WuBlockchain
Trezor confirmed that 3 Trezor Safe 5 wallets inspected from 48 affected users contained malicious circuit boards. The compromised devices were sold through CryptoBilis and its Tokopedia and Shopee stores between Aug 20 and Sep 23, 2026.
Why it matters
The implants were concealed between the motherboard and display, allowing them to capture recovery seeds and passphrases shown on the screen and transmit the data to attackers over cellular networks. This creates a hardware-level threat that can bypass the security expected from a trusted wallet. Trezor has not reported any stolen user funds.
Market impact
Trezor released firmware version 2.13.1 on Nov 11 to block data capture by the identified implants. The company also reduced its reseller network by approximately 80%, tightened procurement and warehousing controls, and offered free replacements or refunds to customers who bought devices from CryptoBilis since March 2026.
Frequently asked questions
-
How many Trezor Safe 5 wallets were confirmed to contain malicious boards?
Trezor confirmed that 3 of the 48 devices inspected after affected users contacted the company contained malicious circuit boards.
-
Where were the compromised Trezor Safe 5 wallets sold?
They were sold through CryptoBilis and its Tokopedia and Shopee stores between Aug 20 and Sep 23, 2026.
-
What could the malicious circuit boards capture?
The implants could capture recovery seeds and passphrases shown on the screen and transmit them to attackers over cellular networks.
-
Have any user funds been stolen from the compromised wallets?
Trezor has not reported any stolen user funds as part of the investigation.
-
What protection is available for affected Safe 5 customers?
Firmware version 2.13.1 blocks data capture by the identified implants. Customers who purchased from CryptoBilis since March 2026 are eligible for a free replacement or refund.
CoinTelegraph
WatcherGuru
TheBlock
CryptoSlate
CoinDesk