Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
Trezor has confirmed that three Trezor Safe 5 hardware wallets purchased from reseller CryptoBilis contained unauthorized implants capable of extracting recovery phrases. The implants, consisting of an extra circuit board positioned between the main board and the display, capture the recovery phrase during backup creation or wallet restoration and transmit the encrypted data over mobile networks. A firmware update version 2.13.1 blocks the known implants on supported devices, but cannot protect phrases already captured. Trezor has advised all customers who bought devices from CryptoBilis since March to move funds to new wallets with fresh recovery phrases and to contact support for replacements. The company has also reduced its reseller network by approximately 80 percent following the incident and similar findings reported by Ledger.
The Hacker NewsNov 13, 2026Translated from English