Trezor cuts resellers by 80% after Safe 5 implants

Trezor says hidden boards inside three Safe 5 wallets sold through CryptoBilis could copy recovery words. It has cut its authorised reseller network by about 80% and shipped firmware 2.13.1 to block them.

Why it matters: Anyone who bought a hardware wallet through a reseller, not the maker, now has a concrete reason to check where it came from and how it was handled.

In short

The wallet maker found hidden cellular implants in three Safe 5 wallets sold through CryptoBilis between 20 August and 23 September 2026.
It cut its official reseller network by about 80% and shipped firmware 2.13.1 on 11 November 2026 to block the implants.
Forty-eight customers had contacted the wallet maker by 12 November; it says no customer funds have been reported lost.
CryptoBilis buyers are told to move funds to a new wallet with a fresh seed phrase, not just replace the device.

Trezor has cut its official reseller network by about 80% after finding unauthorised hardware implants in three Safe 5 wallets sold through CryptoBilis, its former official distributor in Southeast Asia, the company said on 12 November 2026. The implants were extra circuit boards with cellular modules and antennas, hidden between the device's main board and its screen, according to Crypto Briefing. It says no customer has reported losing funds.

Trezor makes hardware wallets, small physical devices that store the private keys to crypto and keep them offline. CryptoBilis sold Trezor devices in Southeast Asia, directly and through its Tokopedia and Shopee stores, until Trezor ended the partnership on 9 October 2026, according to Crypto Briefing.

What Trezor found inside the Safe 5

The three tampered Safe 5 wallets were bought between 20 August and 23 September 2026, Bitcoin.com reported. The wallet maker examined the first reported device in its lab and identified the other two from owners' photographs, according to Bitcoin.com. The hidden board copies recovery words, the 12 or 24 words that restore a wallet, as they are shown on screen during setup, plus any passphrases typed in, and sends them over a mobile network to a server run by the attackers, according to the company's analysis as reported by Bitcoin.com.

At the time of writing (07:21 UTC on 13 November 2026), Bitcoin (BTC) traded at $69,044, down 6.01% in 24 hours, with a market value of $1.39tn, according to InvestIn.News market data.

Why Trezor cut its reseller network

The wallet maker released firmware 2.13.1 on 11 November 2026, a day before it went public with the findings. According to Bitcoin.com, the update stops the implants it has identified from capturing more data, but phrases copied before installation remain exposed. Anyone who bought from CryptoBilis is told to set up a new wallet with a fresh seed phrase and move funds there, since swapping the device while keeping the old phrase would leave the leak in place.

Forty-eight customers had contacted the wallet maker about their devices by 12 November, and it is checking them in its lab or through photographs the owners send in, according to Bitcoin.com. The company says its wider checks found no tampering in other models or through other resellers, pointing to a problem confined to one sales channel rather than its own manufacturing line, Crypto Briefing reported.

InvestIn.News counted 33 days between the wallet maker ending its CryptoBilis partnership on 9 October 2026 and shipping firmware 2.13.1 on 11 November 2026; the three tampered devices were sold across a 34-day window, between 20 August and 23 September.

THE BLOCK: Trezor says it found seed-stealing implants in three Safe 5 wallets sold by CryptoBilis and subsequently cut its reseller network by about 80%.

No losses among Trezor users were reported. pic.twitter.com/rGR4DAlwxI

The Block @TheBlockCo · 12 Nov 2026 · View on X

Why don't people simply order their devices from the official Trezor store? Is it really that difficult to do so?

Farrukh @farrukhm2010 · 12 Nov 2026 · View on X

seed stealing implants in wallets from a reseller is scary bro… how are normal people even supposed to verify a hardware wallet is clean?

Mari @Maribtxn · 12 Nov 2026 · View on X

Key numbers

What	Figure
Trezor reseller network cut	about 80%
Tampered Safe 5 wallets found	3
Customers who contacted Trezor	48
Firmware that blocks the implants	version 2.13.1, released 11 November 2026
CryptoBilis purchase window for replacements	from March 2026 onward

Timeline

20 Aug 2026: First tampered Safe 5 sold through CryptoBilis
23 Sep 2026: Last of the three tampered Safe 5 wallets sold
9 Oct 2026: The wallet maker ends its partnership with CryptoBilis
13 Oct 2026: The wallet maker tells resellers their authorisation ends on 1 January 2027
28 Oct 2026: Responsible disclosure flags a possibly tampered Safe 5
11 Nov 2026: Firmware 2.13.1 is released to block the implants

Questions readers ask

Are Trezor wallets still safe to use?

The company says its checks found no tampering in other models or through other resellers, and that the problem was confined to Safe 5 wallets sold through CryptoBilis. It shipped firmware 2.13.1 on 11 November 2026 to block the identified implants. Anyone who bought from CryptoBilis is still told to move funds to a new wallet with a fresh seed phrase.

What should I do if I bought my Trezor from CryptoBilis?

The wallet maker advises anyone who bought a device from CryptoBilis to update to firmware 2.13.1 and then move funds to a newly created wallet with a new seed phrase, because the update cannot undo recovery words copied earlier. Replacements cover every model bought from CryptoBilis from March 2026 onward, arranged through official support.

Why did the company cut its reseller network by 80%?

It cut its official reseller network by about 80% after finding hidden implants in three Safe 5 wallets sold through CryptoBilis. The company says the removed partners are trustworthy and pose no immediate threat, and that remaining sellers must meet stricter rules on how devices are sourced, stored and handled.

Did any Trezor customers lose funds?

The company says no customer has reported losing funds to the implants. The hidden boards were built to copy recovery words and passphrases and send them over a mobile network. By 12 November 2026, 48 customers had contacted the wallet maker, and their devices are being checked in its lab or through photographs.

Our view

At InvestIn.News, we think the wallet maker was right to shrink its reseller network by about 80%. A hardware wallet is only as safe as the route it takes to its owner, and three Safe 5 devices sold through CryptoBilis carried hidden boards built to copy recovery words. That is not a risk a maker can leave to a partner's paperwork.

The timing matters. The company ended its CryptoBilis partnership on 9 October 2026, weeks before the responsible disclosure of 28 October, and shipped firmware 2.13.1 on 11 November, a day before going public. It says the removed partners are trustworthy and pose no immediate threat, and that no customer funds have been reported lost. Those points deserve weight.

But the fix has a limit. Firmware cannot recall recovery words copied before it was installed, which is why CryptoBilis buyers are told to move funds to a new wallet with a fresh seed phrase. The test of this decision is whether the remaining sellers really meet the stricter rules on sourcing, storage and handling that Trezor has promised.

How we reported this: this story draws on reporting by Crypto Briefing, Bitcoin.com and KuCoin, 3 public posts shown in the story and InvestIn.News market data. Each source is linked in the text and listed under Sources.

Follow the latest news as it breaks on NewsFeeds.

Keshav Aggarwal

What to watch: Authorisation for the resellers being dropped ends on 1 January 2027, and CryptoBilis buyers can arrange replacements through official support.