Trezor Confirms Spy Implants in 3 Hardware Wallets, Cuts Resellers by 80%

Trezor reported the discovery of three tampered Safe 5 wallets, an approximately 80% reduction in resellers, and a firmware update blocking the identified implants. CryptoBilis buyers should still move funds to new wallets, and purchases from March onward qualify for replacements.

Trezor Details Firmware and Reseller Changes

Hardware wallet maker Trezor said on Nov. 12 that three Safe 5 devices bought from CryptoBilis, a former authorized reseller in Southeast Asia, contained unauthorized hardware implants. Its blog post on the investigation detailed a firmware update and stricter distribution controls. Version 2.13.1, released Nov. 11, prevents the identified implants from capturing information by updating the software that runs the device, the company said.

All three affected devices were bought between Aug. 20 and Sept. 23 through CryptoBilis directly or via its Tokopedia and Shopee stores. Trezor examined the first reported Safe 5 implant in its laboratory and identified two others from owners’ photographs. Forty-eight customers had contacted the company, which was checking their devices in its lab or through internal photographs.

The company stated:

“We have cut our reseller network by about 80%.”

Its reseller reduction plans emerged in October, and Trezor now describes the removed partners as trustworthy and posing no immediate threat. Remaining sellers must meet stricter requirements governing sourcing, storage, and access to devices.

Hidden Boards Captured Wallet Secrets

Inside the Safe 5, the unauthorized implant sits between the screen and main board, the device’s primary circuit board connecting electronic components. It copies displayed information without changing the firmware or Secure Element, a dedicated security chip, according to Trezor’s analysis. The added board records recovery words during wallet creation or restoration, plus displayed passphrases, which are optional extra secrets used to access separate wallets.

The implant encrypts what it captures and sends it over a mobile network to a server run by the attackers. Without a signal, it holds the data and keeps retrying until the transfer goes through. Trezor said the implant works the same way as those found in some Ledger devices. In Ledger’s case, attackers bought genuine devices, modified them, and put them back on sale through resellers in Southeast Asia.

Ledger had confirmed an unauthorized hardware implant in an affected customer’s wallet in October. Trezor’s findings remained limited to Safe 5 devices bought from CryptoBilis. Checks of other regional resellers’ devices found no tampering, and the company reported no confirmed implants in other models.

CryptoBilis Buyers Still Need New Wallets

Although the update blocks capture by the identified implants, previously exposed wallet backups remain compromised. Trezor continued advising CryptoBilis buyers to transfer funds to newly created wallets, since replacing hardware while reusing the same recovery phrase leaves that exposure intact. Owners of suspected tampered devices were instructed to retain them and avoid setup or use pending support guidance.

Replacement eligibility covers every model purchased from CryptoBilis from March onward. Shipping restrictions may require a different model with a refund of the price difference, delivery to another country, or a refund. Customers were asked to arrange replacements through official Trezor Support, with uncertain buyers also encouraged to verify their device’s origin.

Scammers could impersonate staff offering replacements or refunds, Trezor warned, reiterating that it never requests recovery phrases. The company continued working with SEAL 911, the Security Alliance’s emergency response service for cryptocurrency incidents. It also pledged a reward for the customer who first reported the implant.