Trezor Cuts Reseller Network After Wallet Implants Found

Trezor reduced its reseller network by about 80% after discovering hardware implants in three Safe 5 wallets sold through CryptoBilis. The company released firmware version 2.13.1 on Nov. 11 to prevent the identified implants from capturing sensitive wallet information.

The investigation covered devices purchased between August and September 2026. Trezor found the three compromised wallets among 48 customers who contacted the company after its initial warning in October. None of the customers has reported losing funds.

An extra circuit board was hidden between each wallet’s main board and screen. The board recorded information displayed on the device, including recovery phrases and passphrases. Those details can be used to access cryptocurrency wallets.

The implant encrypted the recorded information and sent it to servers controlled by attackers through a mobile network. When no connection was available, it stored the data and transmitted it after reconnecting.

Trezor said firmware version 2.13.1 blocks the identified implants from capturing sensitive wallet information. Customers with affected devices must still transfer their funds to newly generated wallets using new recovery phrases.

The company also imposed stricter requirements on resellers covering how devices are sourced, stored and handled. Trezor reported no evidence of tampering in devices sold through other resellers or in its other hardware wallet models.

Reviewed and fact-checked by Alex Panasenko on November 13.