Malware · 14h ago
Trezor confirmed implants in three Safe 5 wallets sold by CryptoBilis, examining one device and identifying two more from owner photos. Firmware 2.13.1 blocks the implants found so far, and Trezor says it has received no reports of lost funds.
Trezor says the implant is an extra board between the wallet’s main board and screen. It copies the recovery phrase whenever displayed—during setup or while restoring an existing wallet—and sends it over a mobile connection. The phrase can escape without altering the wallet’s firmware or security hardware. An update blocks further capture by known implants, but cannot erase a phrase already copied; that phrase can still restore the wallet elsewhere.
For CryptoBilis buyers since March, an updated device does not settle whether its secret was exposed. Funds remain at risk wherever the old phrase still grants access; the same dependency applies to any hardware-wallet user whose phrase is shown on a compromised device.
2 sources covering this story
Trezor confirms crypto-stealing implants in three wallets, releases fix
Cryptocurrency hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers over cellular networks.
Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
Trezor confirms recovery phrase-stealing implants in three CryptoBilis-sold Safe 5 wallets and says firmware 2.13.1 blocks known implants.
Part of the PlainSec briefing for 2026-11-14