Trezor Safe 5 Update Reworks Display Commands to Block Spyware

Trezor's Nov. 11 firmware update for the Safe 5 hardware wallet changes the order of commands sent from the device's MCU to its display — a deliberate break in the trigger sequence used by a recently discovered spyware implant, the company said.

The change does not affect what users see on screen, Trezor said. A company spokesperson explained that the implant works by monitoring communication between the microcontroller and the display, and activates only when it detects a specific command sequence. Reordering that traffic neutralizes the trigger without altering the user interface.

What happened to the tampered wallets?

The update follows Trezor's identification of implants inside three Safe 5 wallets sold through CryptoBilis, a Malaysian reseller. Trezor disclosed the tampered units earlier and released the patch as a defensive measure for the broader device fleet.

The company urged affected customers to move their funds to a new wallet. The firmware fix, Trezor stressed, cannot protect a wallet backup that the implant already captured before installation. In other words, the update stops the spyware from firing — it doesn't undo a seed phrase that may already have been exfiltrated.

That distinction matters operationally. Anyone holding one of the compromised devices faces a migration, not just a patch: create a fresh wallet on untampered hardware, transfer assets, and retire the suspect unit.

How is Trezor reshaping its reseller network?

Alongside the firmware work, Trezor is overhauling how its devices reach customers. The company said only 20% of its vendors met new requirements covering how devices are sourced, how they're stored, and who can access them along the chain.

The stricter standards come with a significant commercial cost: an 80% reduction in Trezor's reseller network. Vendors that fail the new sourcing, storage and access-control bar are being cut from the authorized channel entirely.

Some reseller authorizations are scheduled to end Jan. 1, 2027. Affected sellers won't be forced to halt sales immediately — Trezor is letting them continue moving existing inventory through the holiday season before the cutoff takes effect.

The move signals a supply-chain hardening posture that goes beyond a point fix for the CryptoBilis incident. By shrinking the authorized network to vendors that can demonstrate controlled custody of devices from sourcing through sale, Trezor is trading distribution reach for tamper resistance — a bet that a smaller, audited channel costs less than repeated implant scandals.

What should Safe 5 owners do now?

The practical takeaways for users are narrow but consequential. Install the Nov. 11 firmware update, since it blocks the implant's activation sequence on patched devices. If the wallet came from CryptoBilis, treat the firmware update as insufficient: move funds to a new wallet and assume any backup taken before the patch could be compromised.

For the rest of the market, the episode is a reminder that hardware wallet security now extends past chip design and firmware signatures into logistics. The tampered Safe 5 units didn't require a firmware exploit — they required physical access somewhere between factory and customer.

Resellers losing authorization have until Jan. 1, 2027 to sell through inventory, giving the market a defined window in which Trezor's old distribution footprint shrinks to the 20% of vendors that cleared the new bar.