Trezor said three Trezor Safe 5 wallets sold by the reseller CryptoBilis hold hidden spy hardware. They were bought between 20 August and 23 September 2026, through CryptoBilis's Tokopedia and Shopee shops or from CryptoBilis itself. The implant is an extra circuit board between the main board and the screen. It copies the screen, keeps recovery words and any passphrase, and sends them, encrypted, to the attackers' server over the mobile network. Trezor said firmware 2.13.1, released 11 November, stops these implants from capturing anything.
Trezor said no customer has reported losing funds. It checked one device in its lab and two from owners' photos, and found no implants in other resellers' devices or other models. It is still investigating. Words copied before the update are beyond its reach, so Trezor still tells CryptoBilis buyers to move funds to a new wallet with a new seed.
The implant never touches the firmware or the Secure Element, the wallet's security chip. It watches the screen, where recovery words show in plain view, so a sound chip does not help. A patch blocks future capture but cannot recall words already sent. Buyers should ask where devices come from, who handles them in transit, and who checks them on arrival.