Trezor Identifies Malicious Hardware in CryptoBilis Wallets and Issues Update

Cryptocurrency hardware wallet manufacturer Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and transmit them to attackers via cellular networks.

This confirmation follows an investigation into a suspected hardware implant first reported in October, when a customer discovered an unauthorized circuit board inside a Trezor Safe 5 purchased from CryptoBilis in Indonesia.

At that time, Trezor had not examined the device and could not verify the implant’s capabilities.

In a recent update, Trezor stated that it has now analyzed the original device in its laboratory and identified two additional compromised wallets based on photographs submitted by their owners. All three compromised devices were purchased from CryptoBilis between August 20 and September 23, 2026.

Trezor reported that 48 CryptoBilis customers have contacted the company following its October warning, with devices being examined in its laboratory or through submitted photographs of their internal components. The company also inspected devices from other resellers in the region and found no signs of tampering.

So far, the confirmed implants have been limited to Safe 5 devices sold through CryptoBilis, and no affected customers have reported losing funds.

Firmware Update Blocks Hardware Implants

Trezor’s engineers analyzed the implant’s firmware and confirmed that the malicious hardware could capture sensitive information displayed or entered on the wallet’s screen. The implant consists of an additional circuit board installed between the Safe 5’s main board and display, allowing it to monitor screen activity without altering the device’s legitimate firmware or Secure Element.

When wallet recovery words appear on the screen, either during the creation of a new wallet backup or while restoring an existing wallet, the implant collects them. It can also capture passphrases displayed on the screen, encrypt the stolen information, and transmit it over a mobile network to an attacker-controlled server. If a connection is unavailable, the implant retains the captured data and repeatedly attempts to transmit it until successful.

These reported implants follow confirmed hardware implants previously discovered in Ledger devices sold through CryptoBilis, which have been linked to cryptocurrency thefts.

On November 11, Trezor released firmware version 2.13.1, which includes protections that prevent the implants from capturing information. Trezor stated, “Our latest firmware update 2.13.1, released on November 11th, includes a protection that stops the implants we’ve found from capturing anything on devices that run it, making the current batch of implants useless.” However, the company cautioned that the update cannot protect wallet recovery phrases that may have already been captured before installation.

While no Trezor customers have reported stolen funds, those who purchased Trezor devices from CryptoBilis are advised to transfer their cryptocurrency to a newly created wallet using a new recovery phrase.

Trezor Reduces Reseller Network by 80%

In response to these supply-chain attacks, Trezor has reduced its global reseller network by approximately 80%, significantly decreasing the number of third-party resellers of its hardware wallets. The company had previously announced plans to reduce its reseller network in October, following reports of compromised Ledger wallets sold through CryptoBilis, before learning of the implants in its devices.

Trezor indicated that the removed resellers were trustworthy and posed no threat but did not meet the stricter supply-chain security requirements being implemented. Remaining partners must adhere to tighter controls regarding how devices are sourced, stored, and accessed.

The company is offering replacement devices to anyone who purchased a Trezor wallet from CryptoBilis since March 2026, including customers whose devices have not been confirmed as compromised. Currently, Trezor has found no evidence of device implants from other resellers and has received no reports of funds being stolen through the compromised Safe 5 wallets.

Source: BleepingComputer