Trezor found spy implants in 3 Safe 5 wallets. Who should transfer crypto

• Trezor confirmed spying implants in three Safe 5 units purchased from the CryptoBilis store in Southeast Asia.
• The implant copies the data displayed on the screen, including the recovery phrase and secondary password, if they appear on the screen. It sends them via the mobile network.
• 48 customers contacted the manufacturer. As of November 12, he had not received any reports of loss of funds.
• Software 2.13.1 blocks the operation of detected implants. However, it will not protect the phrase that the attacker copied earlier.
• The funds should be transferred by users of all Trezor models purchased on CryptoBilis from March 2026. The new wallet must have a new recovery phrase.

Trezor confirmed that it found hidden screen viewing implants in three Safe 5 hardware wallets. All devices came from the CryptoBilis store. Although manipulation has only been detected in this model so far, the manufacturer recommends transferring the funds also to owners of other Trezors purchased from this seller from March 2026.

The first implant was reported by a customer from Indonesia at the end of October, and the manufacturer tested the device in the laboratory. He recognized two more in photos from the owners. By November 12, 48 customers had contacted Trezor. The manufacturer has not received any reports of loss of funds.

Three devices with a confirmed implant were purchased on CryptoBilis between August 20 and September 23, 2026, either directly or through the seller’s stores on the Tokopedia and Shopee platforms. However, this does not mean that other purchases can be considered safe.

Inspections of devices from other sellers in the region did not reveal tampering. Trezor has no confirmed cases outside of CryptoBilis and did not indicate whether the store’s customers include people from Poland.

If you store crypto in a Trezor purchased from CryptoBilis since March 2026, the manufacturer recommends moving the funds to a new wallet with a new recovery phrase as soon as possible. Reproducing the existing phrase on another device does not solve the problem because the attacker may still know it.

The suspect device should not be configured or further used. You need to save them and contact technical support. Software 2.13.1, released on November 11, blocks data capture by detected implants. However, the update will not take away the phrase that the attacker has already copied, so it does not replace the transfer of funds.

Trezor is still investigating the case. It does not reveal technical details that could help attackers. It promises to update the statement if it confirms implants in other models or devices from other sellers, receives reports of losses or introduces further safeguards.

The manufacturer also reduced the network of authorized resellers by approximately 80%. It stipulates that the removed partners were trustworthy and did not pose a direct threat. However, they did not meet the new, stricter requirements regarding supply, storage and access to devices.