🔍 Read the full analysis: Trezor Confirms Hidden Implants In Safe 5 Wallets: Key Details On The Fix on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Trezor says it confirmed hidden circuit-board implants in three Safe 5 hardware wallets purchased through former reseller CryptoBilis. The implants copied recovery words and passphrases displayed on the devices; firmware 2.13.1 blocks the identified implants, but cannot protect information captured before installation of the update. Trezor says no owners have reported losing funds.
Trezor has confirmed hidden implants in three Safe 5 hardware wallets bought through former reseller CryptoBilis, saying the added circuit boards copied recovery words and passphrases shown on the devices and sent the information over a mobile network. The company says firmware 2.13.1 blocks the implants it has identified, but cannot protect recovery information captured before the update; it reports that none of the three owners has lost funds.
Trezor said its laboratory confirmed the implant in a Safe 5 first reported by a customer on October 28. The company later identified two additional implanted devices through photographs supplied by their owners. The three wallets were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor says the devices were individual Safe 5 units, not three different wallet models.
The added board sat between the Safe 5’s main board and screen. According to Trezor’s analysis, it copied what appeared on the screen, including recovery words shown when creating a wallet backup or entered while restoring one, and a passphrase if displayed. The implant encrypted the captured information and transmitted it over a mobile network to a server controlled by the attackers. If it could not connect, Trezor said, it retained the data and tried again later.
Trezor says the implant did not alter the device’s firmware or Secure Element, the dedicated security chip. Firmware version 2.13.1, released November 11, is available for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says it prevents the implants found in this case from capturing information on devices running the update. That protection does not undo any earlier capture: the company warns that a recovery backup obtained before updating may remain exposed.
Trezor says 48 CryptoBilis customers have come forward and their devices are being checked. The figure is the number of customers who contacted the company, not a count of confirmed compromised wallets. Trezor reports that every other device it has checked showed no evidence of tampering, and that checks of devices from its other regional resellers found none. It is working with SEAL 911, the Security Alliance’s emergency response service.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why Captured Recovery Words Matter
A hardware wallet is designed to protect the credentials that control access to cryptocurrency. A recovery phrase can restore a wallet, so someone who obtains it may be able to access funds, depending on the wallet’s setup and any additional passphrase protection. The alleged implant targeted information displayed on the device itself, rather than relying on malware on a connected computer.
The case also highlights a supply-chain risk: a device may be altered after leaving the manufacturer and before reaching a buyer. Trezor says the implant left the firmware and Secure Element unchanged, meaning those components alone would not reveal the extra board. The company’s current warning focuses on where a device was purchased and whether its history is linked to CryptoBilis, rather than claiming that every Safe 5 is affected.
The reported absence of fund losses is encouraging but does not establish that captured information was never accessed or used. Customers who may have entered recovery words on an affected device need to distinguish between a software update that blocks the identified implant and steps addressing a backup that may already have been copied.
Products Worth Considering
Samsung Odyssey OLED G5 27-Inch QHD Gaming Monitor
LG UltraGear 34-inch Curved OLED Gaming Monitor, WQHD 1440p, 240Hz, 0.03ms, 800R
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
Trezor removed CryptoBilis from its reseller network on October 9, 2026. The company said the decision followed Ledger’s investigation into customer losses involving wallets bought from CryptoBilis, then an authorized Ledger reseller in Southeast Asia. In a statement dated October 15, Ledger described the incident as “an attack on the distribution channel after the devices left our control” and said some of its devices had been physically tampered with. That was Ledger’s account of its own case; it did not confirm the Trezor findings.
On October 28, a Trezor customer in Indonesia reported an extra circuit board inside a Safe 5 bought through CryptoBilis on Tokopedia. Before Trezor had examined the device, it issued a customer warning on October 30. Trezor said it acted because waiting for laboratory confirmation could leave buyers exposed. The company’s lab confirmation followed on November 12, after examination of the reported wallet and identification of two more devices through owner-supplied photographs.
Trezor’s October notice described the board as including a cellular module and antenna. Its later analysis said the implant operated by monitoring the display and transmitting captured data. The company said the approach was similar to implants found in Ledger devices but adapted to the Safe 5 screen. The number of confirmed Trezor devices in this account remains three Safe 5 wallets.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
Extent of Exposure Still Under Review
The confirmed count is three implanted Safe 5 devices; it is not yet clear whether additional altered units exist. Trezor says 48 CryptoBilis customers have come forward, but the supplied information does not give the number of those devices examined so far or the final results of those checks. The company’s finding that other checked devices showed no tampering does not establish that every device sold through the reseller has been inspected.
Trezor has not provided details here about how many recovery phrases or passphrases the implants captured, whether the attackers accessed the server holding the encrypted data, or whether any captured information was used. It says no owner of the three confirmed devices has reported losing funds. That statement describes reported losses so far; it does not establish whether any wallet credentials were copied or whether losses could emerge later.
The source material also does not specify how users can independently verify whether a device bought through CryptoBilis contains an implant, beyond checking its purchase history and following Trezor’s guidance. Nor does it explain whether Trezor considers a previously displayed recovery phrase safe after installing the update. Firmware protection and exposure of a backup captured earlier are separate issues.
Customer Checks and Update Guidance
Trezor says it is checking devices belonging to customers who have come forward and is working with SEAL 911. Buyers should follow the company’s current official guidance on affected purchases and firmware updates, and avoid relying on an update alone if recovery information may already have appeared on a compromised device. Trezor’s stated limitation is that firmware 2.13.1 cannot protect a backup captured before the update.
The next public developments to watch are the results of checks on the 48 customers’ devices, any further confirmed implant cases, and updated instructions from Trezor for customers who bought through CryptoBilis. The available account does not say when those checks will be completed or whether the company plans to publish a final investigation report.
Key Questions
How many Trezor wallets has the company confirmed were implanted?
Trezor has confirmed three individual Safe 5 devices. The company identified them through a laboratory examination and photographs from owners.
What information did the implant copy?
According to Trezor, it copied information shown on the Safe 5 screen, including recovery words and any passphrase displayed. It encrypted the data and sent it over a mobile network.
Does firmware 2.13.1 protect a backup captured earlier?
No. Trezor says the update blocks the implants it found from capturing information on updated devices, but cannot protect a backup captured before installation.
Have the owners reported losing funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not said whether captured information was accessed or used.
Are all Safe 5 wallets affected?
No such finding has been reported. Trezor confirmed three Safe 5 units linked to CryptoBilis and says other devices it checked showed no evidence of tampering. It is still checking devices from customers who have come forward.
Source: ThorstenMeyerAI.com
