Secure

Safe

Element

<ul>
 <li>Three modified Trezor Safe 5 wallets exposed recovery phrases through hidden display implants.</li>
 <li>The malicious circuitry transmitted sensitive information without compromising the Secure Element.</li>
 <li>Firmware 2.13.1 blocks identified implants but cannot protect previously stolen backups.</li>
 <li>CryptoBilis customers should migrate their funds using newly generated recovery phrases.</li>
</ul>
A hardware wallet can run legitimate firmware, protect its private keys and still reveal the information needed to empty its accounts.
That is the central finding of Trezor’s investigation into three Safe 5 wallets distributed through Southeast Asian reseller CryptoBilis. Unauthorized circuitry placed between the main board and screen captured recovery information and transmitted it over a cellular network.
The affected owners have reported no losses. Nevertheless, Trezor’s precautionary warning covers customers who bought its d<a href="https://ethnews.com/trezor-warns-cryptobilis-buyers-over-suspected-wallet-implant/" rel="noopener noreferrer nofollow">evices from CryptoBilis</a> since March 2026, including purchases through Tokopedia and Shopee.
For those buyers, the immediate priority is securing the assets, not inspecting the hardware.
<h2 id="the-decision-comes-before-the-diagnosis">The Decision Comes Before the Diagnosis</h2>
Customers who have initialized a CryptoBilis wallet should transfer their cryptocurrency to accounts generated from a completely new recovery phrase.
Moving the old phrase to another device preserves the same underlying vulnerability. If an attacker obtained the backup, the original hardware is no longer needed to access the associated accounts.
Trezor recommends temporarily using a familiar software wallet or cryptocurrency exchange when another trusted hardware wallet is unavailable. Both alternatives carry their own risks, but they may reduce exposure while a replacement is arranged.
Unused devices should remain uninitialized, especially if the owner intends to restore an existing wallet.
The company is offering eligible customers replacements, although international shipping restrictions may require an alternative model with a price-difference refund, delivery to another country or a full refund.
Customers should retain the original device and initiate requests through official Trezor Support.
<h2 id="the-secure-chip-wasn-t-the-target">The Secure Chip Wasn’t the Target</h2>
<a href="https://trezor.io/blog/news/our-cryptobilis-investigation-what-we-found-and-what-weve-changed" rel="noopener noreferrer nofollow">Trezor’s technical investigation</a>, published November 12, identified an additional circuit board installed along the Safe 5’s display connection.
The implant operated as a passive observer. It did not modify the legitimate firmware or Secure Element, according to the manufacturer’s laboratory findings.
Instead, it recognized recovery words appearing during wallet creation and restoration. It could also capture passphrase information presented through the monitored interface.
The collected data was encrypted and transmitted to an attacker-controlled server through a cellular connection. When the connection failed, the implant retained the information and attempted transmission later.
This architecture creates an important distinction between private-key isolation and recovery-phrase confidentiality.
A Secure Element can prevent direct extraction of cryptographic material while a separate component captures the backup used to reconstruct that material elsewhere.
Trezor confirmed that the malicious boards followed the same basic design as implants previously discovered in Ledger devices, modified to work with the Safe 5 display.
The similarity establishes a shared attack method. It does not establish who installed the components or whether the same group targeted both manufacturers.
<h2 id="a-firmware-fix-cannot-revoke-a-secret">A Firmware Fix Cannot Revoke a Secret</h2>
Trezor released firmware version 2.13.1 on November 11, introducing protection against the implants identified during its investigation.
The company has not disclosed the precise implementation of that countermeasure.
Its effectiveness also has a clear limit: a recovery phrase captured before the update remains compromised.
An attacker with a complete backup may restore the associated wallet independently. Where an additional passphrase is required, access also depends on obtaining that separate secret.
The appropriate response is therefore account migration using newly generated recovery information. Updating or replacing the original device does not change the keys derived from an existing phrase.
<h2 id="the-reseller-response-predated-trezor-s-discovery">The Reseller Response Predated Trezor’s Discovery</h2>
On October 9, Ledger started examining reported customer losses involving hardware wallets purchased through CryptoBilis. Trezor removed the reseller from its authorized network that day as a precaution.
By October 13, Trezor had announced a wider reduction in its reseller network. Affected partners were told they would receive no new stock and that their authorizations would end on January 1, 2027, with remaining inventory permitted to be sold until then.
That restructuring preceded the first reported Trezor implant.
The manufacturer’s security team received the Safe 5 disclosure on October 28 and published its initial customer <a href="https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis" rel="noopener noreferrer nofollow">advisory on October 30</a>.
Subsequent examinations identified three modified devices purchased between August 20 and September 23. One was examined in Trezor’s laboratory, while the other two were identified through photographs supplied by their owners.
Forty-eight CryptoBilis customers had contacted the company following the warnings. Trezor has not disclosed a complete denominator of devices sold or examined, making an infection-rate estimate impossible.
<h2 id="what-remains-unanswered">What Remains Unanswered</h2>
The manufacturer has not identified where the unauthorized circuitry entered the distribution chain.
Its investigation has also found no comparable implants in other Trezor models or devices purchased from different resellers.
Those findings limit the confirmed scope of the incident, although they do not establish that every unexamined device is safe.
Trezor is working with SEAL 911, the Security Alliance’s emergency-response service, and says it will publish further findings if investigators identify additional compromised products or confirmed fund losses.
For customers, the most useful evidence is their purchase history. A device that appears normal, passes routine software checks or has the latest firmware cannot establish whether its recovery information was previously intercepted.
The outstanding investigative question is how modified devices entered an authorized reseller’s inventory and whether the same distribution weakness exposed additional customers.
The post <a href="https://ethnews.com/how-a-hidden-screen-tap-turned-trezor-backups-into-a-liability/" rel="noopener noreferrer nofollow">How a Hidden Screen Tap Turned Trezor Backups Into a Liability</a> appeared first on <a href="https://ethnews.com" rel="noopener noreferrer nofollow">ETHNews</a>.

How a Hidden Screen Tap Turned Trezor Backups Into a Liability

Table of Contents

ETHNews

Other articles published on Nov 14, 2026

Join our free newsletter for daily crypto updates!