Trezor removes 80% of resellers after three wallets found with implants

Firmware version 2.13.1, released Nov. 11, changes the order of commands sent to the wallet’s display, disrupting the sequence that triggered the implant’s recording, according to Trezor. The company’s Nov. 12 update said the fix cannot protect recovery words captured before installation. CryptoBilis customers should create a new wallet with a new seed and transfer their funds; those who have not set up a device bought from the reseller should not do so or enter an existing backup.

The three affected devices were purchased between Aug. 20 and Sept. 23, 2026, through CryptoBilis’s Tokopedia or Shopee stores or directly from the reseller. Engineers examined the first wallet in Trezor’s laboratory and identified implants in the other two from photographs provided by their owners. Since asking customers to come forward in October, Trezor has heard from 48 CryptoBilis buyers.

The implant is an extra circuit board fitted between the Safe 5’s main board and screen. Trezor said it could copy recovery words and passphrases displayed during wallet creation or restoration, encrypt the information and send it over a mobile network to an attacker-controlled server. If no connection was available, it stored the data and tried again later. The company said no customer had reported losing funds and no implant had been confirmed outside CryptoBilis. It found no evidence of tampering in other examined devices, including wallets from other regional resellers, and has not confirmed an implant in another Trezor model.

Trezor removed CryptoBilis as an authorized reseller on Oct. 9 after reports of tampered Ledger wallets sold by the business. Its first warning about a suspected Trezor implant followed on Oct. 30. Customers who bought a Trezor from CryptoBilis from March 2026 onward qualify for a replacement. Depending on shipping restrictions, they may receive a different model with the price difference refunded, arrange delivery to another country or request a refund. Trezor advised customers to keep their devices and contact Support, warning that its staff will never ask for recovery phrases.