Key Facts

  • Trezor said three Safe 5 hardware wallets bought from former reseller CryptoBilis contain an implant that copies what is shown on the screen, including recovery words.

  • Firmware version 2.13.1, released Nov. 11, stops the implants Trezor has found from capturing anything on devices that run it.

  • Trezor said it cut its reseller network by about 80%, and that no customer has reported losing funds.

Trezor said three Safe 5 hardware wallets bought from former reseller CryptoBilis contain an implant that copies what is shown on the screen, including recovery words.

Firmware version 2.13.1, released Nov. 11, stops the implants Trezor has found from capturing anything on devices that run it.

Trezor said it cut its reseller network by about 80%, and that no customer has reported losing funds.

Hardware wallet maker Trezor said it has found implants in three Trezor Safe 5 devices bought from former reseller CryptoBilis, and released a firmware update that stops the implants it has found from capturing anything on devices that run it.

All three devices were bought between Aug. 20 and Sept. 23 through CryptoBilis's Tokopedia and Shopee stores and directly from CryptoBilis, Trezor said. So far it has found no implants in devices from other resellers or in other Trezor models, and none of the three owners has lost funds.

How the Implant Works

It does not change the device's firmware or Secure Element, and works the same way as implants found in Ledger devices, Trezor said. Its lab examined the device first reported in October, and identified the other two from photos sent by owners.

Resellers Cut

Trezor said it cut its reseller network by about 80%, and that every remaining reseller will have to follow much stricter rules. The resellers it removed were trustworthy and posed no immediate threat but did not fit the stricter processes, Trezor said. Forty-eight CryptoBilis customers have contacted the company, which checked their devices in its lab or from photos.

CryptoBilis buyers should still move funds to a new wallet with a new seed, because the update cannot protect a backup captured before it was installed, Trezor said. Anyone who bought a Trezor from CryptoBilis from March 2026 onward is eligible for a replacement.