Trezor has slashed around 80% of its official reseller network after discovering malicious hardware implants in three Safe 5 wallets. The three compromised units were purchased between August 20 and September 23, 2026, from former authorized reseller CryptoBilis via its stores on Tokopedia and Shopee, as well as through direct purchases.
The breach occurred not through a remote software exploit, but through physical modifications to internal components before reaching customers.
The attack vector targeted the most vulnerable pathway in the hardware: the physical connection between the microcontroller unit and the PIN display screen.
How the Hardware Implant Works
A technical inspection revealed that the implant consisted of an extra circuit board sandwiched between the main microcontroller and the Safe 5 display. The rogue circuit was installed without altering the genuine firmware or the Secure Element chip that protects the device’s cryptographic keys.
When a wallet is created or restored on the screen, the secondary circuit records the recovery seed phrase. After copying the secret sequence of words, the spy device encrypts the data and transmits it directly to an attacker-controlled server via a cellular network.
CryptoBilis had its official reseller status revoked on October 9, 2026, following reports of tampered Ledger devices originating from the same seller.
Lab Test Results and Firmware Patch
A total of 48 CryptoBilis customers have come forward since October 2026 to submit their units for laboratory testing. Lab inspections confirmed no indications of tampering on devices from other resellers, nor on any Trezor models other than the Safe 5.
Trezor subsequently released firmware update version 2.13.1 on November 11, 2026, modifying the instruction sequence sent to the display. This revised command sequence prevents the implant from triggering the seed phrase recording process when the screen is active.
Nonetheless, the software update does not automatically make previously compromised wallets safe to reuse. Trezor continues to instruct CryptoBilis customers to immediately transfer all funds to a new wallet with a fresh seed phrase.
Unit Replacements for Customers
Trezor is offering a free unit replacement or a full refund for customers who purchased a wallet from CryptoBilis since March 2026.
For owners who purchased devices from that store, migrating funds to a new wallet remains an urgent step. The firmware patch only prevents subsequent screen recordings, but cannot recover seed phrases that may have already been transmitted to attacker servers.
Reported by crypto.news.
Read also: Across Urges Users to Avoid App - Wallet Balances Drained After Bridge Interaction
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
