Trezor Safe 5 hardware wallet implants: CryptoBilis reseller devices steal recovery phrases
Severity: high · Patch status: partial · Since 2026-10-30
Trezor says a Safe 5 bought in August 2026 from the reseller CryptoBilis, through its Tokopedia store, contained an extra circuit board between the main board and the screen. Trezor's 30 October notice covered that single report and said the device had not yet been received or examined. On 12 November Trezor confirmed that three Safe 5 units bought from CryptoBilis between 20 August and 23 September 2026 (through Tokopedia, Shopee or directly from CryptoBilis) carry the implant: one was examined in Trezor's lab and two were identified from owners' photos. Trezor describes the implant as copying everything shown on the screen, including recovery words and any passphrase, encrypting it, and sending it over the mobile network to a server run by the attackers. Trezor says no CryptoBilis buyer has reported lost funds, that 48 customers have contacted it, and that no tampering was found in devices from other resellers or other models. Firmware 2.13.1, released 11 November, stops the known implants from capturing anything on devices that run it, but it cannot protect a backup captured before the update. Trezor removed CryptoBilis as a reseller on 9 October and cut its reseller network by about 80%. Trezor says the implant works the same way as implants found in Ledger devices sold through the same reseller, which is tracked as a separate record. Affected buyers should move their funds to a wallet with a new recovery phrase, never enter an old phrase on a new device, and contact Trezor Support for a replacement, which is offered to anyone who bought from CryptoBilis since March 2026.
What to do
- If you bought a Trezor from CryptoBilis (including Tokopedia/Shopee stores) since March 2026: move all funds to a new wallet with a newly generated recovery phrase; do not restore the old phrase on any reseller-sold device
- Never type an existing recovery phrase into an unused wallet from the reseller; do not set up unopened devices from it
- Update Trezor firmware to 2.13.1 (Safe 7, Safe 5, Safe 3, Model T), understanding it cannot protect previously captured backups
- Keep the suspect wallet and contact Trezor Support, which offers replacement wallets to affected buyers; do not weigh or open the wallet to check
- Beware scammers posing as Trezor offering replacements/refunds; Trezor never asks for your recovery phrase
- Audit hardware wallet procurement: buy only from vetted, authorized channels and verify supply chain provenance
Fixed versions
Sources
All live incidents on Threat Watch
