🔍 Read the full analysis: Trezor Safe 5 Security Update: What It Addresses And What It Doesn’t on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor says it confirmed implants in three Safe 5 hardware wallets bought through former reseller CryptoBilis. The company says firmware 2.13.1 blocks the identified implants from capturing data on updated devices, but cannot protect recovery words or passphrases already copied. Trezor reports no customer fund losses so far.
Trezor has confirmed that three Safe 5 hardware wallets bought through former reseller CryptoBilis contained an added circuit board that copied information displayed on the devices, including wallet recovery words. The company says firmware 2.13.1, released November 11, stops the implants it has identified from capturing data on updated devices, but cannot protect information copied before installation.
Trezor said its laboratory examined one Safe 5 after a customer reported an extra board inside the device, and it identified two more affected wallets from photographs provided by their owners. The three devices were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. Trezor said the finding concerns three individual Safe 5 units, not three different wallet models.
According to Trezor’s analysis of the implant, the board sits between the wallet’s main board and screen. It copies information shown on the display, including recovery words when a wallet is created or restored and a passphrase if one appears there. Trezor says the implant encrypts captured data and attempts to send it over a mobile network to an attacker-controlled server; if it cannot connect, it stores the data and tries again.
Trezor says the implant does not alter the device firmware or its Secure Element, the dedicated security chip. The company’s November 11 release of firmware 2.13.1 covers the Safe 7, Safe 5, Safe 3 and Model T. Trezor says the update stops the implants it has found from capturing information on devices running the new firmware. It also cautions that updating does not undo a past capture.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Recovery Data Is the Main Risk
The case matters because recovery words can restore access to a wallet. If an attacker obtained a customer’s recovery phrase, the risk would not necessarily end when the affected hardware wallet is updated or replaced. Trezor says the implant can also copy a passphrase if it appears on the screen, adding another potentially sensitive piece of wallet information.
Trezor reported that no affected owner has reported losing funds. That is the company’s status as of its report, not proof that no captured information exists or that funds could not be targeted later. The company said 48 CryptoBilis customers had come forward and that their devices were being checked. It is not clear from the available information how many of those 48 devices have been examined.
The incident also illustrates a supply-chain risk distinct from a flaw in a wallet’s software. Trezor says the implant leaves firmware and the security chip unchanged, while copying information from the screen. That means a software-integrity check alone may not identify this particular modification. This is an implication of Trezor’s account, rather than a direct statement from the company.
Products Worth Considering
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
Trezor removed CryptoBilis from its reseller network on October 9, 2026. The company said the action followed a separate investigation by Ledger into losses among customers who had bought hardware wallets from CryptoBilis, then an authorized Ledger reseller in Southeast Asia. Ledger said on October 15 that its incident involved “an attack on the distribution channel after the devices left our control.” That statement concerned Ledger devices; Trezor’s later investigation concerned its own Safe 5 units.
On October 28, a Trezor customer in Indonesia reported an extra circuit board in a Safe 5 bought from CryptoBilis through Tokopedia. Trezor issued a customer warning on October 30 before it had inspected the device, saying it considered the report credible. The company’s laboratory confirmation followed on November 12, after it examined the reported wallet and reviewed images of two additional devices.
Trezor says other devices it has checked showed no evidence of tampering, including devices from its other regional resellers. It also said it had cut its reseller network by about 80%. The company is working with SEAL 911, an emergency response service run by the Security Alliance.
““It only listens.””
— Trezor, describing the implant’s behavior
How Many Devices Were Exposed?
The confirmed count is three Safe 5 devices, but the number of affected units in circulation is not known. Trezor said 48 CryptoBilis customers had come forward and that their wallets were being checked; the available account does not give a completed inspection total or say how many customers may still need to respond.
It is also unclear whether the implant successfully sent data from any of the three devices, what information may have reached the server, or whether anyone accessed or used it. Trezor reports no customer losses, but that does not establish whether recovery information was captured. The company has not provided a full account of the attacker’s identity, the server’s location, or how the modified units entered CryptoBilis’s supply chain.
Trezor’s update addresses the implants it says it has found. The available information does not establish whether other designs or modified devices exist, or provide a user-run test that can conclusively identify every physical implant.
Customer Checks and Firmware Updates
Trezor says it is checking devices reported by CryptoBilis customers and working with SEAL 911. Owners who bought a Safe 5 from CryptoBilis can consult Trezor’s guidance and contact the company about their device and purchase history. The company’s account does not state when its checks of customer devices will be complete.
Trezor says users should install firmware 2.13.1 on supported devices to block the implants it has identified from capturing information. The update is not a remedy for recovery words or passphrases that may already have been copied. Trezor has not reported a confirmed loss of funds among the affected owners, and the investigation’s findings may change as more devices are examined.
Key Questions
What did Trezor find inside the Safe 5 wallets?
Trezor confirmed an extra circuit board inside three Safe 5 devices. It says the board copied information displayed on the screen, including recovery words and, if displayed, a passphrase.
Does firmware 2.13.1 fix the problem?
Trezor says the update stops the implants it has identified from capturing information on devices running it. It cannot protect data captured before the update, and Trezor has not said that the update can identify every possible physical modification.
Have customers lost funds?
Trezor said no owner of the three confirmed affected devices had reported losing funds as of its report. The company said 48 CryptoBilis customers had come forward and their devices were being checked.
Which purchases are involved?
The three confirmed Safe 5s were bought from CryptoBilis between August 20 and September 23, 2026, through its Tokopedia or Shopee stores or directly from the reseller. Trezor has not given a total number of affected units beyond the three confirmed devices.
What should an affected buyer do?
Buyers should follow Trezor’s current guidance, contact the company about their purchase, and install firmware 2.13.1 on supported devices. Because Trezor says an update cannot reverse earlier capture, customers should not assume that updating alone addresses recovery information that may already have been exposed.
Source: ThorstenMeyerAI.com
