Show
Trezor has confirmed that three of its Safe 5 hardware wallets were secretly fitted with additional circuit boards after customers bought them from CryptoBilis between August and September 2026.
The company announced the findings on November 11, alongside a security update designed to stop the hidden components from collecting sensitive wallet information.
The discovery follows an earlier warning issued on October 30, after a customer reported finding an extra hardware component inside a Trezor Safe 5 purchased from CryptoBilis. The device was bought through Indonesia’s Tokopedia marketplace in August. Trezor initially had not examined the wallet physically but treated the report as credible and began investigating other devices sold by the reseller.
The Crypto Times has reached out to CryptoBilis for comment on the findings.
Trezor Finds Three Compromised Wallets
After receiving the first report, Trezor asked customers who purchased its wallets from CryptoBilis to contact its support team. So far, 48 customers have come forward, allowing the company to examine their devices in its laboratory or through photographs of their internal components.
The investigation confirmed that three Trezor Safe 5 devices contained hidden hardware implants. One was the wallet originally reported in October, which Trezor later examined in its laboratory. The other two were identified through pictures sent by their owners.
All three devices were purchased between August 20 and September 23, 2026. They came from CryptoBilis’s stores on Tokopedia and Shopee, as well as direct purchases from the reseller.
However, Trezor said it had found no evidence of tampering in devices purchased from other resellers or in any other Trezor wallet model. It also confirmed that none of the owners of the three affected devices had reported losing funds.
How the Hidden Hardware Collected Wallet Information
Trezor’s investigation found that the implant was an additional circuit board placed between the Safe 5’s main board and its screen. The component was designed to secretly copy information displayed on the screen without changing the device’s software or interfering with its Secure Element, which helps protect private wallet information.
This allowed the hidden board to collect recovery phrases whenever users created new wallets or entered their recovery words to restore existing ones. It could also capture a passphrase if one appeared on the screen.
After collecting the information, the implant encrypted the data and sent it through a mobile network to a server controlled by the attackers. If it could not connect to the server, it kept the captured information and tried again later.
This is particularly dangerous because a recovery phrase can give someone access to a cryptocurrency wallet. Anyone who obtains those words may be able to take control of the funds stored in it.
Trezor Releases Security Update
To stop the identified implants from collecting more information, Trezor released firmware version 2.13.1 on November 11. The update includes protection that prevents the hidden components from capturing information displayed on devices running the new software.
However, installing the update does not make previously exposed recovery phrases safe again. If the implant captured a customer’s recovery words before the update, those words could still be used to access the wallet.
Trezor is therefore advising customers who purchased devices from CryptoBilis to move their funds into a new wallet created with a completely new recovery phrase. Simply restoring an old recovery phrase on another device will not solve the problem.
Company Cuts Reseller Network by 80%
Beyond the software update, Trezor has also reduced its authorized reseller network by approximately 80%. The company explained that the removed partners were considered trustworthy and did not pose an immediate threat, but they did not meet the stricter requirements now being introduced.
The new rules cover how hardware wallets are sourced, stored and accessed before they reach customers.
Trezor had already removed CryptoBilis as an authorized reseller on October 9, before publishing its first public warning on October 30.
The company said its investigation is still focused on the affected devices, while its current findings remain limited to three Trezor Safe 5 wallets purchased through CryptoBilis.
Also Read: Tether Gold Gets KPMG Audit as 520,089 Ounces of Gold Back XAU₮