By The hardware wallet manufacturer releases emergency firmware protection after discovering devices capable of stealing recovery phrases, while offering replacements to customers who purchased through CryptoBilis. Cryptocurrency hardware wallet manufacturer Trezor has confirmed malicious hardware implants in three Safe 5 devices distributed through Southeast Asian reseller CryptoBilis, prompting a major restructuring of its distribution network and new security guidance for customers. In a November 12, 2026, announcement, Trezor disclosed that three wallets purchased between August 20 and September 23 contained unauthorized electronic components capable of capturing sensitive information displayed on their screens.
The affected devices were purchased directly from CryptoBilis or through its Tokopedia and Shopee marketplace stores. Trezor also confirmed that it had reduced its authorized reseller network by approximately 80%, introducing stricter requirements governing product storage, handling and distribution. The company emphasized that no customers had reported losing cryptocurrency through the identified implants. Its investigation has found no evidence of tampering involving other Trezor models or devices distributed through other resellers, although the inquiry remains ongoing.
Hidden Circuit Boards Could Capture Recovery Phrases
The investigation began after a customer reported a suspicious component inside a Trezor Safe 5 on October 28. Trezor initially treated the report as credible and issued a public warning on October 30 before completing its laboratory examination. Following the warning, 48 CryptoBilis customers contacted the company, allowing devices to be examined physically or through photographs of their internal components. Investigators confirmed three affected devices, including one examined directly in Trezor’s laboratory and two identified through customer-submitted photographs.
According to Trezor’s technical analysis, the implants consisted of additional circuit boards positioned between the devices’ main circuit boards and displays. The components could capture recovery phrases during wallet creation or restoration, along with passphrases entered on the device. Captured information was encrypted and transmitted over mobile networks to attacker-controlled infrastructure. Importantly, the implants did not alter the devices’ firmware or Secure Element, meaning conventional software integrity checks might not reveal their presence. On November 11, Trezor released firmware version 2.13.1, designed to prevent the identified implants from capturing additional information. However, the update cannot invalidate recovery phrases potentially exposed before installation.
What Affected Owners Must Do to Protect Their Cryptocurrency
Trezor has instructed anyone who purchased its hardware wallets from CryptoBilis since March 2026 to transfer existing cryptocurrency holdings into newly created wallets using completely new recovery phrases. Restoring an existing recovery phrase onto another hardware wallet does not eliminate the risk if attackers have already obtained that phrase. Customers who have not initialized their devices should avoid setting them up or entering existing recovery information. The company is offering replacement devices to eligible CryptoBilis customers, with alternative models or refunds available where shipping restrictions prevent direct replacement.
Affected customers should retain their original devices and contact Trezor through its official support website. For customers purchasing through other distributors, Trezor has identified no confirmed cases requiring comparable emergency migration. The company explained that the approximately 80% reduction in authorized resellers was precautionary and did not indicate that the removed businesses were compromised. Remaining distributors must satisfy stronger supply-chain security requirements. Trezor also warned that criminals may exploit the incident through fraudulent replacement offers and phishing messages. The findings highlight an important limitation of hardware wallet security: even when private keys remain protected within dedicated security chips, compromised physical components can expose recovery information before transactions are authorized.