Trezor slashes reseller network by 80% after discovering spy implants in Safe 5 wallets
Trezor reduced its reseller network by approximately 80% after discovering malicious, seed-stealing hardware implants inside three Trezor Safe 5 wallets sold by vendor CryptoBilis.
Hardware wallet maker Trezor has removed approximately 80% of its authorized resellers following an investigation that uncovered malicious circuit boards inside three Trezor Safe 5 devices, the company announced. Trezor inspected hardware submitted by 48 users and confirmed that the three compromised units were purchased between August 20 and September 23, 2026, through Malaysian reseller CryptoBilis and its Tokopedia and Shopee storefronts.[2][3][4]
A comparison graphic published by Trezor shows the implant consisted of an extra circuit board fitted on top of the genuine board, an additional antenna placed on the lower back of the display screen, and extra wires connecting the components. Concealed between the motherboard and display, the rogue board monitored communications between the microcontroller and the screen, listening for the wallet's seed phrase sequence to capture recovery seeds and passphrases before transmitting them over cellular networks.[2][3][4]
No user funds have been reported stolen from the compromised units. In response, Trezor introduced stricter supply chain guidelines concerning device sourcing, storage, and access, with only 20% of its vendors qualifying to remain in the network. Trezor noted that dropped resellers were considered trustworthy and posed no immediate threat. To mitigate the risk, Trezor released firmware version 2.13.1 on November 11, which reorders display commands to block the implant's capture mechanism without altering what users see. However, the company cautioned affected CryptoBilis customers to transfer their funds to new wallets, warning that the update cannot protect seed phrases copied prior to the patch. Customers who purchased devices from CryptoBilis since March 2026 are eligible for free replacements or refunds.[1][2][4]
Key facts
- Trezor confirmed that three Trezor Safe 5 wallets sold by reseller CryptoBilis contained malicious hardware implants.
- The compromised wallets were sold between August 20 and September 23, 2026, through CryptoBilis and its Tokopedia and Shopee storefronts.
- The implant consisted of an extra board placed on the genuine board, an extra antenna on the back of the screen, and connecting wires designed to capture recovery seeds and transmit them over cellular networks.
- Trezor cut its reseller network by approximately 80% after only 20% of vendors met new procurement and warehousing rules.
- No user funds have been reported stolen from the compromised Trezor Safe 5 devices.
- Trezor released firmware version 2.13.1 on November 11 to prevent the implants from recording seed data.
- Customers who purchased devices from CryptoBilis since March 2026 are eligible for a free replacement or refund.
Sources · 4 sources
- DE
Decrypt@DecryptMediaPost on X ·
Trezor Finds Implants That Copy Recovery Words Inside Three Safe 5 Wallets. Trezor said the wallets were bought from reseller CryptoBilis between Aug. 20 and Sept. 23, firmware 2.13.1 stops the implants, and it has cut its reseller network by about 80%. https://t.co/SAntTi9R1z
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
Trezor Investigation Update: Malicious Circuit Boards Found in Three Safe 5 Wallets Hardware wallet manufacturer Trezor provided an update on its investigation into hardware tampering involving devices sold by reseller CryptoBilis. After inspecting devices from 48 users who contacted the company, Trezor confirmed that three Trezor Safe 5 wallets sold between August 20 and September 23, 2026, through CryptoBilis and its Tokopedia and Shopee stores contained malicious circuit boards. The implants, concealed between the motherboard and display, could capture recovery seeds and passphrases shown on the screen and transmit them to attackers’ servers via cellular networks. No user funds have been reported stolen to date. Trezor has reduced its reseller network by approximately 80%, tightened procurement and warehousing controls, and released firmware version 2.13.1 on November 11 to block data capture by the identified implants. Customers who purchased devices from CryptoBilis since March 2026 are eligible for a free replacement or refund.
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: Trezor says it found seed-stealing implants in three Safe 5 wallets sold by CryptoBilis and subsequently cut its reseller network by about 80%. No losses among Trezor users were reported. https://t.co/rGR4DAlwxI
Open source - PR
ProtosArticle ·
Trezor cuts reseller network by 80% after finding more spy implants Crypto wallet firm Trezor has cut its reseller network by 80% following the discovery of more spy implants in devices sold by Malaysian vendor CryptoBilis. Trezor’s latest update on the spyware incident revealed it has implemented stricter rules for vendors in order to protect its supply chain. However, only 20% of vendors were able to abide by the new rules that focus on “how devices are sourced, stored and who has access to them.” Trezor stressed, however, that the dropped resellers “were trustworthy and posed no immediate threat.” Trezor says its new update renders spy implants useless Trezor also claims to have released an update on November 11 that stops the implants recording data and renders them “useless.” A spokesperson for the company told Protos, “The implant listens to the communication between the MCU and the display and triggers the capture when it sees a specific sequence.” In order to stop the sequence trigger, which is a wallet’s seed phrase, Trezor claims it “changed the order of the commands sent to the display” and that it can do this “without any effect on the displayed screen.” Trezor shared the interior of one of the tampered CryptoBilis-sourced wallets. Read more: Trezor reveals Malaysian reseller sold wallet with spyware Despite this, Trezor warned CryptoBilis customers that they should still move their funds to a new wallet as “the update can’t protect a wallet backup that was captured before it.” Three Trezor wallets infected but no funds stolen Trezor says a total of three Trezor Safe 5 models have been found implanted with the spyware and that the devices were purchased between August 20 and September 23. It still maintains that no crypto has been stolen from the affected devices, and has offered those who bought their wallets from CryptoBilis a free replacement. Ledger wallet users suffered $86M theft Wallets sold by Trezor rival Ledger were drained of over $86 million last month in an attack that also involved tampered wallets sold by CryptoBilis. Stablecoin firm Tether froze $10 million in stolen funds, and Ledger asked multiple wallet vendors across Asia to halt sales. Ledger’s SDK snitched users’ transaction data and device info Read more: Ledger roasted over $849 device launch after $86M hack Its investigation uncovered an organized crime group spending millions to build spyware infrastructure that involved logistics, seed collector servers, and draining/laundering infrastructure. It took several weeks before Trezor revealed it too had discovered an implant in one of its devices. Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel . The post Trezor cuts reseller network by 80% after finding more spy implants appeared first on Protos .
Open source