Trezor said on Nov. 12 that three Safe 5 hardware wallets bought from former reseller CryptoBilis contained unauthorized implants that could capture recovery words and displayed passphrases. All three were bought between Aug. 20 and Sept. 23. Trezor said it had received no reports of customer funds lost to the implants; its confirmed findings were limited to Safe 5 devices from CryptoBilis.
Trezor said firmware version 2.13.1, released Nov. 11, blocks the identified implants from capturing information, but cannot protect recovery phrases captured before installation. It advised CryptoBilis buyers to move funds to newly created wallets rather than reuse an exposed recovery phrase. Replacement eligibility covers every model bought from CryptoBilis from March onward, though shipping restrictions may require a different model, delivery to another country or a refund.
