In this article5 sections
Trezor has confirmed that three of its Safe 5 hardware wallets reached customers with unauthorized circuit boards inside them, and the company has responded by shrinking its authorized reseller network by about 80%. The affected devices were sold through CryptoBilis, a Southeast Asian reseller, between August 20 and September 23, 2026, according to Protos. Trezor went public with the findings on November 12.
The implants were extra boards carrying cellular modules and antennas, positioned between the device’s main board and its screen, Crypto Briefing reported. Trezor examined one unit in its lab and relied on photographic evidence for the other two. Of 48 devices inspected, only the three were confirmed as tampered.
Also read: Ledger implant attack reaches Europe as AI finds XRP bug
Key facts
- Trezor cut its reseller network by roughly 80%, keeping only partners able to meet stricter rules on how devices are sourced, stored and accessed.
- Firmware version 2.13.1 shipped on November 11, 2026, a day before the public disclosure, to block the implants from capturing data.
- Trezor says no crypto has been stolen from the affected devices and has offered free replacements to CryptoBilis buyers.
- Trezor ended its relationship with CryptoBilis on October 9, 2026; Crypto Briefing reported that the decision followed concerns about similar threats involving Ledger devices tied to the same reseller.
- The investigation began with a responsible disclosure on October 28, 2026, flagging possible tampering in a Safe 5 bought in August from Tokopedia, per Crypto Briefing.
How the firmware neutralises the implant
A Trezor spokesperson told Protos that the implant monitors communication between the microcontroller and the display, triggering capture when it detects a specific sequence. To defeat that trigger, Trezor said it changed the order of commands sent to the display, an adjustment it can make without affecting what appears on screen. The company’s update describes the change as rendering the implants useless.
The fix has a limit. Trezor warned CryptoBilis customers that the update cannot protect a wallet backup captured before it was installed, and it is urging those buyers to move funds to a new wallet with a fresh seed phrase. The hostile hardware may still be physically present even after updating, Crypto Briefing noted.
Reseller purge and the Ledger comparison
The reseller cuts are the larger structural change. Trezor imposed tighter rules on how devices are sourced, stored and who can access them, and only about 20% of vendors could comply. The company stressed that the dropped resellers were trustworthy and posed no immediate threat.
The timing differs between the reports. Protos describes the reseller reduction as following the discovery of more implants, while Crypto Briefing reports that CryptoBilis was removed earlier, on October 9, weeks before the disclosure arrived. Both accounts agree the reseller is no longer authorized.
The episode follows a larger attack. Ledger wallets sold through CryptoBilis were drained of more than $86 million last month, Tether froze $10 million in stolen funds, and Ledger asked multiple vendors across Asia to halt sales. Its investigation uncovered an organized crime group that spent millions building spyware infrastructure covering logistics, seed-collection servers and laundering. Trezor maintains its own investigation found no tampering in other models or through other resellers, pointing to a breach confined to one sales channel.
Why it matters
Hardware wallets are bought precisely because users assume the physical device sits outside online attack paths. A tampered unit inside a sealed box defeats that assumption before the owner ever plugs it in. For buyers who purchased through CryptoBilis, the practical steps are unchanged: update to firmware 2.13.1 and then move funds to a new wallet with a new seed phrase. Owners who bought elsewhere have less to act on, based on Trezor’s findings.
What to watch
CryptoBilis buyers are still advised to migrate funds and to accept the free replacements Trezor has offered. Further lab results on the remaining inspected devices and any follow-up from law enforcement on the organized group behind the infrastructure would extend the story.
Reported by Protos.