Trezor has confirmed the presence of spy devices in three Safe 5 crypto wallets sold by CryptoBilis, a former authorized distributor in Southeast Asia. In its report dated November 12, 2026, the manufacturer announced that it had reduced its reseller network by approximately 80%. A security update now blocks identified implants. None of the three affected owners reported a loss of funds.
In brief
- Trezor confirms three Safe 5 wallets equipped with spy devices.
- The manufacturer is reducing its authorized dealer network by around 80%.
- Update 2.13.1 neutralizes identified implants, without protecting old compromised recovery phrases.
Trezor confirms three crypto wallets equipped with spy devices
The investigation into CryptoBilis brings new conclusions. At the end of October, Trezor reported a first suspicious implant in a Safe 5 wallet, without yet having material confirmation. The manufacturer has now identified three compromised crypto devices. All were purchased between August 20 and September 23, 2026 from CryptoBilis, directly or on the Tokopedia and Shopee platforms.
The first device was examined in Trezor’s laboratories. The other two were identified from photographs sent by their owners.
Since the first alerts, 48 CryptoBilis customers have contacted the manufacturer. Their devices are verified in the laboratory or based on photographs. No similar devices were found on the other devices inspected.
Investigations have also not identified any implants on other Trezor models or from other distributors. The assessment remains provisional. The three owners of the compromised devices reported no loss of crypto. Trezor is nevertheless continuing its verifications and working with SEAL 911, an intervention service specializing in crypto security incidents.
How spy devices recover passphrases
Technical analysis now makes it possible to understand how the attack works. Hackers installed an additional electronic board between the screen and the main board of the Trezor Safe 5 crypto wallet. This component monitors the information displayed without directly modifying the operating system or the Secure Element, the chip responsible for protecting cryptographic secrets.
In particular, it can save recovery words when a user creates or restores their crypto wallet. Passphrases displayed on the screen can also be intercepted. Once collected, this data is encrypted and then transmitted via mobile network to a server controlled by the attackers.
If the connection fails, the implant retains the information and attempts to send it later. This method resembles that of the spy devices already discovered in Ledger wallets, also distributed by CryptoBilis. A hacker who retrieves a restore phrase can access assets from another device, without needing the victim’s physical wallet.
Trezor responded by releasing firmware 2.13.1 on November 11. According to the manufacturerthis update prevents identified implants from capturing new information. However, it has an important limitation: a previously intercepted recovery phrase remains compromised. Simply changing the software is therefore not enough.
Trezor cuts resellers by 80% and offers replacements
The manufacturer’s response exceeds the three devices identified. Trezor says it has reduced its authorized reseller network by approximately 80% to strengthen the security of its supply chain. The crypto company specifies that the partners removed were considered reliable and did not pose an immediate threat. However, they did not meet the manufacturer’s new requirements regarding the origin of the devices, their storage and who is authorized to access them.
This decision began to be prepared in October, after the first incidents at CryptoBilis. For affected buyers, the recommendations remain unchanged. Anyone who purchased a Trezor device from CryptoBilis since March 2026 must transfer their cryptos to a new wallet, created with a new recovery phrase.
The recommendation concerns all models purchased from this distributor, although only three Safe 5s have been identified as compromised. Trezor also offers a replacement. Depending on delivery restrictions, customers may receive an alternate model, obtain a price difference refund, or request a full refund.
Requests should be directed to official support. The manufacturer also warns that fraudsters could take advantage of the incident to send false replacement offers. No real Trezor advisor will ask for a client’s recovery phrase. The reduction in the distribution network comes after several alerts regarding physical wallets. Tremplin.io previously reported on the first steps taken by Trezor in the face of modified Ledger devices. The investigation now confirms three implants on its own devices. The manufacturer recommends purchasing directly from its official website to reduce the risk of handling before delivery.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
