Trezor confirmed on November 12, 2026, that three Safe 5 hardware wallets sold through former reseller CryptoBilis contained malicious hardware implants capable of capturing recovery phrases. In response, the company cut its authorized reseller network by roughly 80% and released firmware version 2.13.1 on November 11 to block the identified implants from capturing sensitive information on updated devices.
The affected wallets were purchased between August 20 and September 23, 2026, either directly from CryptoBilis or through its Tokopedia and Shopee stores. Trezor examined one device in its laboratory and identified the other two from customer-submitted photographs. Among 48 CryptoBilis buyers who contacted the company after its October warning, only these three cases were confirmed. No customers have reported losing funds, and no implants have been found in other Trezor models or devices from remaining resellers.
The Drivers of the Current Situation
The main issue is a limited supply-chain compromise confined to three Safe 5 devices sold by a single Southeast Asian reseller. The implants were designed to record recovery phrases displayed on the screen, encrypt the data, and transmit it over a mobile network when a connection was available. Trezor’s investigation found no evidence of wider tampering.
Related factors shaped the response. The company had issued an earlier warning in October and invited CryptoBilis customers to come forward. Firmware 2.13.1 stops the known implants from capturing new data, but any recovery phrase displayed before the update remains potentially exposed, requiring affected users to move funds to newly generated wallets with new seeds. Trezor described the removed resellers as trustworthy and said the reduction was a precautionary step to enforce stricter sourcing, storage, and handling rules across the remaining network. Only the confirmation of three implants, the absence of reported fund losses, the firmware release, the 80% reseller cut, and the lack of findings in other channels are verified. Broader supply-chain concerns in the hardware-wallet sector contributed to the decisive network reduction.
Continued monitoring requires observation of any additional confirmed cases, the effectiveness of the new reseller standards, and whether affected customers complete the recommended fund migration. Limited public detail on the exact implant design beyond the capture-and-transmit behavior forms a narrower path for assessing residual risk. Trezor, its remaining partners, and hardware-wallet users remain the primary parties tracking residual effects. The situation is a contained supply-chain incident that prompted a major contraction of the distribution network and a targeted firmware mitigation.
Impact and Broader Context
Questions about hardware-wallet supply-chain integrity keep growing. The discovery creates uncertainty about the residual risk for any CryptoBilis buyers who have not yet migrated funds and about the practical reach of the new stricter reseller requirements. It also elevates attention on the difference between firmware protections that stop future capture and the irreversible exposure of any previously displayed seed. Self-custody advocates, competing wallet makers, and security researchers continue to assess the implications.
The issue drives debate on third-party distribution risks for hardware wallets. It raises questions about the durability of trusted-reseller models, the limits of post-manufacture detection, risks of similar implants appearing through other channels, effects on near-term confidence in physical device purchases, and competition among manufacturers on supply-chain controls. Coverage notes that Trezor acted to shrink the attack surface while emphasizing that the compromise remained limited to one former partner and produced no confirmed losses.
The November 12 investigation update forced renewed focus on Trezor’s distribution practices. The current findings show how further customer reports, reseller compliance audits, or comparable incidents at other brands will determine the lasting effect.
New confirmed cases, updated firmware guidance, or changes in authorized reseller lists will clarify the practical contribution of the 80% network reduction.
This analysis uses Trezor’s official investigation update and contemporaneous reporting. The ultimate effectiveness of the mitigations and the absence of further compromises remain subject to ongoing checks and user actions.