Introduction
Trezor, a cryptocurrency hardware wallet maker, has confirmed that three Safe 5 wallets sold by CryptoBilis contain malicious hardware implants designed to steal wallet recovery phrases and send them to attackers. The company has released a firmware update to address the issue.
Initial Findings
The findings follow an investigation into a suspected hardware implant first reported in October, when a customer discovered an unauthorized circuit board inside a Trezor Safe 5 purchased from Indonesian reseller CryptoBilis. At the time, Trezor had not received the device for examination and could not confirm the implant's capabilities.
New Investigation Update
In a new investigation update, the company says it has now examined the original device in its laboratory and identified two additional compromised wallets using photographs submitted by their owners. All three compromised devices were purchased from CryptoBilis between August 20 and September 23, 2026.
Firmware Update
Trezor's firmware update, version 2.13.1, released on November 11, includes protections that prevent the implants from capturing information. The update cannot protect wallet recovery phrases that may have already been captured before it was installed.
Reseller Network Reduction
Due to these supply-chain attacks, Trezor has reduced its global reseller network by approximately 80%, significantly reducing the number of third-party resellers of its hardware wallets. The company is offering replacement devices to anyone who purchased a Trezor wallet from CryptoBilis since March 2026, including customers whose devices have not been confirmed as compromised.
Other Resellers
The company has inspected devices from other resellers in the region and found no evidence of tampering. No Trezor customers have reported stolen funds, but those who purchased Trezor devices from CryptoBilis are advised to transfer their cryptocurrency to a newly created wallet using a new recovery phrase.
Conclusion
Trezor has released a firmware update to prevent hardware implants from capturing information and is offering replacement devices to customers who purchased from compromised resellers. The company is also reducing its reseller network to improve supply-chain security and prevent future attacks.
Comments