Threat watch / Attack
Trezor: spy implants found in Safe 5 hardware wallets sold by a former reseller
Trezor confirms that three Trezor Safe 5 hardware wallets bought from CryptoBilis, a former authorized reseller in Southeast Asia, carried an extra circuit board that copies what the screen shows, including recovery words and passphrases, and sends it over the mobile network to an attacker's server. Trezor released firmware 2.13.1 on November 11 to stop these implants from capturing anything, cut its reseller network by about 80%, and tells CryptoBilis buyers to move their funds to a new wallet with a new recovery phrase.
- Sector
- Consumer apps & devices
- Way in
- Supplier
- Product or vendor
- Trezor Safe 5, CryptoBilis
- Trezor Safe 5 devices confirmed with an implant, out of 48 customers who contacted Trezor[3]
- 3
- How it happened
- Physical tampering before the buyer received the device: Trezor describes the implant as "an extra circuit board fitted between the Trezor Safe 5's main board and its screen". It only listens, copying what the screen shows, and never changes the firmware or the Secure Element. It encrypts what it captures and sends it over the mobile network, retrying until it succeeds. The devices were sold by CryptoBilis, a former authorized reseller in Southeast Asia, through its Tokopedia and Shopee stores and direct sales. Trezor has not said how the tampered devices got into the reseller's stock.[1][2][3] Checked 14 Nov 2026
- What was stolen
- What the device screen shows: recovery words when a backup is created or a wallet is restored, and passphrases shown on screen. "No customer has reported losing funds," Trezor says; it cannot see balances because the wallets are self-custodial.[1][3] Checked 14 Nov 2026
- Who was impacted
- Buyers of Trezor Safe 5 devices from CryptoBilis. Three implanted devices are confirmed, bought between 20 August and 23 September 2026: one examined in Trezor's lab, two identified from owners' photos. 48 customers have contacted Trezor, which is checking their devices. Trezor says it found no implant in devices from other resellers or in other Trezor models, and offers replacements to anyone who bought from CryptoBilis from March 2026 onwards.[1][3] Checked 14 Nov 2026
- Threat actor
- Not attributed. Unknown. "We don't know who is behind this," Trezor says. It says the implant works the same way as the implants found in Ledger devices.
Timeline
- Ledger begins investigating fund losses among CryptoBilis customers, and Trezor removes CryptoBilis as a reseller the same day, according to Trezor. [2]
- Trezor's security team receives a report of an implant in a Trezor Safe 5 bought from CryptoBilis in August 2026. The buyer, a customer in Indonesia, found an extra circuit board. [2]
- Trezor publishes a first notice, treating the report as credible before receiving the device. The reporter had already moved his funds off the device. [2]
- Trezor releases firmware 2.13.1, which it says stops the implants found so far from capturing anything, "making the current batch of implants useless". It cannot protect a recovery phrase captured before the update. [3]
- Trezor publishes its investigation: three confirmed devices, 48 customers in contact, no implant found elsewhere, and a reseller network cut by about 80%. [3][1]