Hardware wallet maker Trezor confirmed that three Safe 5 devices sold through Southeast Asian reseller CryptoBilis between August 20 and September 23, 2026, contained unauthorized circuit boards equipped with cellular modules and antennas. The malicious implants were located between the device's main board and touchscreen and were capable of capturing recovery phrases and passphrases displayed during wallet creation or restoration. Trezor said the captured data was encrypted and transmitted over mobile networks to attacker-controlled infrastructure.
The investigation began on October 28, 2026, after a customer report via Trezor’s responsible disclosure program, followed by a public warning on October 30. Trezor examined 48 devices submitted by CryptoBilis customers—either physically or through photographic evidence—and confirmed only three affected units, one examined in Trezor’s laboratory and two verified from customer photographs. The implants did not alter the firmware or Secure Element, meaning normal software integrity checks might not detect the compromise. Trezor found no evidence of tampering in other models or in devices sold through other authorized channels.
On November 11, 2026, Trezor released firmware version 2.13.1 to block the implants from capturing further data, but the company warned the patch alone is insufficient for buyers from the compromised channel. Customers who purchased from CryptoBilis since March 2026 were urged to transfer funds to newly created wallets with new recovery phrases and avoid restoring existing phrases. Trezor also cut its authorized reseller network by about 80%, imposed stricter supply-chain controls, and offered replacements or refunds to affected customers. The company noted no customer losses had been reported as of November 12, and cautioned users to beware of phishing messages and fake replacement offers.
