Trezor Confirms Crypto-Stealing Implants in Three Safe 5 Wallets, Releases Fix
Summary
Trezor confirmed implants in three Safe 5 wallets sold by CryptoBilis could capture recovery phrases and transmit them over cellular networks. Firmware 2.13.1 blocks the implants, but previously captured phrases may remain at risk.
Key points
- Trezor confirmed implants in three Safe 5 devices purchased from CryptoBilis between August 20 and September 23, 2026.
- The added circuit board could capture recovery words and passphrases shown on the wallet screen, then encrypt and transmit them over a mobile network.
- Trezor released firmware 2.13.1 on November 11, which the company says prevents the identified implants from capturing information.
- The update cannot protect recovery phrases that may have been captured before installation; CryptoBilis customers are advised to move funds to a new wallet with a new recovery phrase.
- Trezor says no customers have reported lost funds and it has found no evidence of implants in devices from other regional resellers.
- Trezor reduced its reseller network by about 80% and is offering replacement devices to CryptoBilis customers who purchased since March 2026.
Article Details
- Victim Organization
- Individual Trezor Safe 5 purchasers; no affected organizations are identified.
- Incident Type
- Supply-chain hardware implant that captured wallet recovery phrases and passphrases and transmitted them over a mobile network.
- Data Types Exposed
- Wallet recovery phrases
- Passphrases displayed on the wallet screen
- Affected Records
- Three devices confirmed compromised. Trezor received contacts from 48 CryptoBilis customers, but the article does not say those devices were all affected.
- Affected Data Size
- Unknown; the number of captured recovery phrases or passphrases is not reported.
- Operational Impact
- Trezor confirmed implants in three Safe 5 devices sold through CryptoBilis. No affected customers had reported lost funds. Trezor released firmware version 2.13.1 to block the implants and offered replacement devices to CryptoBilis purchasers since March 2026.
- Ransom Or Extortion
- None reported. The implants were designed to capture and transmit wallet secrets; no stolen funds were reported.
- Claim Status
- confirmed