Hardware wallet maker Trezor has confirmed that three of its Safe 5 wallets sold by Southeast Asian reseller CryptoBilis contained hidden hardware implants designed to steal their owners' recovery phrases and transmit them to attackers over a mobile network. The company published its investigation findings on November 12, closing a case that began with a single customer's report in late October.
The implant is an extra circuit board slipped between the wallet's main board and its touchscreen, fitted with a cellular modem and antenna. It watches whatever appears on the display and, when a recovery phrase or passphrase shows up, copies it, encrypts it and tries to send it to a server controlled by the attackers. Because the board leaves the wallet's firmware and its Secure Element untouched, the tampered devices looked and behaved exactly like genuine ones.
How the implant worked
Trezor examined one of the three devices in its own laboratory and identified the other two from photographs sent by their owners. All three were bought between August 20 and September 23, 2026, through CryptoBilis's own store and its shops on the marketplaces Tokopedia and Shopee. The implant copies the recovery phrase when the wallet shows it during the creation of a new backup, and again when someone types it in to restore an existing wallet to the device. It can also capture any passphrase displayed on screen.
Forty-eight CryptoBilis customers have contacted Trezor since the company first warned of a suspected implant on October 30, two days after a buyer reported finding an unauthorized board inside a Safe 5. So far the investigation has found implants only in Safe 5 wallets sold through CryptoBilis, with no tampering in any other model and none in wallets from other resellers. None of the three owners has reported losing funds.
Firmware fix, and its limits
On November 11, Trezor released firmware version 2.13.1 for the Safe 7, Safe 5, Safe 3 and Model T. The update changes the order of the commands sent to the display, so the implant's trigger sequence no longer appears and the board records nothing. Trezor says the protection makes the current batch of implants useless on any device that runs the update.
But the company is blunt about the limit: the update cannot protect a recovery phrase that was already captured before it was installed. Its advice to anyone who bought a Trezor from CryptoBilis since March 2026 has not changed — move the assets to a new wallet generated with a fresh recovery phrase. Trezor is providing replacement units to customers who bought devices from CryptoBilis since March 20.
A reseller network cut by 80 percent
CryptoBilis was removed as an authorized reseller on October 9, after Ledger began investigating compromised devices sold through the same retailer. Ledger later confirmed an unauthorized implant in a wallet the reseller sold, and losses linked to those devices reached $93.2 million. Trezor says the implants in its wallets work the same way as the ones found in Ledger devices, adapted to the Safe 5's display.
In response, Trezor has cut its authorized reseller network by about 80 percent, introducing stricter controls over how devices are stored, handled and distributed. It is also working with SEAL 911, a crypto incident-response group, on the response. The episode is a reminder that a hardware wallet's security assumes the device itself is genuine — once the supply chain is compromised, no firmware update or PIN can help. Buying direct from the manufacturer remains the safest route.
By Hamza Faisal
