Trezor confirms three CryptoBilis hardware implants

Trezor's November 12, 2026 update confirms three implanted Safe 5 devices, one examined in its lab and two identified from photos. 48 counts customer contacts, not confirmed compromises. The devices came from CryptoBilis between August 20 and September 23, via direct sales, Tokopedia and Shopee. Trezor reports no confirmed cases elsewhere or in other models, and no reported customer losses.

What Trezor found

Trezor says the implant captures screen data, including recovery words and displayed passphrases, for cellular transmission without modifying firmware or the Secure Element.

What the firmware update changes

Trezor says firmware 2.13.1, released November 11, blocks capture by the identified implants. Its roughly 80% reseller reduction reflects stricter requirements, not findings against every removed partner.

The findings extend the CryptoBilis hardware-tampering story beyond the earlier Ledger reports. Our Ledger investigation timeline covers those separate findings. Neither manufacturer's report establishes that every hardware wallet or reseller was affected.

Why firmware cannot make an exposed recovery phrase safe

A recovery phrase lets a compatible wallet reconstruct the keys controlling funds. Updating the original device changes its software. It does not change those keys or erase a copy held by someone else. An attacker with enough recovery information can act from another wallet without using your updated device.

Changing the PIN or restoring the same phrase on a replacement device also leaves the underlying wallet unchanged. Even a new receiving address within that wallet is derived from the same secret. The remedy is to generate a separate wallet with a fresh seed on trusted equipment, then transfer funds to it. Trezor's compromised-backup guide calls for prompt transfers and retirement of the old backup after all funds have moved.

The screen capture also means owners cannot assume a displayed passphrase remained secret.

Current guidance for Trezor CryptoBilis buyers

Trezor's customer notice applies to every Trezor model bought from CryptoBilis from March 2026 onwards. That precautionary scope is broader than the confirmed Safe 5 cases.

• Already storing funds: move them promptly to a newly created wallet with a fresh seed. Check the complete destination address. If no secure hardware wallet is available, Trezor's notice allows temporary use of a software wallet or familiar exchange. Choose a destination that supports each asset and network.
• Not yet set up: leave the device unused. Do not enter an existing recovery phrase on it.
• Keep the device and contact Trezor Support: do not use weighing or a home inspection to rule out tampering. Never send recovery words to support or anyone offering a replacement.

The November update retains replacement eligibility from March 2026. Shipping restrictions may require alternatives or refunds. Contact support if provenance is unclear.