Trezor finds hardware implants in Safe 5s sold by CryptoBilis, cuts reseller network by 80%

The tampered devices, all sold through CryptoBilis between August 20 and September 23, 2026, contained extra circuit boards with cellular modules and antennas positioned between the device's main board and screen. Trezor examined one affected unit in its lab while relying on photographic evidence for the other two.

Out of 48 devices inspected, only three were confirmed to carry the implants. Trezor's investigation found no evidence of tampering in other Safe 5 models or units sold through different resellers, suggesting the breach was confined to this single sales channel rather than a compromise of the company's manufacturing process.

Security Response

Trezor released firmware version 2.13.1 on November 11, 2026, specifically designed to neutralize the implants by preventing them from capturing sensitive data. While the hostile hardware remains physically present, the update blocks its functionality. The company has not reported any customer financial losses resulting from the tampering.

The update is designed to block the implants from capturing sensitive data on devices that install it. The hostile hardware may still be physically present. The new firmware is meant to stop it from getting anything useful.

Customer Actions

Despite the firmware patch, Trezor is urging customers who purchased Safe 5 devices from CryptoBilis to move their funds to a new wallet with a fresh seed phrase. The company terminated its relationship with CryptoBilis on October 9, 2026, following similar security concerns involving Ledger devices tied to the same reseller.

The investigation began with a responsible disclosure on October 28, 2026, reporting possible tampering in a Safe 5 purchased from Tokopedia in August. This triggered a broader probe that confirmed three implanted devices. Trezor has significantly tightened its reseller requirements following the incident, reducing its authorized network by approximately 80%.