🔍 Read the full analysis: Trezor Safe 5 Wallet Fix: What It Addresses, Step By Step on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Trezor says three Safe 5 wallets bought through reseller CryptoBilis contained an added circuit board that copied recovery words and sent them over a mobile network. Firmware 2.13.1, released November 11, blocks the known implants from capturing data on updated devices, but cannot undo exposure that happened earlier.
Trezor confirmed on November 12 that three Safe 5 hardware wallets bought through reseller CryptoBilis contained an added circuit board designed to copy information shown on the device screen, including recovery words. The company says its firmware 2.13.1, released November 11, stops the implants it has identified from capturing data on updated devices, but cannot protect a wallet backup that may have been captured before the update.
Trezor says its lab examined one device reported by a customer and identified two more implanted Safe 5s from photographs supplied by their owners. The three devices were purchased between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller. The company says it has found no evidence of tampering in other devices it has checked, including devices from other resellers in the region.
According to Trezor’s analysis, the implant is a small circuit board fitted between the wallet’s main board and its screen. It copies information displayed on the screen, including recovery words shown when creating a backup or entered when restoring a wallet. Trezor says it can also capture a passphrase if one appears there. The implant encrypts the captured data and sends it over a mobile network to a server controlled by the attackers; if it cannot connect, it stores the information and tries again later.
Trezor says the implant does not alter the wallet’s firmware or its Secure Element, the dedicated security chip. The company’s November 11 firmware release, version 2.13.1, covers the Safe 7, Safe 5, Safe 3 and Model T. Trezor says it blocks the implants it has found from capturing information on devices running the update. It also says no owner of the three confirmed devices has reported losing funds. Separately, 48 CryptoBilis customers have come forward, and Trezor says their devices are being checked.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why Screen-Captured Recovery Words Matter
A recovery phrase can provide access to the assets controlled by a wallet, so capturing it may put those assets at risk even if the device itself appears to function normally. Trezor says the implant reads what appears on the screen and transmits it later; this means the concern is not limited to someone entering words into a computer or phone. A captured phrase could remain relevant after the device is updated, because the update cannot retrieve or erase data already sent or stored by the implant.
The case also highlights the importance of where a hardware wallet was purchased. Trezor has not described a user-run test that can conclusively identify these implants, and says the implant leaves the firmware and Secure Element unchanged. Its public advice is therefore tied to the source of purchase and the company’s checks, rather than a simple software authenticity check. That distinction matters to customers who may assume a genuine firmware check rules out physical changes elsewhere in a device.
Trezor says it has removed CryptoBilis from its reseller network and reduced that network by about 80%. The confirmed finding is limited to three individual Safe 5 devices, not three different wallet models. The number of customers who may need checks is broader: the company says 48 CryptoBilis customers have contacted it, with inspections ongoing.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Canon SELPHY CP1500 Wireless Compact Photo Printer Bundle with RP-108 Ink and Paper Set, White
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
From Reseller Warning to Lab Confirmation
Trezor’s account traces the investigation to reports involving CryptoBilis, which had been an authorized reseller for both Trezor and Ledger in Southeast Asia. Ledger began investigating losses among customers who bought wallets through the reseller on October 9, according to Trezor. Ledger later said some devices had been physically tampered with. In an October 15 statement, Ledger described the incident as “an attack on the distribution channel after the devices left our control.”
Trezor removed CryptoBilis from its network on October 9. On October 28, a Trezor customer in Indonesia reported an extra circuit board inside a Safe 5 bought through CryptoBilis, using Trezor’s responsible disclosure program. Trezor warned customers on October 30, before it had examined that device in its lab, saying it did not want to leave buyers exposed while it waited for confirmation. The lab confirmation and identification of two further devices followed on November 12.
Trezor says its embedded team extracted and analyzed the implant’s firmware. The company describes its operation as listening to the wallet’s display rather than changing the wallet’s operation. Trezor is working with SEAL 911, the Security Alliance’s emergency response service, on the case.
““It only listens.””
— Trezor
What Checks Are Still Underway
The full number of affected devices is not yet known. Trezor has confirmed three implanted Safe 5s and says it is checking devices belonging to the 48 CryptoBilis customers who have come forward. It has not reported a final result for all those inspections. The company says other devices it checked, including units from other regional resellers, showed no evidence of tampering, but that does not establish the status of every device sold through CryptoBilis.
Trezor says no owner of the three confirmed devices has reported losing funds. That is the company’s current report, not proof that no recovery phrase was copied or that there is no future risk. The source material does not identify the attackers, say how many recovery phrases were successfully transmitted, or provide details about the server receiving the data. It also does not give a public method for users to determine independently whether a device contains an implant.
Firmware 2.13.1 is described as stopping the implants Trezor has found. The available information does not establish whether it would block a different or modified implant. Customers whose recovery words appeared on a device before the update should not assume that installing the firmware reverses any earlier exposure.
Next Steps for CryptoBilis Buyers
Trezor says it is continuing to inspect devices reported by CryptoBilis customers and is working with SEAL 911. Buyers who obtained a Safe 5 through CryptoBilis should contact Trezor through its official support channels to ask about device checks and the company’s guidance. Customers should verify that any firmware instructions come from Trezor itself rather than from unsolicited messages or links.
For devices that are not confirmed compromised, Trezor says firmware 2.13.1 is available for the Safe 7, Safe 5, Safe 3 and Model T. An update protects only against the known capture behavior described by the company; it does not address information that may already have been copied. If a recovery phrase may have been exposed, users should seek guidance from Trezor through official channels about protecting the affected wallet rather than treating a firmware update alone as a complete remedy.
The next public milestones are the results of Trezor’s customer-device checks and any further findings about the implant or affected sales. The company has not yet provided a final count beyond the three confirmed Safe 5s.
Key Questions
What did Trezor find in the Safe 5 wallets?
Trezor confirmed three Safe 5 devices contained an extra circuit board installed between the main board and screen. The company says it copied information displayed on the screen, including recovery words and, if shown, a passphrase.
What does firmware 2.13.1 fix?
Trezor says version 2.13.1 stops the implants it has found from capturing information on devices running the update. It was released November 11, 2026, for the Safe 7, Safe 5, Safe 3 and Model T.
Can the update protect recovery words captured earlier?
No. Trezor says the update cannot protect a wallet backup captured before installation. It blocks the known implant’s capture behavior on an updated device; it cannot undo possible prior copying or transmission.
Have customers reported losing funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not said that this rules out exposure, and checks of other CryptoBilis customers’ devices are ongoing.
What should CryptoBilis customers do?
Customers should contact Trezor through its official support channels for guidance and device checks, and use only official sources for firmware instructions. Trezor says 48 CryptoBilis customers have come forward and that their devices are being checked.
Source: ThorstenMeyerAI.com
