Trezor Confirms Malicious Hardware Implants in Wallets Sold via CryptoBilis

Trezor has confirmed the discovery of malicious hardware implants in Trezor Safe 5 wallets purchased through the reseller CryptoBilis. The implants consist of an additional circuit board designed to capture recovery phrases as they are displayed on the device screen.

The company identified the tampering after examining a device in its laboratory and reviewing images provided by other owners. The implant is positioned between the main board and the display. It functions by reading the recovery phrase or passphrase when the user displays them during the setup or restoration of a wallet.

Once the data is captured, the implant encrypts it and transmits it over a mobile network to a server controlled by attackers. If a network connection is unavailable, the implant is designed to retain the data and attempt transmission again until it succeeds.

Mitigation and Security Guidance

Trezor has released firmware version 2.13.1 for the Safe 7, Safe 5, Safe 3, and Model T. This update is intended to prevent the implants from capturing data on wallets running the new firmware. However, Trezor warned that the update cannot protect any recovery phrases that were intercepted before the update was applied.

Users who purchased Trezor devices from CryptoBilis, including through its stores on Tokopedia and Shopee, since March are advised to move their funds to a new wallet with a completely new recovery phrase. Trezor noted that restoring an old phrase onto a new device does not resolve the security risk.

Supply Chain Impact

The incident mirrors a previous report involving Ledger, which confirmed that unauthorised implants were found in hardware wallets also sold by the same reseller. Trezor removed CryptoBilis from its list of official resellers on 9 October 2026.

According to Trezor, the implant does not modify the device’s original firmware or its Secure Element, making the tampering difficult to detect through standard software checks. The company is continuing its investigation into the source of the implants.