Trezor confirms 3 CryptoBilis wallet implants, cuts resellers 80%

By Tom Whitfield

Trezor confirmed unauthorized “spy implants” in three Safe 5 hardware wallets bought through CryptoBilis and said: “We have cut our reseller network by about 80%.”

The reseller reduction plans emerged in October. Trezor now describes the removed partners as trustworthy and posing no immediate threat, while remaining sellers must meet stricter requirements governing sourcing, storage and access to devices.

Those requirements place sourcing, storage and access controls directly on the remaining reseller channel. Trezor’s language does not accuse the removed sellers of operating implants; it frames the reduction as a tightening of distribution safeguards.

What did the implant capture?

Trezor’s analysis placed the unauthorized board between the Safe 5’s screen and main board, the primary circuit board connecting its electronic components. The board recorded recovery words during wallet creation or restoration and captured displayed passphrases, optional extra secrets used to access separate wallets.

The implant did not change the device’s firmware or Secure Element, its dedicated security chip. It copied what appeared on the display without modifying either component, according to Trezor.

The captured material consisted of recovery words shown during creation or restoration and any passphrases displayed on screen. Recovery words and passphrases can authorize wallet access, so their capture creates exposure beyond the physical device.

The board encrypted captured data and sent it over a mobile network to a server operated by the attackers. Without a signal, it stored the data and kept retrying until the transfer succeeded.

Trezor said the implant worked like those found in some Ledger devices. In the Ledger case, attackers bought genuine devices, modified them and put them back on sale through resellers in Southeast Asia.

How broad is the confirmed exposure?

Ledger confirmed an unauthorized hardware implant in an affected customer’s wallet in October. Trezor’s findings remained limited to Safe 5 devices bought from CryptoBilis; checks of devices from other regional resellers found no tampering.

Trezor also reported no confirmed implants in other models. Its replacement guidance nevertheless extends beyond Safe 5 because every model bought from CryptoBilis from March onward qualifies.

What should CryptoBilis buyers do?

An update blocks capture by the identified implants, but it cannot undo exposure from wallet backups already taken. Trezor continues to advise CryptoBilis buyers to transfer funds to newly created wallets, because replacing hardware while reusing the same recovery phrase leaves that exposure intact.

The exposure therefore persists outside the physical device. Even if the malicious board stops operating, a recovery phrase copied earlier can still recreate the same wallet on replacement hardware, so Trezor recommends a transfer to a fresh wallet.

Owners of suspected tampered devices should retain them and avoid setup or use pending guidance from Trezor Support. Customers must arrange replacements through official Trezor Support, while buyers uncertain about a device’s origin should verify that origin with the company.

Replacement eligibility covers every model purchased from CryptoBilis from March onward. Depending on shipping restrictions, Trezor may require a different model with a refund of the price difference, delivery to another country, or a refund.

How is Trezor handling replacement fraud?

Trezor warned that scammers could impersonate staff and offer replacements or refunds. The company reiterated that it never requests recovery phrases.

Trezor continued working with SEAL 911, the Security Alliance’s emergency response service for cryptocurrency incidents. It also pledged a reward for the customer who first reported the implant.

The next checkpoint is operational: Trezor must apply stricter sourcing, storage and access controls across its remaining reseller network while processing replacements for every CryptoBilis purchase from March onward.