Trezor Says Safe 5 Update Changes Display Commands to Block Spyware

Trezor says a Safe 5 firmware update changes display commands to block a spyware implant’s trigger sequence, while new vendor rules are set to reshape the company’s reseller network.

The Nov. 11 update changes the order of commands sent from the wallet’s MCU to its display, Trezor said. The company said the change does not affect what appears on screen. A Trezor spokesperson said the implant monitors communication between the MCU and display and activates when it detects a specific sequence.

The explanation adds technical detail to the update released after Trezor identified implants in three Safe 5 wallets sold through CryptoBilis, a Malaysian reseller. Trezor urged affected customers to move their funds to a new wallet because the update cannot protect a wallet backup captured before installation.

Trezor said only 20% of vendors met new requirements covering how devices are sourced, stored and who can access them. The stricter rules are tied to an 80% reduction in the reseller network.

Some reseller authorizations are scheduled to end Jan. 1, 2027. Affected sellers can continue selling existing inventory through the holiday season.