Trezor confirmed on the 12th of November that three Safe 5 hardware wallets sold by CryptoBilis contained malicious implants. Fortunately, no customer had reported losing funds.

Still, Trezor urged affected buyers to move their crypto after releasing a firmware fix.

Customers bought those 3 devices between the 20th of August and the 23rd of September through CryptoBilis directly or its Tokopedia and Shopee stores. Trezor examined one device in its lab and identified two more from customer photos.

48 buyers had contacted the company, and at press time, checks were ongoing. Trezor reported that there were no confirmed cases involving other models or resellers.

Why did Trezor urge buyers to move funds?

Apparently, the implants could take recovery phrases and passphrases that appeared on the wallet screen.

On X, a user asked how a software update could stop a physical implant from recording the display. Trezor explained that firmware could “listen to the communication between the MCU and the display,” and the firm has now changed the order of commands needed for the trigger.

Regardless, Trezor still urged buyers to use a fresh recovery phrase because “the update can’t protect a wallet backup that was captured before it.” This advice applied to customers who bought a Trezor from CryptoBilis from March 2026 onward.

The hardware wallet company also urged those using its devices to move funds to a new wallet with a fresh recovery phrase. It told buyers with unused devices to leave them unconfigured. Eligible buyers could contact Trezor Support for a replacement or a refund where shipping limited their options.

How did the Ledger case shape Trezor’s response?

Trezor dropped CryptoBilis on the 9th of October after reports of tampered Ledger devices sold through them. A customer also flagged a suspected Safe 5 implant on the 28th of October.

Trezor issued a warning two days later, saying that it cut its reseller network by about 80% and tightened rules on sourcing, storage, and access.

This brought the debate back to what self-custody protects, and as Ledger CEO Pascal Gauthier said,

Everybody will be hacked at some point. Perfect security doesn’t exist.

Everybody will be hacked at some point. Perfect security doesn’t exist.

 

Final Summary

  • Trezor confirmed that there were three tampered Safe 5 wallets sold through CryptoBilism, but no one had experienced losses yet.
  • However, affected buyers still need a wallet with a fresh recovery phrase.