🔍 Read the full analysis: Hidden Implants Found In Three Safe 5 Wallets: Trezor’s Fix, Explained on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor confirmed that three Safe 5 hardware wallets bought through reseller CryptoBilis contained an extra circuit board that copied recovery words and other information shown on the screen. The company says firmware 2.13.1 blocks the implants it has found, but cannot protect information captured before installation; no affected customers have reported losing funds.
Trezor confirmed on November 12 that three of its Safe 5 hardware wallets, all purchased through reseller CryptoBilis, contained an extra circuit board designed to copy information displayed on the device, including wallet recovery words. The company says firmware 2.13.1, released the day before, blocks the implants it has identified, but cannot protect a recovery backup captured before the update.
Trezor says the implant was fitted between the Safe 5’s main board and screen. Its analysis found that the added board copied information displayed on the screen, including recovery words shown when setting up a wallet or entered when restoring one. It could also capture a passphrase if one appeared there. The implant encrypted the collected information and sent it over a mobile network to a server controlled by the attackers. If it could not connect, Trezor says, it stored the data and tried again later.
The company says the implant did not alter the device’s firmware or its Secure Element, the chip used for security functions. Trezor’s lab examined the first reported device and identified two further implanted Safe 5s from photographs supplied by their owners. The devices were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller.
Trezor released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. It says the update stops the implants it has found from capturing information on devices running the firmware. Trezor reports that none of the three owners has lost funds. It said 48 CryptoBilis customers had come forward and their devices were being checked; the company did not say those 48 devices had all been found to contain implants.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why Recovery Words Were Exposed
A recovery phrase can allow someone to restore and control a wallet, so copying those words may put funds at risk even if the hardware wallet itself continues to operate normally. The reported implant targeted the screen’s information path, rather than changing the firmware or security chip. That distinction matters: a device can appear to run genuine software while a separate physical component records what its screen displays.
Trezor’s update addresses the implants the company has identified, but it does not reverse a prior capture. Anyone whose recovery words were recorded may need to treat them as exposed, even after updating the device. Trezor’s warning is specific: the update cannot protect a backup captured before it. The company has not reported confirmed losses among the three owners, but that does not establish whether copied information was accessed or used.
The case also concerns the supply chain for security devices. Buyers generally rely on a wallet reaching them through a trusted seller without being physically altered. Trezor has said it removed CryptoBilis from its reseller network on October 9 and cut its overall reseller network by about 80%, a change it has not explained in detail in the supplied information.
Products Worth Considering
DJI Mini 3 Drone with DJI RC and 3‑Axis Mechanical Gimbal
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Cypress Green
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Display, Black
As an affiliate, we earn on qualifying purchases.
From Reseller Report to Lab Confirmation
The case came to light amid a separate investigation involving Ledger customers who had bought wallets from CryptoBilis. According to Trezor, Ledger began investigating reported fund losses on October 9. Ledger said on October 15 that some devices sold through the reseller had been physically tampered with, describing the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis was an authorized reseller for both Ledger and Trezor at the time.
On October 28, a Trezor customer in Indonesia reported an extra board inside a Safe 5 purchased from CryptoBilis through Tokopedia. Trezor issued a warning on October 30 before it had examined the device, saying it did not want to leave buyers exposed while waiting for laboratory confirmation. That confirmation followed on November 12, when Trezor said its lab had inspected the first wallet and the company had identified two more through owner photographs.
Trezor says every other device it has checked showed no evidence of tampering, and that its checks of devices from other regional resellers found none. The company is working with SEAL 911, the Security Alliance’s emergency response service. These statements describe the checks reported so far; they do not establish that every device sold through CryptoBilis or other sellers has been inspected.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
What Investigators Have Not Established
Trezor has confirmed three implanted Safe 5 devices, but the available account does not establish how many were made, how many were sold, or how long the operation ran. Forty-eight CryptoBilis customers had come forward, but the outcome of checks on their devices was not provided. Trezor has not reported an implant found in any device from another reseller in the region, while noting that its checks cover devices it has examined.
The company says the implant sent encrypted captures to a server controlled by the attackers. The supplied information does not say whether investigators accessed that server, how much information was transmitted, who operated it, or whether any captured recovery phrases were used. Trezor says none of the three owners has lost funds; it has not established publicly whether any other customers suffered losses connected to this Trezor implant investigation.
It is also not clear how customers can independently test a Safe 5 for this physical modification or whether Trezor will publish a broader account of its investigation. Because the firmware and Secure Element were reportedly left unchanged, a normal check of those components alone may not identify an added circuit board. That is an implication of Trezor’s description, not a separate claim confirmed by the company.
Customer Checks and Security Updates
Trezor says it is checking devices from customers who have come forward and is working with SEAL 911. The next public developments will likely include results from those checks and any further guidance for people who purchased wallets through CryptoBilis. No timetable for releasing additional findings was provided in the source material.
Owners of supported Trezor devices can install firmware 2.13.1, which Trezor says blocks the implants it has identified. Updating is not a remedy if recovery words may already have been captured; customers in that situation should follow Trezor’s official security guidance and consider their wallet’s recovery information exposed. The company has not said that the update detects or removes the physical board.
Whether the investigation finds more affected devices, confirms any use of captured information, or identifies those responsible remains open. Trezor’s current confirmed count is three implanted Safe 5 wallets, with no reported fund losses among their owners.
Key Questions
What was found inside the three Trezor wallets?
Trezor says each of the three Safe 5 devices contained an extra circuit board fitted between the main board and the screen. It copied information displayed on the screen, including recovery words.
Does firmware 2.13.1 protect every affected backup?
No. Trezor says the update blocks the implants it has found from capturing information on updated devices, but cannot protect a backup captured before the update.
Have the three owners lost funds?
Trezor says none of the three owners has lost funds. The company has not publicly established whether captured information was accessed or used.
Were all CryptoBilis customers’ wallets implanted?
No such finding has been reported. Trezor confirmed three implanted devices and said 48 CryptoBilis customers had come forward for checks. The status of all those checks was not provided.
Which Trezor devices received firmware 2.13.1?
Trezor’s changelog lists the update for the Safe 7, Safe 5, Safe 3 and Model T, with a release date of November 11, 2026.
Source: ThorstenMeyerAI.com
