Trezor Cuts Reseller Network by 80% After Hardware Implant Discovery

Trezor has cut its reseller network by roughly 80% after confirming that three Safe 5 hardware wallets sold through the Malaysian reseller CryptoBilis contained malicious implants. The Czech hardware wallet maker confirmed the tampering on November 12. No customer has reported losing funds so far.

The numbers are small. The consequences are not. Three devices, sold between August 20 and September 23 through CryptoBilis directly or its Tokopedia and Shopee storefronts, carried implants capable of capturing recovery phrases and passphrases as they appeared on the wallet screen. Trezor examined one device in its own lab and identified the other two from customer photographs. At press time, 48 buyers had contacted the company, and checks were still running. Trezor reported no confirmed cases involving other models or other resellers.

Why did buyers still need to move funds?

Trezor blocked the implants it found. Then it told affected buyers to move their crypto anyway. That combination puzzled users, and one of them put the obvious question on X: how can a software update stop a physical implant from recording the display?

Trezor's answer was technical and specific. The firmware, the company explained, can "listen to the communication between the MCU and the display," and Trezor has now changed the order of commands needed for the implant's trigger. In other words, the update neutralizes the implant's firing mechanism rather than removing the hardware itself.

That leaves a gap the patch cannot close. Trezor urged buyers to generate a fresh recovery phrase because "the update can't protect a wallet backup that was captured before it." The advice applied to anyone who bought a Trezor device from CryptoBilis from March 2026 onward. Buyers with unused devices were told to leave them unconfigured. Eligible customers can contact Trezor Support for a replacement, or a refund where shipping makes a swap impractical.

How did the Ledger case shape the response?

The CryptoBilis problem surfaced through another company's hardware. Trezor dropped the reseller on October 9, after reports of tampered Ledger devices sold through the same channel. On October 28, a customer flagged a suspected Safe 5 implant. Trezor issued a public warning two days later.

The warning carried the structural fix. Alongside the roughly 80% cut to the reseller network, Trezor tightened rules on sourcing, storage, and access across its supply chain. That is the operational consequence of this episode: fewer intermediaries, tighter custody of inventory between factory and customer, and a shorter attack surface for anyone trying to implant hardware before it reaches a buyer.

The episode also revived an older argument about what self-custody actually protects. Ledger CEO Pascal Gauthier framed it bluntly:

Everybody will be hacked at some point. Perfect security doesn't exist.

What does this change for hardware wallet buyers?

For now, the exposure is contained: three devices, one reseller, one model, zero confirmed losses. But the burden of verification has shifted. Trezor's guidance — fresh recovery phrase, fresh wallet, unconfigured devices left untouched — assumes the customer cannot trust the physical object in the box, even when the vendor has patched around the implant.

Trezor's checks on the 48 buyers who came forward remain ongoing, and the company says no other resellers or models are implicated. Whether the tightened sourcing and storage rules hold will show up in the next audit cycle, not in this week's headlines.