Trezor confirms implants in three Safe 5 wallets sold by CryptoBilis, ships firmware 2.13.1

Trezor has confirmed that three Safe 5 hardware wallets sold by Southeast Asian reseller CryptoBilis carried malicious hardware implants built to steal wallet recovery phrases and send them to attackers over cellular networks. The company published the finding on November 13, 2026, alongside firmware version 2.13.1, released November 11, which it says stops the implants it found from capturing anything on devices running it.

The case started in October, when a customer opened a Safe 5 bought from CryptoBilis and found an unauthorized circuit board inside. Trezor couldn't confirm what the board did at that point because it hadn't received the device. It has now examined the original unit in its laboratory and identified two more compromised wallets from photographs their owners sent in. All three were bought from CryptoBilis between August 20 and September 23, 2026.

What the implant does

The added board sits between the Safe 5's main board and its display. That position lets it watch what the screen shows without touching the device's legitimate firmware or its Secure Element, which is the part that normally holds keys and is meant to resist exactly this kind of meddling. Trezor's engineers analyzed the implant's firmware and say it collects recovery words when they appear on screen, either while a new wallet backup is being created or while an existing wallet is restored. It also captures passphrases shown on the display.

From there it encrypts what it took and transmits it over a mobile network to a server the attacker controls. If there's no connection, it keeps the data and retries until a transmission succeeds. That store-and-forward behaviour matters: a wallet set up in a basement with no signal isn't safe, it's just delayed.

Scope, so far

Trezor says 48 CryptoBilis customers have contacted it since the October warning, with devices examined in its lab or through photographs of their internals. Devices from other resellers in the region were inspected and showed no tampering. The confirmed implants are limited to Safe 5 units sold through CryptoBilis, and no affected customers have reported losing funds.

The company is offering replacements to anyone who bought a Trezor wallet from CryptoBilis since March 2026, including people whose devices haven't been confirmed as compromised. It has also cut its global reseller network by roughly 80%, a move it had already flagged in October after implants turned up in Ledger devices sold through the same reseller. Trezor says the removed resellers were trustworthy and posed no threat, but didn't meet the stricter supply-chain requirements it's introducing. Remaining partners face tighter controls on how devices are sourced, stored and accessed.

Trezor warns that 2.13.1 can't help with recovery phrases captured before the update was installed. Anyone who bought from CryptoBilis is advised to move funds to a newly created wallet with a new recovery phrase.

HackZoneLabs assessment

The interesting part of this one is where the trust boundary sits. A hardware wallet's whole pitch is that the Secure Element and the signed firmware are the parts you can trust, and this implant never touched either. It didn't need to. It sat on the wire between the board and the screen, which is where the seed phrase has to appear in plain form at least once, because a human has to read it off and write it down. Any design that shows secrets to a person has that gap, and no amount of firmware signing closes it. In our view, that's the part worth carrying away: verification of the device's internals is a supply-chain problem, not a cryptography problem, and buyers have no practical way to check a sealed retail box for an extra board.

We'd also read the "no funds stolen" line carefully. It's accurate as far as it goes, but it's a statement about reports received, not about absence of theft. Someone whose seed was captured in September and who hasn't looked at their wallet since wouldn't necessarily have told Trezor anything. The replacement offer covering every CryptoBilis purchase since March 2026, well before the August-to-September window of the confirmed units, suggests the company isn't fully confident the three devices are the whole set either.

What's still unknown, and what to do first

Nobody has published how the implant gets its power or how the cellular link is provisioned, and Trezor hasn't said whether the attacker had to know which devices were going where. The advisory doesn't say how the boards got into the boxes, or who put them there. It also doesn't say whether the attacker's server has been taken down or whether any captured data was retrieved.

For defenders and anyone holding crypto on a Trezor: if the device came from CryptoBilis, treat the seed as burned. Update to 2.13.1, but generate a fresh wallet with a new recovery phrase on a device you trust and move the funds, rather than assuming the firmware update retroactively protects an old seed. If you bought from another reseller, the reported evidence doesn't show tampering, though the reseller list has changed enough that checking where your device came from is worth the two minutes. And if you're specifying hardware wallets for an organisation, the reseller chain is now part of your threat model whether you like it or not.