked CryptoBilis customers to contact support. The company has currently received 48 inquiries and is checking the devices. It also examined wallets from other resellers in the region but found no signs of substitution. According to the manufacturer, no customer has reported a loss of funds.
How the implant works and what it can steal
The Trezor team investigated the firmware of the discovered module. It is an additional board installed between the main board of the Safe 5 device and its screen. The implant does not alter the wallet's operation but only reads the information displayed on the screen, including data entered by the user.
When the wallet recovery words appear on the screen, the module recognizes and stores them. This applies both to the seed phrase that the device displays when creating a backup and to the words that the user enters to restore an existing wallet. Likewise, the implant can intercept the passphrase if it is displayed on the screen.
The module encrypts the collected information and transmits it via the mobile network to the attackers' server. If it fails to connect, it stores the data and retries transmission. Trezor noted that the implant's principle of operation is similar to modules previously found in Ledger devices, but adapted to the Safe 5 design.
Trezor updated its firmware and strengthened control over resellers
On November 11, 2026, the company released firmware version 2.13.1. It contains protection that prevents detected implants from collecting information on devices with this update. At the same time, the manufacturer emphasizes: the update cannot protect the seed phrase if it was already intercepted before installing the new firmware.
Therefore, users who purchased a wallet through CryptoBilis and have already set it up are advised to transfer their assets to a new wallet with a new seed phrase as soon as possible. Reusing the old phrase is not allowed — even on a different hardware or software wallet. If there is no other secure hardware device, Trezor advises temporarily using a familiar software wallet or a crypto exchange.
Those who have not yet set up a device purchased from CryptoBilis are advised not to activate it and not to enter on it the backup phrase from an existing wallet.
In addition, Trezor reduced its reseller network by approximately 80%. According to the company, even partners who did not pose a direct threat were excluded due to non-compliance with new, stricter requirements for the supply, storage of devices, and control of access to them.
The company also offers replacement devices to everyone who purchased a Trezor through CryptoBilis since March 2026, and not only to the owners of the three confirmed compromised Safe 5 devices. To arrange a replacement, you must keep the device and contact Trezor support. Depending on the delivery country, customers may be offered a different model with compensation for the price difference, delivery to an address in another country, or a refund.
Recall that Trezor previously removed CryptoBilis from its list of resellers following reports of modified Ledger devices being sold through it. After that, the company began checking Trezor wallets purchased from this seller.
The manufacturer urged users not to share seed phrases with anyone, including individuals posing as support service employees. Trezor emphasizes that its representatives never ask for backup phrases, and issues regarding suspicious devices should be resolved only through the official support service.
Note that Trezor has already reported a data leak affecting over 13,000 customers due to the ShipMonk breach, complained about a new wave of phishing, and reported a breach of a third-party email provider.