Trezor confirmed malicious hardware implants in three Safe 5 wallets bought through CryptoBilis between Aug. 20 and Sept. 23, 2026. It examined one wallet in its lab and identified the other two from owners’ photos. Trezor said the implants could capture seed phrases and passphrases; no customer has reported losing funds.
Trezor said firmware released on Nov. 11, 2026, blocks further collection by the detected implants but cannot protect information intercepted earlier. It has reduced its reseller network by about 80% and is offering replacements to customers who bought Trezor devices through CryptoBilis since March 2026. Customers must keep their devices and contact Trezor support; the remedy may vary by delivery country.
