🔍 Read the full analysis: How To Understand Trezor’s Response To Hidden Safe 5 Wallet Implants on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Trezor says it confirmed implants in three Safe 5 hardware wallets bought through former reseller CryptoBilis. The devices copied recovery words and any passphrase shown on-screen, then sent the captured data over a mobile network; Trezor says firmware 2.13.1 blocks the implants it has identified but cannot protect backups captured before installation of the update.
Trezor confirmed on November 12 that three of its Safe 5 hardware wallets, all bought through former reseller CryptoBilis, contained hidden circuit boards that captured recovery information displayed on the devices. The company says firmware 2.13.1, released a day earlier, blocks the implants it has identified, but cannot protect wallet backups captured before the update.
Trezor says its laboratory examined the device first reported by a customer and confirmed the implant. It identified two additional Safe 5 devices after their owners sent photographs. The three were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. They are three individual devices of one model, not three different wallet models.
According to Trezor’s analysis, the implant is an extra circuit board placed between the Safe 5’s main board and its screen. It copies information shown on the display, including recovery words when a wallet is created or restored, and a passphrase if one appears there. The implant encrypts the captured information and sends it over a mobile network to a server controlled by the attackers, Trezor says. If it cannot connect, it stores the data and tries again later.
Trezor says the implant does not alter the device’s firmware or Secure Element, the dedicated security chip. The company reports that no owner of the three confirmed devices has reported losing funds. It says 48 CryptoBilis customers have come forward and their devices are being checked. Trezor is working with SEAL 911, the Security Alliance’s emergency response service.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why the Screen Became a Target
The incident matters because a hardware wallet’s screen is meant to let users check sensitive actions on the device itself rather than trust information displayed by a connected computer. In Trezor’s account, the implant sits on the display path and copies what the screen shows. That means it can capture recovery information even while leaving the wallet’s firmware and security chip unchanged.
This also limits what a software authenticity check can establish. Trezor says those components were not altered; the implant is an additional physical part. The observation that checks focused only on firmware or the Secure Element may miss this kind of modification is an implication of the described design, not a direct Trezor finding. For customers, purchase history is therefore central: Trezor’s warning is tied to devices sourced through CryptoBilis, rather than to all Safe 5 wallets.
The immediate risk is not the confirmed device count alone but the sensitivity of the captured data. Recovery words can provide access to a wallet, and a passphrase may add another layer if used. Trezor says the update stops the identified implants from capturing information on updated devices, but information copied before the update remains outside that protection.
Products Worth Considering
FLEXISPOT Electric Adjustable Workbench, 48 x 30 in, Maple
Samsung 32-Inch 4K UHD VA Monitor with AMD FreeSync
Dell XPS Tower 8960 Desktop, Intel Core i7-13700, NVIDIA GeForce RTX 4060, 16GB DDR5, 512GB SSD
As an affiliate, we earn on qualifying purchases.
From CryptoBilis Alert to Confirmation
The case followed reports involving another wallet brand. Trezor says Ledger began investigating customer fund losses linked to devices bought through CryptoBilis on October 9. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis was also an authorized Trezor reseller, and Trezor says it removed the company from its reseller network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra board inside a Safe 5 bought from CryptoBilis through Tokopedia. Trezor said it treated the report as credible before its laboratory had examined the device and issued a customer warning on October 30. The company’s confirmation followed on November 12, after examining the reported wallet and reviewing photographs of two more devices.
Trezor says every other device it has checked showed no evidence of tampering, and that checks of devices from its other resellers in the region found none. It also says it has reduced its reseller network by about 80%. That figure is Trezor’s reported change; the source material does not specify the precise counting method or time period.
“It only listens.”
— Trezor, describing the implant’s operation
What the Device Checks Cannot Show
The known scope remains limited to three confirmed Safe 5 devices. Trezor has not reported how many CryptoBilis devices it has examined in total, how many of the 48 customers who came forward have completed checks, or whether more implanted wallets will be found. The company’s checks of other devices and resellers found no evidence of tampering, but the available account does not establish that every device from every source has been inspected.
Trezor’s account describes how the implant captures and transmits data, but the source material does not identify the attackers, say how many recovery backups were successfully received by their server, or establish whether any captured information was used. No owners of the three confirmed devices have reported losses, according to Trezor; that does not confirm whether data was copied or accessed by the attackers.
The available information also does not give a complete customer-level method for determining whether a specific device is affected. Trezor’s warning centers on where the wallet was purchased. Anyone concerned about a device tied to CryptoBilis should rely on Trezor’s current instructions rather than assume that an unchanged firmware check rules out a physical implant.
Checks and Firmware Rollout
Trezor says customers’ devices are being checked and that it is working with SEAL 911 on the response. Firmware 2.13.1 was released November 11 for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says the update stops the implants it has found from capturing information on devices running the new firmware. Customers should consult Trezor’s official guidance for update and device-check instructions, particularly if their wallet came through CryptoBilis.
The next public developments to watch are the results of checks among the 48 customers who have come forward, any further confirmed devices, and Trezor’s updates on the scope of the incident. The company’s statements so far do not resolve whether attackers obtained or used captured recovery information. Installing the update addresses the identified implant’s ability to capture information going forward, but it cannot reverse any earlier exposure.
Key Questions
How many Trezor wallets were confirmed to contain implants?
Trezor confirmed three individual Safe 5 devices. They were all the same model, bought through CryptoBilis between August 20 and September 23, 2026.
What information did the implant copy?
According to Trezor, it copied information shown on the device screen, including recovery words during wallet creation or restoration and a passphrase if one appeared on-screen. It then encrypted and sent the captured data over a mobile network.
Does firmware 2.13.1 protect information captured earlier?
No. Trezor says the update blocks the implants it has identified from capturing information on devices running the firmware, but cannot protect a backup captured before the update.
Have the confirmed devices been linked to reported fund losses?
Trezor says no owner of the three confirmed devices has reported losing funds. The company has not stated whether any recovery information was successfully received or used by the attackers.
What should a CryptoBilis customer do?
Check Trezor’s official incident guidance and contact the company about a device bought through CryptoBilis. Trezor says 48 customers have come forward and their wallets are being checked; its source material does not provide a complete self-test for identifying an implant.
Source: ThorstenMeyerAI.com
