Hardware wallet maker Trezor published an investigation confirming malicious hardware implants in three Safe 5 wallets bought through CryptoBilis between Aug. 20 and Sept. 23, 2026. The implants could collect seed phrases and passphrases used to access crypto assets, and Trezor warned that its Nov. 11 security update cannot protect information stolen before installation.

The affected wallets were bought from CryptoBilis stores on Tokopedia and Shopee or directly from the reseller. Trezor examined one device in its laboratory and identified two others from photographs of their internal components submitted by the owners.

After reports of possible tampering emerged in October, Trezor asked CryptoBilis customers to contact its support team. The company has received 48 inquiries and is checking devices. It also inspected wallets sold by other resellers in the region and said it found no signs of tampering. No customer has reported losing funds, according to Trezor.

Implants captured information from the screen

Trezor said the implant was an additional board installed between the Safe 5’s main board and screen. It did not alter the wallet’s operation but read information shown on the display, including data entered by the user.

The module could recognize and store wallet recovery words displayed when a user created a backup. It could also capture words entered to restore an existing wallet and intercept a passphrase when displayed on the screen.

According to Trezor’s analysis, the implant encrypted the collected information and sent it to the attackers’ server over a mobile network. If it could not connect, it retained the data and tried again. Trezor said the module operated similarly to implants previously found in Ledger devices but was adapted for the Safe 5 design.

Firmware blocks further collection

Trezor released firmware version 2.13.1 on Nov. 11, 2026. The company said the update prevents the detected implants from collecting information, but it cannot secure a seed phrase that may already have been intercepted.

Trezor advised customers who bought wallets through CryptoBilis and had already set them up to move their assets as soon as possible to a new wallet protected by a new seed phrase. Users should not reuse the old phrase on another hardware or software wallet. If no other secure hardware device is available, the company recommends temporarily using a trusted software wallet or crypto exchange.

Customers who have not set up a device purchased through CryptoBilis should not activate it or enter the recovery phrase of an existing wallet, Trezor said.

Trezor offers replacements and cuts reseller network

Trezor reduced its reseller network by about 80%. The company said it also removed partners that posed no direct threat but failed to meet stricter requirements covering supply, device storage and access control.

The company is offering replacements to everyone who purchased a Trezor device through CryptoBilis since March 2026, not only the owners of the three confirmed compromised Safe 5 wallets. Customers must retain the device and contact Trezor support. Depending on the delivery country, they may receive a different model with compensation for any price difference, delivery to an address in another country, or a refund.

Trezor previously removed CryptoBilis from its reseller list after reports that the company was selling modified Ledger devices. It then began inspecting Trezor wallets bought from the seller.

The manufacturer urged users not to share seed phrases with anyone, including people claiming to represent customer support. Trezor said its representatives never request recovery phrases and that customers should handle concerns about suspicious devices only through official support.

Trezor has previously reported a data leak affecting more than 13,000 customers following the ShipMonk hack, warned of a new phishing wave and disclosed the compromise of a third-party email provider.

Source: Incrypted