🔍 Read the full analysis: What’s Included In Trezor’s Fix For Safe 5 Wallet Implants? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Trezor says it confirmed implants in three Safe 5 wallets sold through CryptoBilis and released firmware 2.13.1 to stop the implants it has found from capturing data. The update cannot protect recovery words or passphrases captured before it was installed; Trezor says no owners of the three confirmed devices have reported losing funds.
Trezor confirmed implants in three Safe 5 hardware wallets sold through reseller CryptoBilis and says its firmware 2.13.1 update stops the implants it has found from capturing information on devices running the update. The fix does not protect recovery words or passphrases captured before installation, and Trezor says no owners of the three confirmed devices have reported losing funds.
Trezor says each affected Safe 5 had an extra circuit board fitted between the main board and the screen. Its analysis found that the board copied information displayed on the device, including recovery words shown when creating a wallet backup or entered when restoring one. It could also capture a passphrase when one appeared on the screen. Trezor says the implant encrypted the collected data and sent it over a mobile network to a server controlled by the attackers. If it could not connect, it stored the data and tried again later.
The company says the implant did not alter the Safe 5’s firmware or its Secure Element, the device’s dedicated security chip. Trezor released firmware version 2.13.1 on November 11 for the Safe 7, Safe 5, Safe 3 and Model T. According to Trezor, the update blocks the implants it has identified from capturing data on devices running it. It cannot reverse or secure information already captured before the update.
The three confirmed Safe 5s were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from the reseller, Trezor said. The company reported that 48 CryptoBilis customers had come forward and that their devices were being checked. It also said every other device it had examined showed no evidence of tampering, and its checks of devices from other regional resellers found none.
Trezor Safe 5 implant · how it works
What the hidden board copies, and what the fix stops
How Trezor describes the implant it found in three Safe 5 wallets bought from CryptoBilis, and what firmware 2.13.1 changes.
Inside the device (schematic)
mobile network
Step by step
- 1Recovery words appear on the screen, when a wallet backup is created or a wallet is restored
- 2The extra board copies them, and a passphrase if one is shown. Firmware and Secure Element stay unchanged
- 3It encrypts the data and sends it over the mobile network. No connection: it keeps the data and retries
- 4Firmware 2.13.1, released Nov 11: stops the implants found so far from capturing anything
Confirmed
3 Safe 5 devices, bought Aug 20 – Sep 23, 2026 from CryptoBilis
Being checked
48 CryptoBilis buyers came forward; no tampering found at other resellers in the region
Funds lost
None reported so far, Trezor says
Source: Trezor, “Our CryptoBilis investigation: what we found and what we’ve changed”, Nov 12, 2026; Trezor firmware changelog (2.13.1, released Nov 11, 2026). Schematic drawing, not the real board layout.
Graphic: Powered by Thorsten Meyer AI
Why the Screen-Level Implant Matters
The incident targets the information a hardware wallet is meant to keep private: the recovery words that can restore access to funds. Trezor says the implant copied what appeared on the device screen and transmitted it over a mobile connection. If attackers obtained a usable recovery phrase, they could potentially use it outside the affected wallet; the source material does not report that happening in these three cases.
The implant’s placement also affects what users can infer from ordinary software checks. Trezor says the firmware and Secure Element were left unchanged, while the extra board sat between the device’s main board and display. That means a check of the software alone would not necessarily reveal the physical addition described by the company. Trezor’s response centers on the device’s source and purchase history as well as the firmware update, rather than on a user-run test that can identify every altered unit.
The distinction between prevention and recovery is material. Firmware 2.13.1 is a reported block on further capture by the known implants; it does not retrieve data already sent or establish whether a particular device was affected. Owners who think their recovery information may have been exposed need guidance from Trezor about protecting the wallet itself, not only updating its software.
Products Worth Considering
Samsung Odyssey OLED G5 27-Inch QHD Gaming Monitor
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Display, Black
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
As an affiliate, we earn on qualifying purchases.
From CryptoBilis Report to Confirmation
The investigation followed concerns involving another hardware-wallet brand. Trezor says Ledger began investigating customer fund losses linked to devices bought from CryptoBilis on October 9. Ledger later said some devices had been physically tampered with; in an October 15 statement, it described the incident as “an attack on the distribution channel after the devices left our control.” CryptoBilis was also an authorized Trezor reseller, and Trezor says it removed the company from its network on October 9.
On October 28, a Trezor customer in Indonesia reported an extra circuit board in a Safe 5 bought from CryptoBilis through Tokopedia. Trezor warned customers on October 30, before it had examined the device in its lab, saying it considered the report credible enough to act on. On November 12, the company said its lab had examined that wallet and identified two more implanted Safe 5s from photographs supplied by owners.
Trezor says it is working with SEAL 911, the Security Alliance’s emergency response service. The company also reported cutting its reseller network by about 80%. The source material does not provide further detail on how that reduction was calculated or which resellers were affected.
““The update can’t protect a wallet backup that was captured before it.””
— Trezor
Exposure and Customer Checks
The number of affected Safe 5s is not established. Trezor has confirmed three devices, but the source material does not say whether those represent all implanted units. The company said 48 CryptoBilis customers had come forward and were having their devices checked; it did not give the number of checks completed or their final results.
Trezor said no owners of the three confirmed devices had lost funds, but that does not establish whether any captured information reached or was used by the attackers. The source material does not identify the attackers, state how many recovery phrases or passphrases were transmitted, or describe the server’s status. It also does not specify the technical details of how firmware 2.13.1 prevents capture, beyond Trezor’s claim that it stops the implants it has found.
The company said the other devices it had examined and devices checked from its other regional resellers showed no evidence of tampering. The scale and scope of those checks are not given. Owners also cannot determine from the available information whether an individual wallet was affected solely by checking that its firmware or security chip remains unchanged.
Firmware Updates and Wallet Reviews
Trezor has released firmware 2.13.1 for the Safe 7, Safe 5, Safe 3 and Model T. Owners should consult Trezor’s official instructions for checking and updating their device, and contact the company if they bought a wallet through CryptoBilis or suspect tampering. The available source does not provide a separate schedule for further updates or a completion date for the customer checks.
Trezor says it is continuing to examine devices reported by CryptoBilis customers and working with SEAL 911. Further information about the number of affected wallets, investigation findings and any confirmed misuse of captured data has not been provided in the source material. For anyone whose recovery information may have been exposed, the key unresolved issue is whether it was captured before the protective update and what action Trezor advises for securing the associated wallet.
Key Questions
What does Trezor’s firmware 2.13.1 fix?
Trezor says the update stops the implants it has found from capturing information on devices running the firmware. It is available for the Safe 7, Safe 5, Safe 3 and Model T.
Can the update protect recovery words captured earlier?
No. Trezor says firmware 2.13.1 cannot protect a wallet backup captured before installation. The company has not said that the update can retrieve or erase data already transmitted.
How many implanted Trezor wallets have been confirmed?
Trezor has confirmed three affected devices, all Safe 5 wallets bought through CryptoBilis between August 20 and September 23, 2026. The total number of affected devices remains unknown.
Have owners of the confirmed wallets lost funds?
Trezor says none of the owners of the three confirmed devices has reported losing funds. The company has not provided evidence about whether captured information was used or reached the attackers.
Does unchanged firmware mean a Safe 5 was not tampered with?
Not necessarily. Trezor says the implant left the device’s firmware and Secure Element unchanged while adding a circuit board between the main board and the screen. A software check alone may not identify that physical alteration.
Source: ThorstenMeyerAI.com
