Trezor finds hardware implants in Safe 5s sold by CryptoBilis, cuts reseller network by 80%

Trezor has confirmed that three of its Safe 5 hardware wallets were physically tampered with before reaching customers. Someone had installed unauthorized circuit boards inside them.

All three devices were sold through CryptoBilis, a Southeast Asian reseller, between August 20 and September 23, 2026. The company disclosed the findings on November 12, 2026. It also announced it had cut its reseller network by approximately 80%.

What Trezor found inside the devices

The implants were extra circuit boards carrying cellular modules and antennas. They sat between the device’s main board and its screen.

Trezor examined one of the affected units in its lab. For the other two, it relied on photographic evidence.

According to the research findings, 48 devices were inspected in total. Only three were confirmed to carry the implants.

Trezor said its wider investigation found no tampering in any other models. It also found none in units sold through other resellers. That points to a breach confined to this single sales channel, not a compromise of the company’s own manufacturing line.

Firmware patch, reseller purge, and a recommended reset

Trezor’s technical fix arrived a day before the public disclosure. Firmware version 2.13.1 shipped on November 11, 2026.

The update is designed to block the implants from capturing sensitive data on devices that install it. The hostile hardware may still be physically present. The new firmware is meant to stop it from getting anything useful.

Trezor says no customer financial losses have been reported. Even so, it is not treating the firmware update as the end of the story.

The company is urging anyone who bought from CryptoBilis to move their funds to a new wallet. That new wallet should use a fresh seed phrase.

The reseller cuts are the bigger structural change. Trezor trimmed its authorized network by approximately 80% and imposed tighter rules on the partners that remain.

CryptoBilis had already been removed earlier. Trezor ended the relationship on October 9, 2026. The research findings say that decision followed revelations of similar threats involving Ledger devices tied to the same reseller.

How the tampering came to light

The investigation began with a responsible disclosure on October 28, 2026. It flagged possible tampering in a Safe 5 bought in August from Tokopedia.

That report set off a broader probe. Trezor then issued additional advisories to customers. The confirmed count of implanted devices landed at three.

Trezor had already cut ties with CryptoBilis weeks before the disclosure arrived. The Ledger-related concerns appear to have put the reseller on the radar before Trezor had hard evidence about its own devices.

What this means for hardware wallet buyers

For anyone holding a Safe 5 bought from CryptoBilis, the steps are clear. Update to firmware 2.13.1. Then follow Trezor’s advice and move funds to a new wallet with a new seed phrase.

Owners who bought elsewhere have less to worry about, based on Trezor’s findings. The company says it found no tampering outside this single channel.