🔍 Read the full analysis: Trezor’s Safe 5 Response: The Fix For Hidden Implants And Its Limits on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor says it confirmed hidden implants in three Safe 5 wallets bought through former reseller CryptoBilis. The implants copied recovery words and passphrases shown on the devices and transmitted them to an attacker-controlled server; Trezor says firmware 2.13.1 blocks the implants it found, but cannot protect information captured before installation of the update. No fund losses have been reported to Trezor so far.
Trezor confirmed three Safe 5 hardware wallets bought through former reseller CryptoBilis contained hidden circuit boards that copied recovery words and passphrases displayed on the devices and sent the data over a mobile network. The company says firmware 2.13.1, released November 11, blocks the implants it has identified, but cannot protect a wallet backup captured before the update.
Trezor said its laboratory examined one Safe 5 after a customer reported an extra circuit board inside a device bought from CryptoBilis. The company then identified two more implanted Safe 5s from photographs sent by their owners. The three devices were bought between August 20 and September 23, 2026, through CryptoBilis’s online stores or directly from the reseller. Trezor said it removed CryptoBilis from its reseller network on October 9.
According to Trezor’s analysis, the board sits between the wallet’s main board and screen. It copies information shown on the display, including recovery words when a wallet is created or restored and a passphrase if one appears there. The implant encrypts captured information and sends it to a server controlled by the attackers over a mobile connection; if it cannot connect, Trezor says, it stores the data and retries later.
Trezor said the implant leaves the wallet’s firmware and Secure Element—the device’s dedicated security chip—unchanged. Its firmware changelog lists version 2.13.1, released November 11, for the Safe 7, Safe 5, Safe 3 and Model T. Trezor says the update stops the implants it has found from capturing information on updated devices. The company also said no owner of the three identified wallets has reported losing funds. It said 48 CryptoBilis customers have come forward and their devices are being checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why the Screen Became a Target
The reported implant targets information at the point users rely on to protect it: the wallet’s own display. Hardware wallets are designed to keep recovery information away from internet-connected computers and phones. But if a device has been physically altered to copy what appears on its screen, a user could expose the recovery words while following the normal process for creating or restoring a wallet.
Trezor’s finding that the firmware and Secure Element remain unchanged also limits what a software-focused check can establish. A device could have unmodified software and security-chip components while containing an added board elsewhere in the hardware. That is a practical distinction for buyers: the protection Trezor describes depends on installing the update, while judging whether a device was tampered with may depend on its supply route and inspection rather than the firmware alone.
The reported scope remains limited to three Safe 5 devices identified so far, not three different Trezor models. Trezor says other devices it examined showed no evidence of tampering and that checks of devices from its other regional resellers found none. Those findings matter, but the investigation of additional CryptoBilis customers is still underway.
Popular right now
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
Roborock Q7 L5 Robot Vacuum and Mop Combo
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker (NC701)
As an affiliate, we earn on qualifying purchases.
From CryptoBilis Report to Confirmation
The case emerged amid reports about the same reseller. Trezor said Ledger began investigating customer fund losses involving hardware wallets bought from CryptoBilis on October 9. Ledger, which also authorized the company as a reseller, later said some of its devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” Trezor removed CryptoBilis from its own reseller network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra board in a Safe 5 bought through CryptoBilis’s Tokopedia store. Trezor warned customers on October 30, before its lab had examined the device, saying it considered the report credible enough to act on. The company said waiting for lab confirmation would leave buyers exposed in the meantime. Its lab confirmed the report on November 12, alongside the two additional devices identified from owners’ photographs.
Trezor says it has reduced its reseller network by about 80%, though the supplied information does not specify the measurement period or exact basis for that figure. The company is working with SEAL 911, an emergency response service run by the Security Alliance, as it checks reports and devices.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
How Many Devices Were Affected
The confirmed count is three Safe 5 devices, but Trezor is still checking devices belonging to customers who bought from CryptoBilis. The company said 48 customers had come forward; it has not provided the results of all those checks. It also has not reported how many people, if any, had their recovery information captured or whether the attackers used any captured data.
Trezor says none of the owners of the three identified devices has reported losing funds. That is a statement about reports received so far, not proof that no information was captured or that no later loss could occur. The source material does not identify the attacker, the server’s location, how many devices may have been sold with implants, or whether the captured data was accessed or used.
The company says the implants it found work in a way similar to those identified in Ledger devices, adapted to the Safe 5 display. That comparison is Trezor’s account; the available information does not establish that the same individuals made or installed the implants across both brands.
Customer Checks and Firmware Updates
Trezor says it is checking devices reported by CryptoBilis customers and working with SEAL 911. Owners of Safe 7, Safe 5, Safe 3 and Model T devices can install firmware 2.13.1, which Trezor says blocks the implants it has identified on devices running the update. The company has not said that updating can recover or neutralize recovery information already copied from a device.
The next useful developments will be the results of the customer checks, whether further implanted devices are confirmed, and any information Trezor provides about captured data or possible misuse. Trezor has not announced a completion date for the checks or stated how it will handle every reported device. The investigation remains ongoing.
Key Questions
What did Trezor find in the Safe 5 wallets?
Trezor confirmed three Safe 5 devices contained an extra circuit board between the main board and screen. The company says it copied recovery words and passphrases shown on the display and sent the information over a mobile network to an attacker-controlled server.
Does firmware 2.13.1 remove information already captured?
No. Trezor says the update blocks the implants it has found from capturing information on devices running it, but cannot protect a backup captured before the update. The company has not said that the update retrieves or deletes previously transmitted data.
Have any customers reported losing funds?
Trezor says none of the owners of the three identified devices has reported losing funds. The company said 48 CryptoBilis customers had come forward for device checks, and its review was ongoing.
Were other Trezor models found to contain the implant?
The three confirmed devices are all Trezor Safe 5 wallets. Trezor has not reported finding the implant in other models. Firmware 2.13.1 is listed for the Safe 7, Safe 5, Safe 3 and Model T.
What remains unknown about the attack?
Trezor has not identified the attacker or said how many devices may have been affected beyond the three confirmed Safe 5s. It also has not disclosed whether captured information was accessed or used, or provided final results from checks of the 48 customers who came forward.
Source: ThorstenMeyerAI.com
