Trezor Confirms Spyware Implants in 3 Safe 5 Wallets, Cuts Distributor Network by 80%
Key Facts
Trezor said spyware implants were found in 3 Safe 5 devices purchased through distributor CryptoBilis, in an investigation update published by Protos on November 12, 2026. The finding expands on the report the company disclosed in late October, after it began examining buyers’ devices following CryptoBilis’ removal from its distributor network on October 9. The owners of the three devices bought their units between August 20 and September 23, 2026. In coverage published on November 13, The Crypto Times said 48 customers had contacted the company after it invited CryptoBilis buyers to reach out to support. The owners of the three devices had reported no loss of funds as of that update.
The case began with a responsible disclosure Trezor received on October 28, 2026, about one implant in a Safe 5 device. The company issued a warning on October 30 before taking possession of the device for examination. At the time, it said the customer’s description was sufficient to treat the report as credible, while acknowledging it had not independently verified the described spying mechanism. The company said the reported implant included an additional board between the main board and the screen, along with a cellular communications module and antenna. The warning came after Ledger began investigating losses suffered by customers who bought wallets from the same seller on October 9. In its initial warning, Trezor urged anyone who had bought through CryptoBilis since March 2026 to move their funds to a new wallet with a new seed phrase.
The subsequent investigation described the implant as an additional circuit board placed between the main board and the Safe 5 screen, designed to copy information displayed on the screen without changing the device’s software or interfering with its secure element. A Trezor spokesperson said the implant monitors communication between the microcontroller and the screen and begins capturing data when it detects a specific sequence. According to the investigation’s description, it could capture the recovery phrase and passphrase when they appeared on the screen, then encrypt the data and send it over the mobile network to a server controlled by the attackers. The spokesperson said the company changed the order of screen commands to disable this trigger while leaving what users see unchanged. The mechanism focuses on information displayed on the screen; the coverage did not say the devices’ keys themselves had been read.
Trezor’s website lists firmware version 2.13.1 for Safe 5 devices on November 11, 2026. The coverage said the update prevents the identified implants from capturing information on devices running the new firmware, after the company changed the order of commands sent to the screen. Trezor says the measure disables recording that relies on the specific sequence, but does not make a recovery phrase that may have been captured before the update safe again. The company therefore advised CryptoBilis buyers to move their funds to a new wallet created with a new recovery phrase. It also warned that restoring the old phrase on another device does not address the problem, because the risk is that the phrase itself may have been exposed.
Alongside its technical investigation, Protos reported that Trezor cut its distributor network by 80% and tightened supply chain security rules. The new rules cover the sourcing and storage of devices and the people who can access them, according to the company. It said the distributors removed from the network were trusted and did not pose an immediate threat, adding that the network reduction was tied to preventive measures to protect supply. Trezor had said in its initial warning that it had received no reports of stolen funds from CryptoBilis buyers and had no evidence that any customer had suffered a loss. It also offered eligible buyers who purchased since March 2026 the option to request a new device sent directly to them or a voucher covering its cost, while keeping the device and contacting support to arrange it.