Hardware wallet maker Trezor has confirmed malicious implants in three Safe 5 devices sold by Southeast Asian reseller CryptoBilis and reduced its authorised reseller network by roughly 80% as it tightens supply-chain controls. The findings, published November 12, turn an October warning about one suspected modified wallet into a confirmed case involving three devices.
Trezor says its November 11 firmware update blocks the identified implants from capturing further information, but the company continues to tell CryptoBilis customers to move their cryptocurrency to wallets generated with entirely new recovery phrases. An update cannot revoke a phrase that may already have been copied by an attacker.
No owner of the three affected devices has reported lost funds, Trezor said. The company has found no tampering in devices examined from other resellers or in other Trezor models, but its investigation is still underway and the route by which the modified products entered the distribution chain remains unresolved.
Three implants confirmed, but only one examined in the lab
According to Trezor’s November 12 investigation update, all three affected Safe 5 wallets were purchased between August 20 and September 23, 2026. The sales channels included CryptoBilis’s Tokopedia and Shopee stores as well as direct purchases from the reseller.
One device, first reported to Trezor in October, has been physically examined by its laboratory. The other two implants were identified from photographs of the devices’ interiors provided by their owners. That distinction matters to the evidence: three devices are identified as tampered with, but the company has not said all three were subjected to the same laboratory analysis.
Trezor said 48 CryptoBilis customers had contacted it after the October warning. That is a count of people responding to the investigation, not proof that 48 wallets have completed laboratory inspection. The firm is assessing devices through a combination of physical examination and owner-supplied photographs. No tampering was found in the other devices checked, but Trezor has not provided a final total of completed examinations.
The initial October 30 notice followed a disclosure received on October 28. At that stage Trezor had not examined the suspected device and called the claim credible rather than confirmed. By November 12 its embedded team had extracted and studied the implant firmware from the original device. The evidence has moved from an owner’s discovery to the manufacturer’s technical confirmation.
The attacks also sit alongside, but are distinct from, Ledger’s October confirmation of a tampered wallet sold through CryptoBilis. Investigators reported substantial suspected losses involving Ledger devices, while Trezor says none of its affected owners has reported a loss. Those outcomes should not be combined into one Trezor theft figure.
Implant copied screen data without altering the secure element
Trezor describes an extra circuit board placed between the Safe 5’s main board and screen. It observed what appeared on the display and what users entered, including recovery words during wallet setup or restoration and a passphrase when shown on-screen. The board encrypted captured material and attempted to send it over a mobile network to an attacker-controlled server, retaining data when it could not connect.
The modification did not need to replace the device’s firmware or alter its Secure Element, according to Trezor. It watched the information presented at the screen layer. That is a different failure mode from breaking the cryptography protecting a private key inside a secure chip: once a recovery phrase is exposed, an attacker can potentially reconstruct access elsewhere.
Firmware version 2.13.1, released November 11, prevents the implants identified so far from capturing new information on updated devices, the manufacturer says. But it cannot erase data previously transmitted or make an existing recovery phrase secret again. For that reason, simply updating the firmware, replacing the physical unit or restoring the same backup onto another device is not sufficient protection for potentially exposed funds.
Trezor’s advice to customers who purchased any of its wallets through CryptoBilis from March 2026 onward is to transfer their assets to a newly created wallet with a new seed and contact official support for a replacement or refund. The March eligibility date is broader than the August-to-September purchase window of the three confirmed Safe 5 implants. The firm cautions customers against fake support messages offering replacements, which could themselves be phishing attempts.
Reseller cuts raise questions about product custody
Trezor says it removed approximately four-fifths of its authorised resellers, while making remaining partners comply with more demanding requirements covering sourcing, storage and who can physically access devices. It did not disclose the previous or remaining reseller count, the detailed criteria or when every change was completed.
The company specifically said the removed resellers were trustworthy and posed no immediate threat, but did not meet the tighter operating requirements. The 80% cut is therefore not evidence that four-fifths of dealers sold compromised products. It is an attempt to reduce the number of custody handoffs and opportunities for interference, although the effect on future attacks cannot yet be measured.
Other manufacturers have responded to the CryptoBilis investigation with similar distribution restrictions. OneKey revoked CryptoBilis’s dealer status in October, paused new reseller appointments and offered replacement devices, despite reporting no confirmed customer losses of its own. Trezor’s new reduction is broader, affecting its overall network rather than only the reseller at the centre of the current probe.
Those moves reflect a problem explored in DaveFinances’ investigation of authorised hardware-wallet resellers: a manufacturer’s approval of a merchant is not a guarantee that a specific unit remained untouched between manufacture and delivery. Trezor has yet to identify where the three devices were modified, who had access to them or how their packaging and handling records compare.
Trezor is working with SEAL 911 on the response and says it will update customers if implants turn up outside CryptoBilis or in other models, or if related fund losses are reported. For now, the confirmed scope is three Safe 5 devices linked to one former reseller, a patch for the specific implant discovered and a major change to distribution policy. The unresolved supply-chain route will determine whether those new controls address the point where the attack actually occured.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.