🔍 Read the full analysis: Trezor’s Safe 5 Fix Explained: Protections And Remaining Gaps on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Trezor says it confirmed an implant in three Safe 5 wallets sold through reseller CryptoBilis. Firmware 2.13.1 blocks the implants Trezor has identified from capturing information on updated devices, but cannot protect recovery words or passphrases already captured; Trezor says no owners have reported losing funds.
Trezor confirmed on November 12 that three of its Safe 5 hardware wallets, all sold through reseller CryptoBilis, contained an added circuit board that captured information displayed on the device, including recovery words. The company says firmware 2.13.1, released the day before, stops the implants it has identified from capturing information on updated devices, but cannot protect a wallet backup captured before the update.
According to Trezor’s analysis, each implant was fitted between the Safe 5’s main board and its screen. It copied information shown on the display, including recovery words when a wallet was created or restored and a passphrase if one appeared there. Trezor says the implant encrypted the captured data and sent it over a mobile network to a server controlled by the attackers. If it could not connect, it stored the data and tried again later.
Trezor says the extra board did not alter the device’s firmware or Secure Element, the dedicated security chip. The company’s lab examined one reported device; two more implanted Safe 5s were identified from photographs sent by owners. The three devices were purchased between August 20 and September 23, 2026, through CryptoBilis’s online stores or directly from the reseller.
Trezor says no owner of the three devices has reported losing funds. It said 48 CryptoBilis customers had come forward and their devices were being checked. The company also reported that devices it had examined from other resellers in the region showed no evidence of tampering. It is working with SEAL 911, an emergency response service operated by the Security Alliance.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why a Screen-Side Implant Matters
The incident targets a part of a hardware wallet that users rely on to check sensitive information: its display. Trezor’s description says the implant copied what appeared on the screen rather than changing the wallet’s firmware or security chip. That means a device can have its normal software and Secure Element intact while a separate physical component captures information displayed during setup or recovery.
The practical risk depends on what was shown while the implant was present. A captured recovery phrase can give an attacker a way to access the associated wallet; a passphrase may also be exposed if displayed. Updating blocks the identified implant from capturing information going forward, according to Trezor, but does not make information captured earlier secret again. Owners who may have exposed a recovery phrase therefore face a different problem from users whose devices were updated before any such exposure.
The case also shows why the source of a hardware wallet matters. Trezor’s response has focused on devices linked to a specific reseller and purchase period, rather than claiming that all Safe 5 units or all devices sold in the region are affected. The company’s figures and findings remain its own account of an ongoing investigation.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Bose TV Speaker (2nd Gen) – Compact Soundbar with Bluetooth and HDMI‑ARC Connectivity, Clear Dialogue, Dolby Atmos, Deep Bass, Remote Contro
Apple Watch Series 12 GPS 42mm
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Confirmation
The case emerged amid reports of tampering involving wallets sold through CryptoBilis, which was an authorized reseller for both Trezor and Ledger. Trezor says it removed CryptoBilis from its reseller network on October 9, 2026. Ledger had begun investigating customer fund losses associated with wallets bought there; in an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.”
On October 28, a Trezor customer in Indonesia reported an extra board in a Safe 5 purchased from CryptoBilis. Trezor warned customers on October 30 before its laboratory had examined the device, saying it did not want to leave buyers exposed while awaiting confirmation. The company announced its lab confirmation on November 12, after identifying the two additional devices from owner-submitted photos.
Trezor released firmware version 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. The release notes say it includes protection against the implants Trezor has found. Trezor also says it has reduced its reseller network by about 80%, a company-reported change that reflects a broader response to concerns about distribution-channel risks.
““It only listens.””
— Trezor
Exposure and Device Checks Continue
The full scope of the incident remains unknown. Trezor has confirmed three implanted Safe 5s, but it is still checking devices from customers who have come forward. Its statement that other examined devices showed no evidence of tampering is limited to those checks; it does not establish that every CryptoBilis device has been inspected or that no additional affected units exist.
It is also not clear how many recovery phrases or passphrases the attackers obtained, whether captured data was successfully received by their server, or who controlled that server. Trezor says no owner of the three confirmed devices has reported a loss of funds, but that does not establish whether any captured information was used or whether losses could be reported later. The supplied account does not detail how users can independently verify whether a particular device contains an implant.
Trezor’s claim that the firmware update stops the implants it has found applies to that identified batch, according to the company. The available information does not establish that the update would stop every possible hardware modification or resolve exposure from a phrase already captured.
Firmware Updates and Customer Reviews
Trezor says it is continuing to check devices from CryptoBilis customers, with 48 customers having come forward at the time of its report. Owners of the named models can install firmware 2.13.1, which Trezor says blocks the implants it has identified from capturing information on devices running the update. Users should follow the company’s official instructions and contact Trezor support if they are unsure about a device’s history.
For anyone who entered or displayed recovery words or a passphrase on a suspect device before updating, the update alone cannot undo that exposure. Trezor’s warning makes clear that any response to a potentially captured backup must address the backup itself, not only the device’s firmware. The company has not provided a final count of affected wallets or a completed account of whether captured information was used; those findings depend on its continuing checks and investigation.
Key Questions
How many Trezor Safe 5 devices has the company confirmed were implanted?
Trezor reported three confirmed Safe 5 devices, all linked to CryptoBilis purchases made between August 20 and September 23, 2026.
What information could the implant capture?
Trezor says it copied information displayed on the screen, including recovery words during wallet creation or restoration and a passphrase if one appeared on the display.
Does firmware 2.13.1 undo information captured earlier?
No. Trezor says the update stops the implants it has found from capturing information on updated devices, but cannot protect a backup captured before installation.
Have owners of the confirmed devices lost funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not said that this proves no captured information was used.
Are all Trezor Safe 5 wallets affected?
The reported findings concern three Safe 5 units bought through CryptoBilis. Trezor has not said that all Safe 5 wallets are affected; it says its checks of other examined devices found no evidence of tampering.
Source: ThorstenMeyerAI.com
