---
title: Trezor confirms cellular implants in three Safe 5 wallets sold by CryptoBilis, ships firmware that blinds them, and cuts 80% of its resellers | ctxsec
url: https://ctxsec.com/items/trezor-confirms-three-safe-5-implants-cryptobilis-firmware-2-13-1-blocks-capture-resellers-cut-80
description: "Trezor says three Trezor Safe 5 devices bought from CryptoBilis between Aug 20 and Sep 23, 2026 (via its Tokopedia and Shopee stores and directly) contain an implant: an extra board between the main board and the screen with a cellular module that copies everything shown or typed on the screen, recognizes recovery words and passphrases, encrypts them and sends them to an attacker server, retrying until it connects. It never changes the firmware or Secure Element. Of 48 CryptoBilis buyers' devices checked so far, only those three were tampered with; none of the owners lost funds, and none were found in other resellers' devices or other models. Firmware 2.13.1 (Nov 11) stops the known implants capturing anything."
status: "official (Trezor investigation update, Nov 12, 2026; firmware 2.13.1 released Nov 11); investigation ongoing"
published: 2026-11-12
---

> Trezor says three Trezor Safe 5 devices bought from CryptoBilis between Aug 20 and Sep 23, 2026 (via its Tokopedia and Shopee stores and directly) contain an implant: an extra board between the main board and the screen with a cellular module that copies everything shown or typed on the screen, recognizes recovery words and passphrases, encrypts them and sends them to an attacker server, retrying until it connects. It never changes the firmware or Secure Element. Of 48 CryptoBilis buyers' devices checked so far, only those three were tampered with; none of the owners lost funds, and none were found in other resellers' devices or other models. Firmware 2.13.1 (Nov 11) stops the known implants capturing anything.

[← Cybersecurity News](/news) · [markdown](/items/trezor-confirms-three-safe-5-implants-cryptobilis-firmware-2-13-1-blocks-capture-resellers-cut-80.md)

official (Trezor investigation update, Nov 12, 2026; firmware 2.13.1 released Nov 11); investigation ongoing

2026-11-12 11:37 AM ET

### Trezor confirms cellular implants in three Safe 5 wallets sold by CryptoBilis, ships firmware that blinds them, and cuts 80% of its resellers

- **CryptoBilis buyers (since March 2026):** still move funds to a new wallet with a new seed; the firmware can't protect a backup captured before the update. Trezor offers a free replacement.
- **Everyone:** buy hardware wallets direct from the vendor; beware scammers posing as Trezor offering replacements or refunds.
- Trezor says the implant works the same way as those found in Ledger devices from the same reseller, adapted to the Safe 5 display.

Sources: [Trezor: Our CryptoBilis investigation: what we found and what we've changed (Nov 12, 2026)](https://trezor.io/blog/news/our-cryptobilis-investigation-what-we-found-and-what-weve-changed) · [Trezor firmware changelog (Safe 5 2.13.1, Nov 11, 2026)](https://trezor.io/other/product-updates/trezor-firmware-changelog-all-versions-and-release-dates)