Trezor confirms crypto-stealing implants in three wallets, releases fix

Cryptocurrency hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers over cellular networks.

The findings follow an investigation into a suspected hardware implant first reported in October, when a customer discovered an unauthorized circuit board inside a Trezor Safe 5 purchased from Indonesian reseller CryptoBilis.

At the time, Trezor had not received the device for examination and could not confirm the implant's capabilities.

In a new investigation update, the company says it has now examined the original device in its laboratory and identified two additional compromised wallets using photographs submitted by their owners.

All three compromised devices were purchased from CryptoBilis between August 20 and September 23, 2026.

Trezor says 48 CryptoBilis customers have contacted the company following its October warning, with devices being examined in its laboratory or through photographs of their internal components.

The company has also inspected devices from other resellers in the region and found no evidence of tampering.