Trezor confirms crypto-stealing implants in three wallets, releases fix

Trezor has confirmed that three of its Safe 5 cryptocurrency wallets, sold by Southeast Asian reseller CryptoBilis, contained malicious hardware implants capable of stealing wallet recovery phrases. This discovery led to the release of a new firmware update designed to neutralize the threat. The implants were first suspected in October when a customer reported an unauthorized circuit board inside a wallet bought from CryptoBilis. Trezor's examination of the device has now confirmed the implant's capabilities, with two more compromised wallets identified through customer-submitted photographs.

The compromised wallets were purchased from CryptoBilis between August 20 and September 23, 2026. Trezor's engineers have analyzed the implant's firmware, confirming it can capture sensitive information displayed on the wallet's screen. The implant, an additional circuit board, is situated between the wallet's main board and display, enabling it to monitor screen activity without altering the device's legitimate firmware or Secure Element. It can capture recovery phrases and passphrases displayed on the screen, encrypt the data, and transmit it over a mobile network to an attacker-controlled server.

Trezor has released firmware version 2.13.1, which includes protections to prevent these implants from capturing information on devices that install it. However, the update cannot protect any recovery phrases that might have been captured before the firmware was installed. Despite no reports of stolen funds from affected customers, Trezor advises those who purchased devices from CryptoBilis to transfer their cryptocurrency to a new wallet with a fresh recovery phrase.

The company has taken steps to mitigate future risks by reducing its global reseller network by approximately 80%, focusing on partners that meet stricter supply-chain security requirements. This decision follows reports of similar implants found in Ledger devices sold by the same reseller, which were linked to cryptocurrency thefts. Trezor is offering replacement devices to anyone who purchased a wallet from CryptoBilis since March 2026, regardless of whether their device has been confirmed compromised.

Trezor continues to investigate the situation and has found no evidence of implants in devices sold by other resellers. The company is also inspecting devices from other resellers in the region and has not found any signs of tampering. The company plans to provide updates if any new threats are discovered or if there are reports of funds being stolen through the compromised wallets.