Trezor finds hidden implant boards in three Safe 5 wallets sold by reseller CryptoBilis

Trezor says three of its Safe 5 hardware wallets, bought from the reseller CryptoBilis, contained an implant: an extra circuit board that can copy the recovery phrase. The company's statement went out yesterday, and The Hacker News reported it on Nov 13, 2026.

The board reads the phrase from the wallet's own screen and sends it over the mobile network to a server the attackers control. Trezor examined one of the three wallets in its lab and identified the other two, according to the report.

What the mechanism tells you

A recovery phrase is the whole wallet. Anyone holding it can rebuild the keys on their own hardware and move the funds, and no PIN on the original device changes that. So an implant that lifts the phrase off the display doesn't need to break the secure element, find a firmware bug or defeat the PIN. It sits beside the legitimate electronics and watches what the screen shows.

That's the part worth pausing on. Hardware wallet trust rests on the assumption that the device you unbox is the device the vendor shipped. A reseller who opens the packaging and adds a board breaks that assumption without touching a single line of firmware, which means firmware signing and secure boot checks have nothing to catch.

The mobile network detail matters too. A board that talks over cellular doesn't need the owner's Wi-Fi, doesn't need a host computer and doesn't leave traffic on the local network where anyone might notice it. It needs a SIM and coverage, nothing else.

HackZoneLabs assessment

The interesting failure here isn't cryptographic, it's logistical. Buying a hardware wallet from a third-party reseller is a supply chain decision, and this is what a bad one looks like when it goes wrong. We'd treat the reseller channel as the weak point in this story, not the Safe 5 design, though the report gives no detail on how the boards got into the packaging or who put them there.

We'd also push back on the instinct to read this as a Trezor compromise. Trezor's own lab examination is what surfaced the boards, and the report describes three specific units from one reseller. That's a narrow finding. It's also a serious one for anyone who bought through that channel, because the phrase may already be gone and the device will keep working normally while it is.

The uncomfortable part is the detection gap. A tampered wallet that powers on, shows a plausible screen and generates a phrase looks fine. Nothing in the owner's normal use would flag it. That's an argument for buying direct from the vendor where you can, and for treating any wallet that arrived through a reseller as suspect until you've checked it.

What's still unknown

The report doesn't say how many wallets CryptoBilis sold, how long the boards were in the channel, or whether the other two units were confirmed by physical inspection or by some other means. It doesn't name the server, the operator, or say whether any funds have moved. Nobody has published a teardown write-up that we've seen, and Trezor's statement as reported doesn't describe how a buyer could spot the extra board without opening the case.

What a defender should do first

If you hold a Safe 5 bought from CryptoBilis, the phrase on that device should be treated as exposed. Moving funds to a wallet whose seed was generated on hardware you trust is the step that actually helps, and it has to happen before anything else. Checking the device for an extra board is worth doing, but it doesn't undo a phrase that may already have left over the mobile network.

For everyone else, the practical point is about where the box came from. Sealed packaging from a reseller isn't proof of anything if the reseller is the one sealing it.