A hardware implant first reported in October in a Trezor Safe 5 sold by reseller CryptoBilis has now been traced to more devices, per Trezor's update on the CryptoBilis investigation. Of 48 buyers who came forward, three had wallets with the implant, all bought between 20 August and 23 September 2026 via CryptoBilis's Tokopedia and Shopee stores or directly.

The implant is an extra circuit board fitted between the main board and the screen. It copies everything displayed, recognizes recovery words and passphrases, encrypts them and sends them over the mobile network to an attacker-controlled server, retrying until it connects. It never touches the firmware or the Secure Element.

Firmware 2.13.1, released on 11 November, stops the known implants from capturing anything, and Trezor cut its reseller network by about 80% under stricter supply-chain rules.

No customer has reported losing funds, and no implants were found in other resellers' devices or other Trezor models. CryptoBilis buyers are still told to move funds to a new wallet with a new seed, since the update cannot protect a backup captured earlier. Anyone who bought from CryptoBilis since March 2026 can get a replacement device.