Tzor Cuts 80% of Resellers After Hardware Wallet Implant Discovery

Trezor has cut its reseller network by roughly 80% after hardware implants were found in three Safe 5 wallets sold through former reseller CryptoBilis, the hardware wallet maker said in a Nov. 12 investigation update. A firmware patch, version 2.13.1, shipped on Nov. 11.

The implants cannot steal funds directly. But they can capture something more dangerous: recovery phrases.

How the implant works

Trezor's embedded engineering team extracted and analyzed the implant's firmware. The device is an extra circuit board placed between the Safe 5's main board and its screen.

It works like a listener. It watches the communication between the microcontroller and the display, then starts recording when it recognizes a particular sequence. It does not touch the wallet's own firmware or Secure Element.

The implant captures recovery words shown during wallet backup creation, words entered when restoring an existing wallet, and passphrases that appear on screen. Captured data is encrypted and transmitted over a mobile network to an attacker-controlled server. When no connection is available, the implant stores the data and retries later.

On X, Trezor explained the fix: engineers changed the order of commands sent to the screen, so the trigger no longer works on devices running 2.13.1.

Why the firmware fix isn't enough

The patch blocks the identified implants from recording. It cannot undo what they already recorded. Recovery words collected before installation could already be in an attacker's hands.

"If you bought from CryptoBilis, you should still move your funds to a new wallet with a new seed," Trezor said.

The guidance echoes the company's Oct. 30 warning, which advised against importing an old recovery phrase into any other hardware or software wallet. Customers who bought from CryptoBilis but haven't set up their device should not configure it or enter an existing backup.

Three devices, 48 buyers checked

All three affected Safe 5 units were bought between Aug. 20 and Sept. 23, 2026, through CryptoBilis's Tokopedia and Shopee storefronts or directly from the reseller.

Engineers examined the first reported device in Trezor's laboratory. The other two implants were identified from photographs supplied by their owners.

Since its October appeal for customers to come forward, Trezor has heard from 48 CryptoBilis buyers. Every other device examined showed no evidence of tampering. Inspections of wallets from other resellers in the region found none either. No implant has been confirmed in another Trezor model, and no customer has reported losing funds.

Trezor removed CryptoBilis as an authorized reseller on Oct. 9, after reports of tampered Ledger wallets sold through the same business. The first warning about a suspected Trezor implant followed on Oct. 30.

What about the other removed resellers?

The roughly 80% cut goes well beyond one rogue seller. Trezor said the removed resellers were trustworthy and posed no immediate threat. They failed to meet stricter handling requirements now being rolled out across the remaining partner network — covering how devices are sourced, stored, and accessed.

Spotting a tampered unit is hard. Trezor said there are no obvious external differences, that opening a wallet can damage it, and that a well-made implant can remain difficult to identify even with reference photographs.

Who gets a replacement?

Any customer who bought a Trezor from CryptoBilis from March 2026 onward qualifies for a replacement — a window deliberately extending beyond the purchase dates of the three identified devices.

Shipping restrictions may require a different model, with the price difference refunded, delivery to an address in another country, or a straight refund. Customers should keep their devices and arrange assistance through Trezor Support.

Trezor also warned that scammers may impersonate support staff offering replacements or refunds, and stressed that its staff will never ask customers to share their recovery phrases. Affected buyers now face a practical deadline of their own: install 2.13.1, then move funds to a fresh wallet with a new seed before any previously captured phrase can be used against them.