Trezor found implants in three Safe 5s bought from CryptoBilis, released firmware that stops them capturing data and cut its reseller network by about 80%.
Key Facts
Trezor said three Safe 5 hardware wallets bought from former reseller CryptoBilis contain an implant that copies what is shown on the screen, including recovery words.
Firmware version 2.13.1, released Nov. 11, stops the implants Trezor has found from capturing anything on devices that run it.
Trezor said it cut its reseller network by about 80%, and that no customer has reported losing funds.
Hardware wallet maker Trezor said it has found implants in three Trezor Safe 5 devices bought from former reseller CryptoBilis, and released a firmware update that stops the implants it has found from capturing anything on devices that run it.
All three devices were bought between Aug. 20 and Sept. 23 through CryptoBilis's Tokopedia and Shopee stores and directly from CryptoBilis, Trezor said. So far it has found no implants in devices from other resellers or in other Trezor models, and none of the three owners has lost funds.
Firmware version 2.13.1, released on Nov. 11, includes a protection that stops the implants found so far from capturing anything on devices that run it, "making the current batch useless," Trezor said in an investigation update.
Trezor found implants in three Safe 5 devices bought from CryptoBilis. Source: Trezor
How the Implant Works
The implant is an extra circuit board fitted between the Safe 5's main board and its screen, Trezor said. It copies everything shown on the screen, including the seed phrase words a device displays when creating a backup and those a user types when recovering a wallet, then encrypts the data and sends it over a mobile network to a server controlled by the attackers.
It does not change the device's firmware or Secure Element, and works the same way as implants found in Ledger devices, Trezor said. Its lab examined the device first reported in October, and identified the other two from photos sent by owners.
Resellers Cut
Trezor said it cut its reseller network by about 80%, and that every remaining reseller will have to follow much stricter rules. The resellers it removed were trustworthy and posed no immediate threat but did not fit the stricter processes, Trezor said. Forty-eight CryptoBilis customers have contacted the company, which checked their devices in its lab or from photos.
CryptoBilis buyers should still move funds to a new wallet with a new seed, because the update cannot protect a backup captured before it was installed, Trezor said. Anyone who bought a Trezor from CryptoBilis from March 2026 onward is eligible for a replacement.
Trezor warned CryptoBilis buyers to move funds on Oct. 29, after a customer reported an implant in a Safe 5 bought from the reseller. Ledger had earlier confirmed a supply chain attack on devices sold by CryptoBilis, and said criminals spent millions on the implant attack.
This article contains links to third-party websites or other content for information purposes only ("Third-Party Sites"). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author's [company's] own and do not necessarily reflect those of CoinMarketCap.
