🔍 Read the full analysis: Three Safe 5 Wallets Had Hidden Implants, Trezor Says. What Happens Next? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Trezor says it confirmed hidden implants in three Safe 5 wallets sold through former reseller CryptoBilis. The implants copied information shown on the screen, including recovery words, and transmitted it over a mobile network; firmware 2.13.1 blocks the implants Trezor has identified, but cannot protect data captured before installation. Trezor says no owners of the three confirmed devices have reported losing funds.
Trezor says it confirmed hidden implants in three Safe 5 hardware wallets bought from former reseller CryptoBilis, which the company removed from its reseller network on October 9. The extra circuit boards copied recovery words and other information displayed on the devices, according to Trezor; firmware released November 11 blocks the implants it has identified, but cannot protect a backup captured before the update.
Trezor said its laboratory examined one Safe 5 after a customer in Indonesia reported an extra circuit board. The company also identified two more implanted devices from photographs supplied by their owners. All three were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. They are three individual units of one model, not three different wallet models.
According to Trezor’s analysis, each implant sits between the Safe 5’s main board and screen. It copies information shown on the screen, including recovery words displayed during wallet setup or entered when restoring a wallet, and a passphrase if one appears there. The implant encrypts the captured data and sends it over a mobile network to a server controlled by the attackers; if it cannot connect, Trezor says, it stores the information and tries again.
Trezor says the implants do not alter the device’s firmware or its Secure Element, the security chip. The company released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says the update stops the implants it has found from capturing information on devices running the new firmware. It does not undo an earlier capture. Trezor says none of the owners of the three confirmed devices has reported losing funds; 48 CryptoBilis customers have come forward, and their devices are being checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Recovery Words Are the Main Risk
The case matters because a recovery phrase can give someone access to the funds associated with a wallet. If an implant captured those words before the firmware update, installing the update cannot make the already copied information secret again. Trezor has not said that the three owners lost funds, but the potential exposure is more serious than a hardware defect that simply prevents a device from working.
The method also targets the wallet’s screen, a part of the process users rely on to verify sensitive information on the device itself. Trezor says the implant leaves firmware and the Secure Element unchanged, so those components alone would not reveal the added board. The company’s guidance therefore focuses on where a device was purchased and whether it may have passed through CryptoBilis, rather than claiming users can identify every implant with a routine software check.
The reported scope remains limited to three confirmed Safe 5 devices. Trezor says it found no evidence of tampering in the other devices it checked, including checks involving other regional resellers. That is a statement about the devices examined so far, not proof that no other affected units exist.
Popular right now
Ninja Flip Toaster Oven and Air Fryer SP151
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Cypress Green
Bose QuietComfort Wireless Bluetooth Headphones – Active Over‑Ear Noise Cancelling with Mic, USB‑C Charging, Deep Bass, up to 24 h Playtime,
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
The investigation began with reports concerning another wallet brand. Trezor says Ledger started investigating customer fund losses involving CryptoBilis customers on October 9. In a statement on October 15, Ledger described the incident as “an attack on the distribution channel after the devices left our control” and said some devices had been physically tampered with. CryptoBilis was also an authorized Trezor reseller, and Trezor removed it from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra board inside a Safe 5 purchased from CryptoBilis through Tokopedia. Trezor issued a customer warning on October 30, before it had examined the device, saying it did not want to leave buyers exposed while awaiting laboratory confirmation. That confirmation came on November 12, when Trezor reported the lab finding and the two additional devices identified from owner photographs.
Trezor says it is working with SEAL 911, the Security Alliance’s emergency response service. The company also says it has reduced its reseller network by about 80%. The supplied account does not specify the period used to measure that reduction or provide a detailed breakdown of the changes.
““It only listens.””
— Trezor, describing the implant’s operation
How Many Devices Were Exposed?
The full number of affected devices is not known. Trezor has confirmed three implanted Safe 5s, while it says checks are under way for devices belonging to 48 CryptoBilis customers who have come forward. The available information does not establish whether additional customers or devices were affected, or whether all potentially exposed owners have been identified.
It is also unclear whether any recovery words or passphrases captured by the implants were accessed or used by the attackers. Trezor says none of the owners of the three confirmed devices has reported losing funds, but that does not establish whether data was transmitted or whether a later attempt could occur. The company’s account describes encrypted transmission to an attacker-controlled server but does not provide details about who operated the server or whether investigators recovered its contents.
Trezor says the update blocks the implants it has found. It has not established in the supplied material whether other implant designs exist or whether the same method affected any devices outside the confirmed Safe 5 cases. Its inspection findings apply to devices it has checked so far.
Checks and Customer Guidance Continue
Trezor says it is checking devices from customers who have come forward and is coordinating with SEAL 911. Owners who bought a Safe 5 from CryptoBilis during the reported sales period should follow Trezor’s current official guidance and contact the company about their device. They should not assume that a firmware update can protect a recovery phrase that may already have been captured.
For affected owners, the key next question is whether sensitive backup information appeared on an implanted device before it was updated. Trezor’s warning says the update cannot reverse prior exposure; owners should seek advice from the company through its official support channels about their specific situation. The supplied information does not set out a detailed recovery or fund-migration procedure, so users should avoid relying on unsupported instructions.
The investigation’s next milestones are the results of checks on the 48 customers who have come forward, any further confirmed devices, and additional guidance from Trezor or the security responders. For now, the confirmed count remains three Safe 5 devices, and Trezor says no owner of those three has reported a loss of funds.
Key Questions
What did Trezor find?
Trezor says it confirmed three Safe 5 devices with an extra circuit board placed between the main board and the screen. The devices were bought through CryptoBilis between August 20 and September 23, 2026.
What information could the implant capture?
According to Trezor, it copied information shown on the device screen, including recovery words during wallet creation or restoration and a passphrase if one appeared there. It then encrypted the data and attempted to send it over a mobile network.
Does firmware 2.13.1 remove the risk?
Trezor says firmware 2.13.1 stops the implants it has identified from capturing information on updated devices. The update cannot protect a recovery backup that was captured before the device received it.
Have the confirmed owners lost funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company says 48 CryptoBilis customers have come forward for device checks; the full number of affected devices remains unknown.
Source: ThorstenMeyerAI.com
