Trezor Says Three Wallets Sold by One Reseller Hid a Board That Copies the Screen
Trezor said three of its Safe 5 hardware wallets, devices that hold the keys to an owner's cryptocurrency, were sold by the reseller CryptoBilis with a hidden circuit board that copies everything shown on their screens. The company added that a firmware update released Nov. 11, 2026, stops the implants it has found from capturing anything on devices that install it.
Trezor's embedded team analyzed the implant's software from the device reported in October. According to that analysis, the implant sits between the wallet’s main board and its screen. It copies everything displayed, including what the owner types, but does not change anything on the device itself. When the recovery words that restore a wallet appear on screen, the board stores them and sends them, encrypted, over the mobile network to a server the attackers run.
In its investigation post, Trezor said that 48 customers who bought from CryptoBilis have come forward since the October report, and that it is checking their devices. Three carry the implant, including the one reported in October; the lab examined that device and identified the other two from photographs. All three were bought between Aug. 20 and Sept. 23, 2026, through CryptoBilis's Tokopedia and Shopee stores and directly from the reseller. By the company's account, no customer has reported losing funds.
Version 2.13.1 cannot protect a wallet whose backup was captured before it arrived, so Trezor's advice to CryptoBilis buyers is unchanged: move the funds to a new wallet with a new recovery phrase. It says anyone who bought from that reseller since March 2026 is eligible for a replacement device, and asks them to keep the old one.
Trezor has also cut its reseller network by about 80%. It says the partners it dropped were trustworthy but did not fit the stricter new rules, which cover how devices are sourced and stored and who can access them. So far, its investigation has found the implant only in Safe 5 units sold by CryptoBilis, with none in devices from other resellers in the region or in other Trezor models. No independent examination of the devices has been published, and the company says it is still investigating.
