Trezor Confirms Malicious Implants in Three Safe 5 Wallets

Trezor confirmed that three Safe 5 hardware wallets sold by CryptoBilis contained malicious implants capable of exposing recovery phrases and passphrases, creating a supply-chain security risk for hardware-wallet users.

The implants can capture data shown on a device’s screen and transmit it over a mobile network to a server controlled by attackers. Trezor released firmware version 2.13.1 on Nov. 11 to disable the implants it identified. The company said it has also reduced its reseller network by about 80% and has received no customer reports of stolen funds.

The three confirmed cases involve devices sold through CryptoBilis. Customers who bought through the reseller from March 2026 can apply for replacements. Trezor says affected users should move funds to a wallet created with a fresh recovery seed because the firmware update cannot erase information already exposed.

The incident highlights how the route a hardware wallet takes to a buyer can matter for security: firmware can disable the identified implant, but cannot reverse earlier exposure.