🔍 Read the full analysis: Trezor On Hidden Implants In Safe 5 Wallets: What Its Fix Can Do on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor confirmed that three Safe 5 hardware wallets bought through reseller CryptoBilis contained circuit-board implants that copied information shown on their screens, including recovery words. Firmware 2.13.1, released November 11, blocks the implants Trezor has identified on updated devices, but cannot protect a backup captured before installation. Trezor says no owners of the three confirmed devices have reported losing funds.
Trezor has confirmed implants in three Safe 5 hardware wallets bought through the former reseller CryptoBilis, saying the added circuit boards copied recovery words and other information displayed on the devices. The company says firmware 2.13.1, released November 11, blocks the implants it has identified on updated devices, but cannot protect wallet backups captured before the update.
Trezor said its laboratory examined one Safe 5 after a customer reported an extra circuit board through the company’s responsible disclosure program. The company then identified two more implanted devices from photos provided by their owners. All three were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor says the confirmed cases involve three individual Safe 5 devices, not three different wallet models.
According to Trezor’s analysis of the implant, the board sits between the wallet’s main board and screen. It copies information shown on the screen, including recovery words when users create or restore a wallet and a passphrase if one appears. The implant encrypts the captured information and sends it over a mobile network to a server controlled by the attackers. If it cannot connect, Trezor says, it stores the information and tries again later.
Trezor says the implant does not alter the wallet’s firmware or its Secure Element, the device’s security chip. The company reports that none of the owners of the three confirmed devices has lost funds. It also says 48 CryptoBilis customers have come forward and their devices are being checked. Trezor is working with SEAL 911, an emergency response service run by the Security Alliance.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
The Update Has a Backup Limit
The case matters because the implant targeted information displayed directly by a device intended to protect wallet secrets. According to Trezor, it could capture recovery words during both wallet setup and recovery. Someone who obtains those words may be able to access the associated wallet; a passphrase could also have been exposed if it appeared on the screen. Trezor has not reported confirmed losses among the three owners, and the extent of any data transmission or access is not established in the supplied information.
Firmware 2.13.1 addresses future capture by the identified implants, according to the company, but it does not undo a possible earlier capture. Trezor’s warning is especially relevant to people who entered or displayed recovery words on a device bought through CryptoBilis before updating. An update cannot make information already copied disappear from an attacker-controlled system, if it was transmitted. The source material does not establish whether the captured information was used or whether any attacker accessed funds.
The incident also highlights a limitation of relying on software checks alone. Trezor says the implant leaves the firmware and Secure Element unchanged, so those components would not show the alteration described by the company. That observation follows from Trezor’s account of the implant; it is not a separate test or conclusion published by the company in the supplied material.
Products Worth Considering
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
LG UltraGear 45GX950A-B 45-Inch 5K2K Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From CryptoBilis Report to Confirmation
Trezor removed CryptoBilis from its reseller network on October 9, 2026, according to the company. The reseller had also been authorized to sell Ledger products. Ledger began investigating customer fund losses tied to wallets bought through CryptoBilis that day and later said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” That account concerns Ledger’s investigation and should not be treated as evidence that the three Trezor owners lost funds.
On October 28, a Trezor customer in Indonesia reported an extra board inside a Safe 5 bought from CryptoBilis in August through Tokopedia. Trezor warned customers on October 30, before it had examined that device in its laboratory, saying it did not want buyers to remain exposed while confirmation was pending. The company said laboratory analysis confirmed the report on November 12 and that photos led it to identify two more Safe 5s.
Trezor says every other device it has checked showed no evidence of tampering, and that its checks of devices from other regional resellers found none. The company also says it has cut its reseller network by about 80%. These are company-reported findings; the source material does not provide a complete number of devices examined or the method used to select them.
“It only listens.”
— Trezor
Scope of Exposure Still Under Review
The number of potentially affected Trezor wallets remains unclear. Three Safe 5 devices are confirmed, while 48 CryptoBilis customers have come forward and their devices are being checked. Trezor has not provided, in the source material, a final count of examined devices or a full accounting of how many CryptoBilis customers bought Safe 5s during the relevant period.
It is also unclear whether the implants successfully transmitted captured information, what information attackers received, or whether anyone used it to access a wallet. Trezor reports no fund losses among the owners of the three confirmed devices, but that does not establish whether data was copied or whether other devices are affected. The company has not supplied an independent confirmation of its findings in the material provided.
Trezor’s firmware statement applies to the implants it has found. The available information does not establish that the update detects or blocks every possible form of physical tampering. It also does not recover or invalidate recovery words that may have been captured before installation.
Customer Checks and Firmware Updates
Trezor says it is checking devices belonging to customers who have come forward and is working with SEAL 911 on the response. Owners who bought a wallet through CryptoBilis can consult Trezor’s official guidance and contact the company to establish what checks are available for their device. The company has not provided a final timeline for completing customer checks in the source material.
Trezor released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. The company says the release prevents the implants it has identified from capturing information on devices running the update. The update does not resolve possible exposure from an earlier backup, so Trezor’s warning about previously captured information remains in effect.
The next clear milestone is a fuller account from Trezor as it examines more customer devices and reports the scope of its findings. Until then, the confirmed count remains three implanted Safe 5 wallets, while the number of devices that may require checks is not settled.
Key Questions
What did Trezor find inside the Safe 5 wallets?
Trezor says three Safe 5 devices contained an extra circuit board fitted between the main board and the screen. According to its analysis, the board copied information displayed on the screen, including recovery words and, if shown, a passphrase.
Does firmware 2.13.1 stop the implant?
Trezor says firmware 2.13.1 stops the implants it has identified from capturing information on devices running the update. The company does not say the update can protect information captured before installation or address every possible form of physical tampering.
Have owners of the confirmed devices lost funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not established in the supplied information whether captured data was transmitted or used.
How many CryptoBilis customers may be affected?
Trezor says 48 CryptoBilis customers have come forward and their devices are being checked. Three implanted Safe 5s are confirmed, but the total number of potentially affected devices is not yet known.
When and where were the confirmed wallets bought?
Trezor says the three devices were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia or Shopee stores or directly from the reseller. The company removed CryptoBilis from its reseller network on October 9.
Source: ThorstenMeyerAI.com
