Trezor Finds Spy Implants in 3 Safe 5 Wallets, Slashes Reseller Network

Trezor confirmed on Nov. 12 that three Safe 5 devices sold by CryptoBilis, a former authorized reseller in Southeast Asia, arrived with unauthorized hardware implants. All three were bought between Aug. 20 and Sept. 23, either directly from CryptoBilis or through its Tokopedia and Shopee storefronts. The company examined the first reported implant in its own lab and identified the other two from owners' photographs. Forty-eight customers have contacted Trezor, which is checking their devices in the lab or through internal photos.

The fix arrived a day before the disclosure: firmware version 2.13.1, released Nov. 11, updates the software inside the device so the implants can't capture anything. Trezor said it has also tightened distribution, cutting its reseller network by about 80%. Those removal plans surfaced in October, and Trezor now describes the dropped partners as trustworthy and no immediate threat. Any sellers left standing must meet stricter rules on sourcing, storage and who can access devices.

Physically, the implant hides between the screen and the main board — the circuit board wiring the device's components together. According to Trezor's analysis, it skims what the screen shows without touching the firmware or the Secure Element, the dedicated security chip. That means it grabs recovery words during wallet setup or restoration, plus any passphrases displayed. The data is encrypted and pushed over a mobile network to a server the attackers control; with no signal, the implant stores it and retries until it gets through. Trezor says the technique mirrors implants found in some Ledger devices, where attackers bought genuine units, modified them and resold them through Southeast Asian resellers. Ledger confirmed an unauthorized implant in a customer's wallet in October.

The scope stays narrow: Trezor's findings cover only Safe 5 wallets bought from CryptoBilis. Devices checked at other regional resellers showed no tampering, and no implants were confirmed in other models. But the firmware patch doesn't undo the damage for anyone already exposed — old wallet backups are still compromised. Trezor keeps telling CryptoBilis buyers to move funds into newly created wallets, because swapping hardware while reusing the same recovery phrase leaves the exposure wide open. Owners who suspect a tampered device were told to hold onto it and not set it up or use it until support says otherwise.

Replacements are open for any model bought from CryptoBilis from March onward. Depending on shipping limits, Trezor may swap in a different model and refund the price difference, ship to another country, or refund outright. Customers must arrange it through official Trezor Support, and anyone unsure is urged to verify where their device came from. Trezor warned that scammers may pose as staff dangling replacements or refunds, and repeated that it never asks for recovery phrases. The company is working with SEAL 911, the Security Alliance's emergency response service for crypto incidents, and has promised a reward for the customer who first flagged the implant.