Cryptocurrency hardware wallet manufacturer Trezor has confirmed that three of its Safe 5 devices purchased through reseller CryptoBilis were fitted with hidden hardware implants designed to steal users’ wallet recovery phrases.
The implants consist of additional circuit boards installed inside the devices. They are capable of reading recovery phrases displayed on the wallet’s screen and transmitting the information through a mobile network to a server controlled by attackers.
Trezor disclosed that it examined one affected wallet in its laboratory, while the other two were identified through photographs submitted by their owners. The company said it had not received any reports of funds being stolen from the three customers.
According to the company, the malicious components can capture recovery phrases during the initial wallet backup process and when users enter an existing phrase to restore a wallet. They can also collect passphrases displayed on the device.
The stolen information is encrypted before transmission. If the implant cannot establish a network connection, it stores the captured data and continues attempting to send it until the connection becomes available.
Trezor said the implant is positioned between the Safe 5’s main circuit board and its display. Its investigation found that the additional component does not modify the wallet’s original firmware or interfere with its Secure Element.
The company has released firmware version 2.13.1, which it says prevents the identified implants from capturing recovery information on devices running the updated software. The update is available for the Safe 7, Safe 5, Safe 3 and Model T.
However, Trezor warned that installing the update cannot protect recovery phrases that may have been captured before the firmware upgrade.
The company has maintained its security recommendations for customers who purchased Trezor devices from CryptoBilis from March onwards, including through the reseller’s online stores on Tokopedia and Shopee.
Affected customers have been advised to transfer their cryptocurrency holdings to a completely new wallet created with a fresh recovery phrase. Simply restoring an existing recovery phrase on another device will not eliminate the risk if the original phrase has already been compromised.
Trezor also warned customers against setting up unused wallets obtained from the reseller or entering existing recovery phrases into such devices.
Customers have been advised to retain their wallets and contact Trezor Support, which is offering replacement devices to people who purchased from CryptoBilis since March. Anyone uncertain about the source of their wallet has also been encouraged to contact the company.
The manufacturer cautioned against weighing or opening the devices to determine whether they contain implants, explaining that neither method provides a reliable way of identifying compromised wallets.
It also warned users never to disclose their recovery phrases to anyone, stressing that the company would never request such information. Customers were urged to remain alert to scammers impersonating Trezor representatives and offering replacement devices or refunds.
Trezor’s latest disclosure follows an earlier warning issued on October 30, after a customer reported a suspected hardware implant two days before the company had examined the affected device in its laboratory.
CryptoBilis previously operated as an authorised Trezor reseller in Southeast Asia. The company removed the reseller from its official network on October 9, the same day that rival hardware wallet manufacturer Ledger began investigating reports of cryptocurrency losses involving customers who purchased devices through CryptoBilis.
Ledger subsequently confirmed that some of its genuine hardware wallets sold by the reseller had been fitted with unauthorised components designed to capture users’ recovery phrases during device setup.
The stolen information was reportedly used to gain access to victims’ cryptocurrency wallets, with attackers draining funds in a coordinated operation.
Trezor said the implants discovered in its Safe 5 devices operate in a similar manner to those found in Ledger products, although they have been adapted to capture information through the Safe 5’s display.
The company has not identified the individuals responsible for installing the malicious components or established the exact point in the supply chain where the tampering occurred.
The three affected Safe 5 wallets were purchased between August 20 and September 23. Trezor said its investigation has so far identified implants only in Safe 5 devices sold through CryptoBilis, with no evidence of similar cases involving other models or devices obtained from different authorised resellers.
Following its initial warning, Trezor invited customers who purchased devices through CryptoBilis to report their purchases. The company said 48 customers had contacted it, and it was examining their devices either physically in its laboratory or through photographs showing their internal components.
Although the company has not disclosed how many of the 48 devices have been examined, it confirmed that none of the three owners whose wallets were identified as compromised had reported losing cryptocurrency.
Trezor also explained that its wallets are self-custodial, meaning it does not have direct access to customers’ cryptocurrency balances and cannot independently verify the amount of funds held in individual wallets.
Beyond the hardware investigation, the company disclosed that it had reduced its reseller network by approximately 80 per cent as part of tighter security and distribution requirements.
The restructuring was first announced on October 13, more than two weeks before the initial report of a suspected implant in a Trezor wallet.
In a letter to affected partners, the company explained that removed resellers would no longer receive new stock but could continue selling their existing inventory until January 1, 2027, after which they would be taken off its authorised reseller list.
Trezor said its investigation remains ongoing. It will provide further updates if it discovers implants in devices outside the CryptoBilis distribution network or in other wallet models, receives reports of financial losses connected to the incident, or introduces additional security measures.