Trezor said three of its Safe 5 hardware wallets sold through former Southeast Asia reseller CryptoBilis contained unauthorized hardware implants designed to capture sensitive wallet data. The company released firmware version 2.13.1 on Nov. 11 to block the specific implants it identified and said it has reduced its reseller network by about 80% while tightening distribution rules.
The affected devices were bought between Aug. 20 and Sept. 23, either directly from CryptoBilis or through its Tokopedia and Shopee storefronts. Trezor said it has not received reports of customer funds being lost because of the implants, but warned that any recovery phrases or passphrases previously exposed should be treated as compromised.
What Trezor found
According to Trezor, the first tampered Safe 5 was examined in its own laboratory, while two additional cases were identified from photographs supplied by device owners. In total, 48 customers had contacted the company, and it said those devices were being checked either in its lab or through internal photo review.
The company said its findings remain limited to Safe 5 units bought from CryptoBilis. It added that checks of devices from other regional resellers had not found tampering, and that it had no confirmed cases involving other Trezor models.
How the implant worked
Trezor said the added hardware was placed between the Safe 5 screen and the main board. Based on the company’s analysis, the implant copied information shown on the display without altering the wallet’s firmware or Secure Element, the dedicated chip used for security functions.
That meant it could record recovery words during wallet setup or restoration, as well as displayed passphrases. Trezor said the implant encrypted the captured data and attempted to send it over a mobile network to a server controlled by attackers. If no signal was available, the board stored the data and kept retrying transmission until it succeeded.
Firmware update and reseller changes
Trezor said firmware 2.13.1 prevents the identified implants from capturing information by updating the software that runs the device. But the company also stressed that the update cannot protect recovery phrases that were already captured before installation.
Alongside the firmware release, Trezor said it cut its reseller network by roughly 80%. The company said plans to reduce the network had emerged in October, and described the removed partners as trustworthy with no immediate threat identified. The sellers that remain must now meet stricter standards for sourcing, storage, and physical access to devices.
Advice for CryptoBilis customers
Trezor said customers who bought from CryptoBilis should move funds to newly created wallets rather than simply replacing the hardware and reusing an existing recovery phrase. In its view, a phrase that may already have been captured remains exposed even if the device itself is swapped out.
The company also told owners of suspected tampered wallets to stop using them and wait for guidance from official support. Replacement eligibility applies to all models purchased from CryptoBilis from March onward. Depending on shipping restrictions, customers may be offered a different model with a refund of the price difference, delivery to another country, or a full refund.
Next steps and warnings
Trezor said replacements should be arranged only through official support channels, and it warned that scammers may try to impersonate company staff by offering refunds or exchanges. The company repeated that it never asks customers for their recovery phrases.
It also said it is continuing to work with SEAL 911, the Security Alliance’s emergency response service for crypto incidents, and pledged a reward for the customer who first reported the implant. For now, the confirmed issue is confined to three Safe 5 devices tied to CryptoBilis, while Trezor continues reviewing additional customer reports.
Source: news.bitcoin.com