🔍 Read the full analysis: What We Know About Trezor’s Fix For Three Safe 5 Wallets With Implants on ThorstenMeyerAI.com
TL;DR
Trezor says it confirmed implants in three Safe 5 wallets bought through its former reseller CryptoBilis and released firmware 2.13.1 to stop the implants it has identified from capturing data. No owners of the three devices have reported losing funds, according to Trezor, but the update cannot protect recovery words captured before it was installed.
Trezor says it confirmed implants in three Safe 5 hardware wallets bought through its former reseller CryptoBilis and released firmware 2.13.1 to stop the implants it has identified from capturing information displayed on affected devices. The company says the three owners have not reported losing funds, but warns that the update cannot protect recovery words captured before installation.
The implants are extra circuit boards fitted between a Safe 5’s main board and screen, according to Trezor’s analysis. The company says they copy information displayed on the screen, including recovery words shown when creating a wallet backup or entered while restoring a wallet. They can also capture a passphrase if it appears there. The implants encrypt the captured information and send it over a mobile network to a server controlled by the attackers; if they cannot connect, Trezor says, they store the data and try again.
Trezor says the implants it examined leave the device firmware and Secure Element unchanged. The company released firmware 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. It says the update stops the implants it has found from capturing anything on devices running the new firmware. That does not erase information already taken: a previously exposed recovery phrase or passphrase may remain compromised, and the update cannot undo that capture.
The three Safe 5s were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee shops or directly from the reseller, according to Trezor. The company says it confirmed one device in its lab and identified two others from photographs provided by their owners. Forty-eight CryptoBilis customers have come forward and their devices are being checked. Trezor says the other devices it has examined, including devices from other regional resellers, showed no evidence of tampering.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, „Our CryptoBilis investigation: what we found and what we’ve changed“, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why the Screen-Side Implant Matters
The finding targets a key part of a hardware wallet’s security process: the device screen used to display and confirm sensitive information. Trezor says the implant copies what appears there while leaving the firmware and Secure Element unchanged. That means, according to the company’s description, checking those components alone would not establish that the device has no added hardware.
The immediate concern is not limited to whether a device receives the update. Recovery words can allow access to a wallet, so anyone whose words were displayed while an implanted device was active may need to treat them as exposed. Trezor’s warning draws a clear distinction: firmware 2.13.1 blocks the implants it has found from capturing further data, but it does not retrieve or invalidate information that may already have been sent.
The case also raises questions about the risks of buying security devices through compromised distribution channels. Trezor removed CryptoBilis from its reseller network on October 9 and says it has cut that network by about 80%. Those steps address how devices reach customers, while the ongoing checks are intended to identify whether additional units were affected.
Popular right now
Hisense 55-Inch E6SR Series Hi-QLED 4K UHD Smart Roku TV (55E6SR, 2026 Model)
Roborock Q7 M5+ Robot Vacuum and Mop
Vitamix Touch & Go Advance 32-Ounce Bar Blender, White
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
The investigation began amid reports involving another hardware-wallet brand. Trezor says Ledger began investigating customer fund losses involving wallets purchased from CryptoBilis on October 9. Ledger later confirmed physical tampering in some devices. In a statement dated October 15, Ledger described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis was also an authorized Trezor reseller, and Trezor says it removed the company from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra circuit board inside a Safe 5 bought from CryptoBilis in August through Tokopedia. Trezor says it treated the report as credible before its laboratory had examined the device and issued a customer warning on October 30. The company says it confirmed the reported device and identified two more implanted Safe 5s on November 12. It is working with SEAL 911, the Security Alliance’s emergency response service, as it checks reports and devices.
„“It only listens.”“
— Trezor, describing the implant
How Many Devices Were Affected
The full number of affected devices is not yet known. Trezor has confirmed three Safe 5s and says 48 CryptoBilis customers have come forward, but the supplied information does not say how many of those devices have completed checks or when the review will finish. The company says devices it has examined outside the three confirmed cases showed no evidence of tampering; that is not the same as confirming every CryptoBilis device is clear.
Trezor reports no fund losses among the owners of the three confirmed wallets. The source material does not establish whether captured recovery words or passphrases were accessed or used, or whether the attackers sent data from every implanted device. It also does not give details about the attackers’ identities or the server that received the information. Those points remain unconfirmed, and the extent of any exposure may depend on what the affected owners displayed on their devices before updating.
Checks and Customer Guidance Continue
Trezor says it is checking devices from the 48 customers who have come forward and is working with SEAL 911. Customers with Safe 5 wallets bought through CryptoBilis should follow Trezor’s current guidance and contact the company about device checks. Installing firmware 2.13.1 addresses the implant behavior Trezor has identified, but customers should not assume it reverses an earlier capture of recovery information.
The next key developments are whether checks identify more tampered devices and whether Trezor provides further guidance for customers whose recovery words or passphrases may have appeared on an affected wallet. The company’s statements so far do not give a final count or a completion date for the checks. Its finding remains limited to three confirmed Safe 5 devices, while the review of other customer devices continues.
Key Questions
What did Trezor find inside the Safe 5 wallets?
Trezor says three Safe 5 devices contained an extra circuit board between the main board and the screen. It says the implant copied information shown on the screen and sent encrypted data over a mobile network.
What does firmware 2.13.1 do?
Trezor says firmware 2.13.1 stops the implants it has found from capturing information on devices running the update. It was released for the Safe 7, Safe 5, Safe 3 and Model T on November 11, 2026.
Can the update protect recovery words captured earlier?
No. Trezor says the update cannot protect a wallet backup captured before installation. The company has not said whether information taken from the three confirmed devices was accessed or used.
Have customers lost funds?
Trezor says none of the owners of the three confirmed implanted devices has reported losing funds. That statement applies to those owners and does not establish whether captured information was sent or accessed.
Were other Trezor models or resellers affected?
Trezor has confirmed implants in three Safe 5 devices linked to CryptoBilis. It says devices it has checked from other resellers in the region showed no evidence of tampering. The company’s checks are ongoing, and the source material does not provide a final count of all devices examined.
Source: ThorstenMeyerAI.com
