Trezor confirms Safe 5 hardware wallets sold by reseller CryptoBilis were fitted with recovery-phrase-stealing boards

Trezor says three Trezor Safe 5s bought from CryptoBilis contain the implant, all bought between Aug 20 and Sep 23, 2026 via CryptoBilis’s Tokopedia and Shopee stores or directly, and devices from other resellers or other models showed no tampering ^[1]. BleepingComputer says the malicious hardware implants are designed to steal wallet recovery phrases and send them to attackers over cellular networks; Trezor says the implant is an extra board between the main board and screen that captures recovery words and passphrases shown on screen and sends them encrypted to an attacker-controlled server ^[1][2]. What to do now: Trezor says firmware 2.13.1, released Nov 11, stops the implants found from capturing anything, but CryptoBilis buyers should still move funds to a new wallet with a new seed and can contact Trezor Support for a replacement device ^[1].

Industries mainly affected: Finance

1. Update your Trezor to firmware 2.13.1 ^[1].