🔍 Read the full analysis: Inside Trezor’s Fix For Hidden Implants In Three Safe 5 Wallets on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor confirmed that three Safe 5 wallets sold through former reseller CryptoBilis contained extra circuit boards that copied information displayed on the device, including recovery words. Firmware 2.13.1, released November 11, blocks the implants Trezor has identified, but cannot protect information captured before installation; Trezor says no owner of the three confirmed devices has reported losing funds.
Trezor confirmed on November 12 that three Safe 5 hardware wallets bought through former reseller CryptoBilis contained hidden circuit boards that copied information shown on their screens, including wallet recovery words. The company says its firmware 2.13.1 update, released November 11, blocks the implants it has identified, but cannot protect a recovery backup captured before the update.
According to Trezor, each implant was an extra circuit board fitted between the Safe 5’s main board and its screen. The company’s analysis found that the board copied information displayed on the screen, including recovery words shown when creating a backup or entered when restoring a wallet. It could also capture a passphrase if one appeared there. Trezor said the implant encrypted the captured information and sent it over a mobile network to a server controlled by the attackers; if it could not connect, it stored the data and tried again later.
Trezor said the implants did not alter the wallet’s firmware or Secure Element, its dedicated security chip. The three confirmed devices were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor said it identified the devices after examining one wallet reported by a customer and reviewing photos of two more.
Firmware version 2.13.1 was released November 11 for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says it prevents the implants it has found from capturing information on devices running the update. The company also reported that no owner of the three confirmed wallets had reported losing funds. Forty-eight CryptoBilis customers had come forward, and Trezor said their devices were being checked. It is also working with SEAL 911, the Security Alliance’s emergency response service.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Recovery Words Were Exposed on Screen
The incident targets a key part of a hardware wallet’s security model: users rely on the device itself to display and handle sensitive wallet information. Trezor says the implant copied that display output without changing the firmware or Secure Element. That means a software check alone may not reveal a physical component inserted along the screen’s connection, although Trezor has not said that every check would fail to detect one.
The practical risk is greatest for anyone whose recovery words or passphrase may have appeared on an affected device before it received the update. Installing the firmware cannot undo a prior capture, and Trezor expressly warns that the update cannot protect a backup already taken. The company has not reported confirmed fund losses from the three wallets, but the absence of reported losses does not establish that previously captured information was never accessed or used.
Products Worth Considering
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Blush
Samsung 27-Inch S3 FHD IPS Monitor, 120Hz
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
From CryptoBilis Warning to Lab Confirmation
Trezor removed CryptoBilis from its reseller network on October 9, 2026. The company said the action followed an investigation by Ledger into fund losses involving customers who had bought wallets from the same reseller. Ledger, which had also authorized CryptoBilis, said on October 15 that devices had been physically tampered with and described the incident as “an attack on the distribution channel after the devices left our control.” That statement concerned Ledger’s investigation; it is not evidence that the same customers or devices suffered losses involving Trezor wallets.
On October 28, a Trezor customer in Indonesia reported an extra board inside a Safe 5 purchased from CryptoBilis through Tokopedia. Trezor issued a customer warning on October 30, before it had examined the device in its lab. The company said it acted on the report because waiting for lab confirmation would leave buyers exposed. The lab later examined that wallet, while photos supplied by two other owners led to the confirmation of three implanted Safe 5 devices.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
Scope and Prior Data Access
The confirmed count is three individual Safe 5 wallets, not three different wallet models. Trezor says it is checking devices belonging to 48 customers who came forward, but the available information does not establish how many additional devices were sold, whether more were implanted, or how many buyers may still need to contact the company. Trezor said devices it had checked outside the confirmed cases showed no evidence of tampering, including devices from other regional resellers.
The company has not provided details in the supplied information about the attackers’ identities, the server receiving the captured data, whether any collected recovery words were retrieved or used, or the full period during which the implants were active. It also has not reported a customer loss linked to the three confirmed Trezor devices. Those points remain distinct from Ledger’s reported losses involving its own customers.
Checks for CryptoBilis Buyers
Trezor’s immediate next step is to continue examining devices reported by CryptoBilis customers and coordinating with SEAL 911. Owners who bought a wallet through the reseller should follow Trezor’s official guidance and contact the company through its support or disclosure channels rather than assume that a firmware update resolves any earlier exposure.
The company says version 2.13.1 blocks the implants it has identified on devices running the update. Further updates from Trezor may clarify the checks on customer devices, the number of wallets involved and whether investigators found evidence that captured information was used. Until then, the confirmed scope remains three Safe 5 wallets, with the broader review ongoing.
Key Questions
How many Trezor wallets were confirmed to have implants?
Trezor confirmed three individual Safe 5 devices. The finding does not mean three different wallet models were affected.
What information did the implant copy?
Trezor says it copied information shown on the device screen, including recovery words during wallet creation or restoration and a passphrase if one appeared there.
Does firmware 2.13.1 protect information captured earlier?
No. Trezor says the update blocks the identified implants from capturing information on updated devices, but cannot protect a backup captured before installation.
Has Trezor reported losses from the three confirmed devices?
Trezor said no owner of the three confirmed wallets had reported losing funds. It has not established in the supplied information whether any previously captured data was accessed or used.
What should CryptoBilis customers do?
Trezor says it is checking devices from customers who have come forward. Buyers should consult Trezor’s official guidance and contact its support channels for instructions specific to their device and purchase.
Source: ThorstenMeyerAI.com
