Trezor Updates Investigation Into Safe 5 Hardware Implant Incident: 3 Devices Tampered With, No User Fund Losses

November 12: Hardware wallet maker Trezor has updated the findings of its investigation into the Trezor Safe 5 hardware implant incident. It has confirmed that the implant was limited to Safe 5 devices purchased through reseller CryptoBilis between August and September 2026, with 3 affected devices identified, none of which caused user fund losses. No implants were found in devices from other resellers or in other Trezor models.

Trezor released firmware version 2.13.1 on November 11, which blocks the discovered implant from capturing screen content (including seed phrases and keys), rendering the current batch of implants ineffective. In addition, the company has cut about 80% of its reseller network and imposed stricter supply chain controls on remaining partners. Trezor advises CryptoBilis buyers (those who purchased from March 2026 onward) to move their funds to a new wallet (using a new seed phrase), and to contact Trezor support to apply for a free device replacement. The investigation is still ongoing.