Trezor finds malicious circuit boards in three Safe 5 wallets
The devices were sold between Aug 20 and Sep 23 2026 via reseller CryptoBilis and the implants could capture recovery seeds before the Nov 11 firmware patch.
Key takeaways
- 1Three Trezor Safe 5 wallets were found with malicious circuit boards
- 2Devices sold between Aug 20 and Sep 23 2026 via CryptoBilis on Tokopedia and Shopee
- 3Firmware v2.13.1 released on Nov 11 blocks the implants' data capture
- 4Trezor reduced its reseller network by about 80 percent
- 5Customers who bought since Mar 2026 eligible for free replacement or refund
Trezor said three Safe 5 wallets sold through CryptoBilis between Aug 20 and Sep 23 2026 contained hidden malicious circuit boards. The devices were listed on Tokopedia and Shopee stores owned by the reseller.
The implants sit between the motherboard and the display. They record recovery seeds and passphrases shown on the screen and relay the data to attackers' servers over cellular networks. The circuitry was designed to be invisible to casual inspection.
Trezor reported no user funds have been stolen to date. The company released firmware version 2.13.1 on Nov 11 that disables the data capture function of the implants. Users should install the update immediately.
In response, Trezor cut its reseller network by roughly 80 percent and tightened procurement and warehousing controls. The move limits exposure to unauthorised components in future shipments.
Customers who bought Safe 5 devices from CryptoBilis since March 2026 can claim a free replacement or a full refund. Claims are processed through Trezor's support portal and require proof of purchase.
The incident shows how supply chain tampering poses a direct risk to hardware wallet users. Traders and custodians will watch for further disclosures as the company audits its remaining inventory.
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.