Trezor Confirms Hardware Implants in Three Safe 5 Wallets Sold by Reseller CryptoBilis

Trezor has confirmed that three of its Safe 5 hardware wallets were physically tampered with before reaching customers, closing out a weeks long investigation into a reseller called CryptoBilis. The company released a firmware update on November 11 that neutralizes the implants and has cut its authorized reseller network by roughly 80%.

THE INVESTIGATION'S CONCLUSION

The case started on October 28, when a customer in Indonesia reported a suspicious extra component inside a Safe 5 bought from CryptoBilis through the Tokopedia marketplace. Trezor had already cut ties with CryptoBilis on October 9, after rival hardware wallet maker Ledger began investigating fund losses tied to the same reseller. Following the October 28 report, Trezor asked other CryptoBilis buyers to come forward. Forty eight did, and the company examined their devices in its lab or through photos of the internals. Three were confirmed to contain the implant, all purchased between August 20 and September 23, 2026, through CryptoBilis's Tokopedia and Shopee storefronts or directly from the reseller.

HOW THE IMPLANT WORKED

The implant was an added circuit board, fitted with a cellular module and antenna, sitting between the device's main board and its screen. It was built to read what the screen displayed, including a wallet's recovery phrase, and transmit that information over a mobile network. Trezor said the component did not alter the device's firmware or interfere with its secure element, the chip that protects private key material, which is part of why it went undetected until a customer physically opened the device.

Trezor's new firmware, version 2.13.1, blocks the implant from capturing anything going forward, making the current batch of hardware useless for that purpose. No customer has reported losing funds.

WHO IS AFFECTED

Trezor found no evidence of tampering in any device bought from another reseller or in any other Trezor model. The exposure is narrow by Trezor's own account: Safe 5 units bought specifically through CryptoBilis in a roughly five week window last August and September. Anyone who fits that description needs to do more than install the firmware update. Trezor is telling those customers to move their funds to an entirely new wallet with a freshly generated seed phrase, since the firmware fix cannot undo a recovery phrase that may have already been captured and transmitted before the patch existed.

THE BIGGER FALLOUT FOR SELF-CUSTODY

This is the second hardware wallet maker tied to CryptoBilis in two months, after Ledger confirmed similar tampering through the same reseller in October. On the show, the hosts treated it as the latest entry in a run of incidents that has forced a more nuanced view of self-custody over the past several months. Single sig seed phrases generated with real entropy have not been broken in any of these cases. What has been exploited, repeatedly, is the supply chain the hardware moves through before it reaches a buyer's hands, which is why Trezor's reseller cuts, not just its firmware patch, are the part of this response likely to matter most going forward.

This story comes from the Simply Bitcoin Live show. Watch the full episode.