Trezor Confirms Spy Implants in Three Safe 5 Wallets and Cuts Its Reseller Network by 80%

Published November 13, 2026, 1:10 AM PKT. Based on Trezor's own update published on November 12, 2026, as reported by Protos, which quotes the update and a Trezor spokesperson (primary source), and reporting from Crypto Briefing and KuCoin the same day (secondary sources). Market data from CoinGecko, November 12, 2026.

Trezor said on Thursday, November 12, that it has confirmed spy implants in three of its Safe 5 hardware wallets sold through Malaysian reseller CryptoBilis, and has cut its authorized reseller network by about 80 percent in response. The confirmation turns a suspected case this site reported on October 31 into a verified supply chain attack, and the reseller cut is the largest structural change Trezor has made to how its wallets reach customers.

The three tampered devices were sold between August 20 and September 23, 2026, through CryptoBilis, its Tokopedia and Shopee stores, or directly from the reseller. Trezor examined one of the three units in its laboratory and relied on photographic evidence for the other two, and says it inspected 48 devices in total during the investigation. No tampering was found in any other Trezor model, and none was found in devices sold through any other reseller, according to the company.

Three wallets, one reseller, one hidden board

The implant was an extra circuit board fitted between the wallet's main board and its screen, carrying a cellular module and an antenna. It was hidden inside the sealed device, invisible to the buyer, and it was designed to watch what the screen showed. Trezor said the implant listens to the communication between the wallet's microcontroller and its display, and triggers a capture when it sees a specific sequence, the moment a recovery seed phrase appears on screen. According to reporting on the company's findings, the board copies the display content, identifies and stores mnemonic phrases and passphrases, then encrypts them and transmits them over mobile networks to servers controlled by the attackers.

The investigation began with a responsible disclosure on October 28, 2026, when a buyer in Indonesia reported a possible implant in a Safe 5 bought in August through Tokopedia. Trezor treated the report as credible, warned CryptoBilis buyers on October 30 to move their funds to newly created wallets, and arranged to receive the device for laboratory examination. The November 12 update is the result of that examination, and it narrows the confirmed damage to three devices out of the 48 inspected.

Firmware 2.13.1 and its limit

Trezor's technical fix arrived a day before the public disclosure. Firmware version 2.13.1 shipped on November 11, 2026, and is designed to stop the implants from capturing sensitive data. A Trezor spokesperson told Protos that the company changed the order of the commands sent to the display, which defeats the trigger the implant listens for, and that it can make the change without any effect on what appears on screen. The company describes the update as rendering the identified implants useless.

The fix has a hard limit, and Trezor states it plainly. The update cannot protect a wallet backup that was already captured before the firmware was installed, so CryptoBilis buyers are still urged to move their funds to a new wallet with a freshly generated seed phrase. Anyone who bought a Trezor device from CryptoBilis since March 2026 can request a free replacement device. Trezor says it has received no customer reports of stolen funds from the affected devices.

The reseller network, cut by 80 percent

The bigger structural change is the reseller purge. Trezor said it has trimmed its authorized network by approximately 80 percent and imposed tighter rules on the partners that remain, covering how devices are sourced, stored and who has access to them. Only about 20 percent of vendors were able to meet the new rules. Trezor stressed that the dropped resellers were trustworthy and posed no immediate threat, which frames the cut as a supply chain tightening rather than a finding of guilt against the wider network.

CryptoBilis itself was already gone before the disclosure. Trezor ended the relationship on October 9, 2026, after Ledger began investigating physically tampered Ledger devices sold through the same channel. The removal came three weeks before the first Trezor implant report reached the company.

The same reseller behind the Ledger drain

The CryptoBilis channel is the same one behind the far larger Ledger incident. Wallets sold by Trezor rival Ledger were drained of more than $86 million last month in an attack that also involved tampered wallets sold by CryptoBilis. Stablecoin issuer Tether froze $10 million of the stolen funds, and Ledger asked multiple wallet vendors across Asia to halt sales. Ledger's investigation found an organized crime group spending millions to build spyware infrastructure covering logistics, seed collector servers, and draining and laundering infrastructure.

The contrast between the two cases is the point. Ledger's devices were drained at scale, while Trezor's three confirmed implants have produced no reported thefts. Both cases ran through the same reseller, and both involved implants hidden between the board and the screen. The shared channel is why Trezor's warning covers every buyer who purchased from CryptoBilis from March 2026 onward, not only the three confirmed Safe 5 owners.

The market context

The disclosure landed on a weak week for crypto markets. Bitcoin ($BTC) traded near $72,300 on November 12, down about 1.8 percent over 24 hours, while Ethereum ($ETH) hovered near $2,045, according to CoinGecko. US spot Bitcoin ($BTC) exchange-traded funds recorded about $299.8 million in outflows on November 11, a fifth straight day of withdrawals, and spot Ethereum ($ETH) funds lost $144.8 million the same day. The Crypto Fear and Greed Index stood at 28, in Fear territory.

What to watch next

The next facts to watch are whether any CryptoBilis buyer reports a loss after the firmware update, whether Trezor names the group behind the implants, and whether other hardware wallet makers follow with their own reseller reviews. The Ledger case showed the same channel could be used to drain tens of millions, so the open question is whether the three confirmed Trezor devices were the full extent of the tampering or only the ones that surfaced. Until Trezor says its review is closed, buyers who purchased from CryptoBilis should treat the move funds instruction as live, not as history.

Sources

• Protos, Trezor cuts reseller network by 80% after finding more spy implants, November 12, 2026 (primary source: direct quotes from Trezor's November 12 update and a Trezor spokesperson, three Safe 5 devices implanted and bought between August 20 and September 23, 2026, reseller network cut by 80 percent with only 20 percent of vendors meeting stricter sourcing, storage and access rules, dropped resellers trustworthy and no immediate threat, firmware update released November 11 rendering implants useless, implant listens to microcontroller to display communication and triggers on a specific sequence, display command order changed with no effect on the screen, CryptoBilis buyers still urged to move funds to a new wallet, no crypto stolen from the affected devices, free replacements offered, Ledger wallets drained of more than $86 million through the same reseller, Tether froze $10 million)
• Crypto Briefing, Trezor finds hardware implants in Safe 5s sold by CryptoBilis, cuts reseller network by 80%, November 12, 2026 (secondary source: 48 devices inspected with only three confirmed tampered, one unit examined in the lab and photographic evidence for the other two, implants are extra boards with cellular modules and antennas between the main board and the screen, no tampering in other models or through other resellers, firmware 2.13.1 shipped November 11, CryptoBilis relationship ended October 9, 2026, investigation began with a responsible disclosure on October 28, 2026)
• KuCoin News, Trezor Releases Firmware Update to Neutralize Hardware Implants from CryptoBilis, November 12, 2026 (secondary source: implant copies display content, identifies and stores mnemonic phrases and passphrases, encrypts and transmits them via mobile networks to attacker controlled servers, affected devices bought through CryptoBilis Tokopedia or Shopee stores or directly, buyers from CryptoBilis since March 2026 may apply for a device replacement, no user reports of fund losses to date)

This article is news reporting and is not investment advice.