🔍 Read the full analysis: Trezor Safe 5 Wallets: Understanding The Hidden Implant Issue And Fix on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Trezor says three Safe 5 wallets sold through former reseller CryptoBilis contained an extra circuit board that copied recovery words and passphrases displayed on the device, then sent the captured data over a mobile network. Firmware 2.13.1, released November 11, blocks the implants Trezor has identified, but cannot protect recovery data captured before installation; the company says no affected owner has reported losing funds.
Trezor confirmed that three of its Safe 5 hardware wallets, bought from former Southeast Asian reseller CryptoBilis, contained an extra circuit board that captured recovery words and passphrases displayed on the device. The company says firmware 2.13.1 blocks the implants it has identified, but the update cannot undo exposure if a wallet backup was captured before the firmware was installed.
Trezor said on November 12 that its laboratory examined one Safe 5 after a customer reported suspicious hardware and confirmed the implant. Two more implanted devices were identified from photographs provided by their owners. The three wallets were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor said it removed CryptoBilis from its reseller network on October 9.
According to Trezor’s analysis, the implant is a small board installed between the wallet’s main board and screen. It copies information displayed on the screen, including recovery words shown when creating a backup or entered when restoring a wallet, and a passphrase if one appears. The implant encrypts the captured information and sends it over a mobile network to a server controlled by the attackers; if it cannot connect, Trezor says, it stores the data and tries again later.
Trezor says the implant does not alter the device’s firmware or Secure Element, the dedicated security chip. The company released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. It says the release prevents the implants it has found from capturing information on updated devices. Trezor reported no customer losses from the three confirmed devices and said 48 CryptoBilis customers have come forward to have their devices checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why the Recovery Words Are at Risk
A recovery phrase can provide access to the wallet’s funds, so a copy obtained outside the device’s intended security process may put assets at risk. The case is unusual in the way Trezor describes it: the implant listens to the device’s screen and transmits what it captures, while leaving the firmware and security chip unchanged. That means a check focused only on those components would not, on its own, address the physical modification Trezor identified.
The immediate fix has an important limit. Updating firmware may prevent the identified implant from capturing information going forward, according to Trezor, but it cannot retrieve or erase data that may already have been sent. Anyone whose recovery words or passphrase appeared on an affected device before the update faces a different concern from someone whose device was not tampered with. Trezor has not reported losses among the three owners, but that does not establish whether captured data was accessed or used.
The incident also makes the purchase route relevant to device security. Trezor said the confirmed wallets all came through CryptoBilis, while checks of other devices it examined and devices from its other regional resellers found no evidence of tampering. The company said it has reduced its reseller network by about 80%; the supplied information does not specify the exact period or calculation behind that figure.
Popular right now
eufy E25 Robot Vacuum and Mop with HydroJet Roller Mop, 20,000 Pa Suction
Bose QuietComfort Wireless Bluetooth Headphones – Active Over‑Ear Noise Cancelling with Mic, USB‑C Charging, Deep Bass, up to 24 h Playtime,
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
The issue emerged amid a separate investigation involving CryptoBilis. According to Trezor, on October 9 Ledger began investigating customer fund losses among people who bought hardware wallets from the reseller. Ledger later confirmed physical tampering in some devices. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis had also been an authorized Trezor reseller, and Trezor said it removed the company from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra circuit board inside a Safe 5 bought from CryptoBilis in August through Tokopedia. Before it had examined the device, Trezor issued a warning on October 30, saying it did not want to leave buyers exposed while it waited for laboratory confirmation. The company’s lab later examined that wallet; photos from two other owners led to the additional confirmed cases.
Trezor says it is working with SEAL 911, the Security Alliance’s emergency response service. Its account describes the Safe 5 implant as operating in a similar way to implants found in Ledger devices, adapted to the Safe 5 screen. Those findings are Trezor’s account of its analysis; the supplied material does not include an independent technical report or a statement from the alleged attackers.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor, on the limit of the firmware update
What the Investigation Has Not Established
Trezor has confirmed three implanted Safe 5 devices, but it has not said how many additional tampered wallets may exist. The company said 48 CryptoBilis customers had come forward and their devices were being checked; the supplied information does not give the results of those checks. Trezor also said every other device it had checked showed no evidence of tampering, but did not specify the total number examined.
It is not clear whether the captured information from the three confirmed devices reached the attackers’ server, whether it was accessed or used, or whether any recovery phrases were exposed before the update. Trezor says no owner of the three devices has reported losing funds. The identity of the attackers, the full extent of the distribution-channel operation and the precise number of devices involved have not been established in the provided material.
The firmware protection is described by Trezor as stopping the implants it has found. The available information does not establish whether it would block every possible hardware modification or address a different implant design. Customers should treat that wording as a claim about the known implants, not a guarantee against all forms of physical tampering.
Device Checks and Firmware Updates
Trezor says it is checking devices reported by CryptoBilis customers and coordinating with SEAL 911. Owners who bought a Safe 5 through CryptoBilis should consult Trezor’s current guidance and contact the company about having the device assessed; the source material does not provide a separate testing method consumers can use to identify the implant themselves. Trezor’s reseller guidance is based on where a device was purchased.
Owners should also check whether their supported device is running firmware 2.13.1, released November 11 for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says the update blocks capture by the implants it identified. Anyone with reason to believe their recovery words or passphrase appeared on a tampered device before updating should not assume the update has made previously captured information safe; they should seek guidance from Trezor about next steps.
The next public milestones are the results of further device checks and any updated guidance from Trezor or investigators. Until those results are available, the confirmed count remains three, the company’s reported loss status remains no customer losses among those owners, and the broader scale of the tampering is unresolved.
Key Questions
How many Trezor Safe 5 wallets did Trezor confirm were implanted?
Trezor confirmed three individual Safe 5 devices. The finding does not mean three different wallet models were affected.
What information did the implant capture?
According to Trezor, it copied information shown on the screen, including recovery words and any passphrase displayed, then encrypted and sent the data over a mobile network.
Does firmware 2.13.1 protect an already exposed recovery phrase?
No. Trezor says the update blocks the implants it has identified from capturing information on updated devices, but cannot protect a backup captured before installation.
Have owners of the three confirmed wallets lost funds?
Trezor says none of the three owners has reported losing funds. The company has not established in the supplied information whether captured data was accessed or used.
What should a CryptoBilis customer do?
Check Trezor’s current guidance and contact the company about an assessment, particularly if the device was bought through CryptoBilis. Trezor says it is checking devices from customers who have come forward; the supplied material does not describe a reliable self-test.
Source: ThorstenMeyerAI.com
