Trezor Detects Malicious Hardware Implants in Safe 5 Wallets Sold Through CryptoBilis

TL;DR:

• Trezor confirmed the presence of unauthorized circuit boards with cellular modules in three Safe 5 devices sold between August 20 and September 23, 2026, through reseller CryptoBilis.
• The technical investigation covered a total of 48 units inspected and found no evidence of tampering in other models or in devices distributed through other authorized channels.
• The company released firmware version 2.13.1 on November 11, 2026, to neutralize data capture and cut its official reseller network by approximately 80%.

Hardware wallet manufacturer Trezor confirmed the discovery of malicious hardware implants in  Safe 5 wallets distributed in Southeast Asia. The firm reported that three units sold by reseller CryptoBilis between August 20 and September 23, 2026, contained unauthorized additional circuit boards.

The detected components consisted of circuits equipped with cellular modules and antennas. These parts were physically located between the device’s main board and the touchscreen. According to the company’s technical report, specialists examined one of the affected wallets directly in their laboratory, while in the other two cases, verification was conducted through photographic evidence of the internal components.

The security audit covered a total of 48 devices sent in or reported by users. Of the analyzed group, only three devices presented the physical implants. Trezor’s broader investigation indicated that no signs of tampering were detected in other models of the brand or in units sold by different distributors. The company’s findings suggest that the security breach was confined to this specific sales channel and does not point to a compromise in the original factory assembly line.

Firmware patch and reseller restructuring

One day before making the report public, on November 11, 2026, Trezor launched firmware update version 2.13.1. Technical data from the company reveals that this patch is designed to block the implants’ ability to capture sensitive information on the devices where it is installed. Even if the malicious hardware remains physically inside the casing, the new software aims to prevent the module from extracting useful data from the screen.

Up to the time of the report’s publication on November 12, Trezor noted that no financial losses had been reported by customers. However, the firm indicated that the firmware update alone is not a sufficient measure for those who purchased the device through the compromised channel. The company urged all CryptoBilis buyers to transfer their funds to a different wallet configured with a newly generated seed phrase.

In parallel with the technical measures, the company executed a structural reduction in its supply chain by cutting its network of authorized resellers by approximately 80%. According to the statement, Trezor imposed stricter control regulations on the commercial partners who remain active in its ecosystem. The business relationship with CryptoBilis had previously ended on October 9, 2026, a decision the firm linked to earlier revelations about similar threats in Ledger devices associated with the same Asian distributor.

Origin of the investigation and protocols for users

The tracing process formally began on October 28, 2026, based on a report received through the company’s responsible disclosure program. This notification warned of a possible physical alteration in a Safe 5 unit purchased during August through the e-commerce platform Tokopedia. Following this initial warning, the security team issued preventive alerts and expanded its scrutiny of shipments managed by the distributor.

The chronological history of the case shows that Trezor had cut ties with CryptoBilis nearly three weeks before receiving technical confirmation about its own devices. Market analyses indicate that the reported incidents surrounding Ledger wallets had placed the reseller under surveillance before material evidence existed regarding the Safe 5 model.

For current owners of a Safe 5 wallet purchased through CryptoBilis, official guidelines establish two sequential steps: immediately install firmware version 2.13.1 and migrate digital assets to a new address with a different recovery phrase. Meanwhile, official Trezor documentation indicates that users who purchased their devices through other distributors or directly from the manufacturer show no signs of exposure, as the investigation found no traces of intervention outside the scrutinized channel. The company is keeping its official support channel open to manage the review and replacement of units purchased through the former reseller since March 2026.