Trezor has confirmed a hardware implant in three Trezor Safe 5 wallets bought from CryptoBilis, a former reseller in Southeast Asia, and said on November 12, 2026 that firmware 2.13.1 stops the implants it has found from capturing anything. The firmware does not undo earlier exposure: a recovery phrase the implant already read is still in the attackers’ hands, so CryptoBilis buyers are told to move their funds to a new wallet with a new seed.

That is the main point of Trezor’s investigation update. The rest of this report sorts out which owners need to act, and what the update does and does not change.

What Trezor found

  • Three implanted devices. All three are Trezor Safe 5 units, including the one first reported in October. Trezor’s lab examined that device; the other two were identified from photos their owners sent of the internals.
  • One seller, a short window. All three were bought between August 20 and September 23, 2026, through CryptoBilis’s Tokopedia and Shopee stores or directly from CryptoBilis.
  • No other models or resellers so far. Trezor says it has found no implant in devices from any other reseller or in any other Trezor model. It has also checked devices from its other resellers in the region and found no tampering.
  • No reported losses. None of the three owners has lost funds, and no customer has reported a loss tied to the implants.
  • 48 buyers checked. That many CryptoBilis customers have contacted Trezor since October, and their devices are being checked in the lab or from photos.

How the implant reads a recovery phrase

The implant is an extra circuit board fitted between the Safe 5’s main board and its screen. According to Trezor, which extracted and analyzed its firmware, it only listens. It copies whatever the screen shows, including what the owner types on the device, and changes nothing on the wallet itself: not the firmware and not the Secure Element chip that holds the keys.

When recovery words appear on screen, the implant stores them. That covers both moments a seed is visible: when the device shows a new wallet backup, and when an owner types an existing backup in to restore a wallet. It does the same with a passphrase if one appears on screen. It then encrypts what it captured and sends it over a mobile network to a server the attackers control, retrying until it gets a connection.

Nothing in the wallet’s own software changes, so the attack sits between that software and the owner’s eyes. Trezor says the implant works the same way as the ones found in Ledger devices sold by the same reseller, adapted to the Safe 5’s display. Ledger described its case on October 15 as an attack on the distribution channel after the devices left its control.

What firmware 2.13.1 changes

Trezor’s firmware changelog, checked on November 14, 2026, lists version 2.13.1 with a release date of November 11, 2026 for four models:

  • Trezor Safe 7
  • Trezor Safe 5
  • Trezor Safe 3
  • Trezor Model T

The previous version for all four, 2.13.0, came out on October 21, 2026. Trezor says 2.13.1 includes a protection that stops the implants it has found from capturing anything on devices that run it, “making the current batch of implants useless.” It has not published technical details of that protection and says it will not publish details that could help attackers.

The limit matters more than the fix. A Safe 5 from CryptoBilis that showed or received its recovery phrase before the update may already have sent that phrase out. Updating afterwards protects what happens next on that device, not the seed that already passed across the screen.

What to do, depending on where your Trezor came from

  • Bought from CryptoBilis since March 2026 and already in use. Move your funds to a new wallet with a new recovery phrase. Restoring the old phrase on a different device does not help, because the old phrase is what may have leaked. Trezor’s first notice adds that if no other secure hardware wallet is at hand, a software wallet or an exchange account you already know can hold the funds for now; check the full receiving address before sending.
  • Bought from CryptoBilis and not set up yet. Do not set it up, and never type an existing recovery phrase into it.
  • Any CryptoBilis buyer since March 2026. Keep the device and contact Trezor Support for a replacement. Where shipping rules prevent delivery of the same model, Trezor offers a different model with the price difference refunded, delivery to another country, or a refund.
  • Bought elsewhere. Trezor has no confirmed cases outside CryptoBilis. If you are not sure where a device came from, the seller’s name on the receipt is the first check; Trezor Support is the second.

Trezor also says not to weigh or open a device to test it. The person who first reported the implant noticed a weight difference, but small differences have other causes, so a scale cannot confirm or rule out tampering. And no support agent needs your recovery phrase: scammers are already using the incident to offer fake replacements and refunds by email, letter and phone.

For why a recovery phrase is the whole wallet, and why moving to a “new wallet” means a new phrase rather than a new device, see our explainer on wallet keys and coins. The wider trade-off between holding your own keys and leaving them with a platform is in self-custody versus an exchange account.

The timeline

  • October 9, 2026. Ledger begins investigating fund losses among customers who bought from CryptoBilis. Trezor removes CryptoBilis as an authorized reseller the same day.
  • October 28. Trezor receives a responsible disclosure about an implant in a Safe 5 bought from CryptoBilis via Tokopedia in August.
  • October 30. Trezor publishes its first notice, treating the report as credible before examining the device.
  • November 11. Firmware 2.13.1 is released for the Safe 7, Safe 5, Safe 3 and Model T.
  • November 12. Trezor publishes its investigation update: three confirmed implants, the firmware protection, and a reseller network cut by about 80%.

Trezor says the resellers it dropped were trustworthy and posed no immediate threat, but did not fit stricter rules on how devices are sourced, stored and who can handle them. It is working with SEAL 911, the Security Alliance’s emergency response service, and says it will add dated updates to the top of its post if it confirms an implant outside CryptoBilis, in another model, or a loss of funds.