🔍 Read the full analysis: Trezor Details A Fix After Finding Hidden Implants In Three Safe 5 Wallets on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor confirmed that three Safe 5 hardware wallets sold through former reseller CryptoBilis contained an added circuit board designed to capture information shown on the device screen and transmit it over a mobile network. Trezor says firmware 2.13.1 blocks the implants it identified, but cannot protect recovery words captured before installation; no fund losses have been reported to the company.
Trezor confirmed on November 12 that three of its Safe 5 hardware wallets bought through former authorized reseller CryptoBilis contained an added circuit board designed to capture information shown on the device screen and send it over a mobile network. The company says its November 11 firmware update, version 2.13.1, stops the implants it has identified from capturing data on devices running the update, but cannot protect recovery words that may have been captured earlier.
Trezor said its lab examined a Safe 5 first reported by a customer and confirmed an implant. Two further cases were identified from photographs supplied by owners. The three devices were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee storefronts or directly from the reseller. Trezor said the added board was fitted between the wallet’s main board and screen.
According to Trezor’s analysis of the implant, it copies information shown on the screen, including recovery words displayed during wallet setup or entered when restoring a wallet. The company says it can also capture a passphrase if one appears on the display. It encrypts the collected information and sends it to a server over a mobile network; if it cannot connect, it stores the data and tries again. Trezor says the implant does not alter the device firmware or its Secure Element, the dedicated security chip.
No customer has reported losing funds, Trezor said. The company reported that 48 CryptoBilis customers had come forward and that their devices were being checked. It also said that every other device it had checked showed no evidence of tampering, as did devices examined from other regional resellers. Trezor is working with SEAL 911, an emergency response service run by the Security Alliance.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
A Screen-Based Route to Recovery Words
The reported method targets information that users rely on a hardware wallet to keep private. Recovery words can provide access to a wallet, while a passphrase may add another layer of protection. If an attacker obtains those details, updating a device afterward cannot make information already copied private again. Trezor’s warning about previously captured backups is therefore separate from the protection offered by its firmware patch.
The case also shows why a device’s software status alone may not reveal a physical modification. Trezor says the implant leaves the firmware and Secure Element unchanged while copying what appears on the screen. That makes the point of sale relevant: the confirmed devices came through one former reseller, rather than from the broader set of devices Trezor says it checked. The company has not said that all CryptoBilis devices are affected.
Products Worth Considering
LG UltraGear 45GX950A-B 45-Inch 5K2K Curved OLED Gaming Monitor
Bose SoundLink Max Portable Bluetooth Speaker, IP67 Waterproof and Dustproof, Up to 20 Hours of Battery Life, Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
The case followed a separate investigation involving CryptoBilis. Trezor said Ledger began investigating customer fund losses involving wallets purchased from the reseller on October 9. Ledger later said some devices sold through CryptoBilis had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis had also been an authorized Trezor reseller; Trezor says it removed the company from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an added circuit board in a Safe 5 bought from CryptoBilis through Tokopedia. Trezor warned customers on October 30, before its lab had examined the reported unit, saying it did not want to leave buyers exposed while confirmation was pending. The company announced its confirmation on November 12, after examining the device and reviewing photographs of two others. Its firmware changelog dates version 2.13.1 to November 11 and lists the Safe 7, Safe 5, Safe 3 and Model T as supported devices.
““It only listens.””
— Trezor, describing what the implant does
How Many Devices Were Affected?
The confirmed count is three Safe 5 devices, not three Trezor models or a verified count of every affected wallet. Trezor has not established how many devices, if any, beyond those three carry an implant. The 48 CryptoBilis customers who contacted the company are being checked, but the source material does not give the results of those inspections.
The company has not reported customer fund losses, but that does not establish whether any recovery words or passphrases were captured or whether collected data was accessed by attackers. Trezor says the implant sends encrypted information to an attacker-controlled server; the available account does not state whether investigators located that server, determined who operated it, or established what happened to any data it received.
Trezor’s finding that other checked devices showed no tampering is limited to the devices examined. The company has not provided a complete public tally of those checks or a method customers can use to determine whether an unexamined wallet was physically modified.
Customer Checks and Firmware Updates
Trezor says it is checking devices from CryptoBilis customers who have come forward and is working with SEAL 911. Owners of supported devices can install firmware 2.13.1, which Trezor says blocks the implants it has found from capturing information on devices running the update. The company warns that updating cannot undo an earlier capture.
Customers who believe their wallet came through CryptoBilis should follow Trezor’s published guidance and contact the company for a device check rather than assume the update resolves any prior exposure. If recovery words or a passphrase may have been captured, the firmware change alone does not address that risk. Further information is needed on the inspections of the 48 customers’ devices, whether additional implants are found, and whether investigators can establish what happened to information sent from the confirmed devices.
Key Questions
What did Trezor find in the three Safe 5 wallets?
Trezor says each had an extra circuit board fitted between the main board and screen. The company says the board copied information displayed on the screen and transmitted it over a mobile network.
What information could the implant capture?
According to Trezor, it could capture recovery words shown during wallet setup or typed during restoration, as well as a passphrase if it appeared on the screen. Trezor says the implant encrypted the captured data before sending it.
Does firmware 2.13.1 protect every affected wallet?
Trezor says version 2.13.1 stops the implants it identified from capturing information on devices running the update. It also says the update cannot protect a backup captured before installation.
Have customers reported losing funds?
Trezor says no customer has reported fund losses in connection with the confirmed devices. The company has not said whether any recovery words or passphrases were captured or accessed.
Were all CryptoBilis wallets affected?
No such finding has been reported. Trezor confirmed three Safe 5 devices and said 48 CryptoBilis customers had come forward for checks. It has not established how many other devices, if any, were modified.
Source: ThorstenMeyerAI.com
