Trezor Safe 5 hardware implants via reseller CryptoBilis steal recovery phrases
Severity: high · Patch status: patched · Since 2026-11-13
Trezor confirmed that three Safe 5 hardware wallets sold by Southeast Asian reseller CryptoBilis between August 20 and September 23, 2026 contained malicious hardware implants — an extra circuit board between the main board and display that captures recovery phrases and passphrases shown on screen and exfiltrates them over cellular networks, storing data until transmission succeeds. The implant does not modify legitimate firmware or the Secure Element. 48 CryptoBilis customers contacted Trezor; devices from other resellers showed no tampering, and no customers reported stolen funds. Firmware 2.13.1 (released November 11, 2026) blocks the implants from capturing data, but cannot protect phrases already captured. Trezor cut its reseller network by ~80% and is offering replacements to CryptoBilis buyers since March 2026. This follows similar confirmed implants in Ledger devices sold via CryptoBilis.
What to do
- If you bought a Trezor (or Ledger) from CryptoBilis, immediately move funds to a new wallet with a fresh recovery phrase generated on a verified device
- Update Trezor devices to firmware 2.13.1 or later
- Inspect devices purchased from third-party resellers for tampering; buy hardware wallets only from official channels
- Treat any recovery phrase entered on a reseller-bought device as compromised
Fixed versions
Sources
All live incidents on Threat Watch
