Crypto: Trezor Uncovers Spy Devices in 3 Wallets, Drops 80% of Resellers

Trezor has confirmed the presence of spy devices in three Safe 5 crypto wallets sold by CryptoBilis, a former authorized distributor in Southeast Asia. In its report dated November 12, 2026, the manufacturer announces having reduced its reseller network by about 80%. A security update now blocks the identified implants. None of the three affected owners reported any loss of funds.

Trezor confirms three crypto wallets equipped with spy devices

The investigation on CryptoBilis brings new findings. At the end of October, Trezor reported a first suspicious implant in a Safe 5 wallet, without yet having material confirmation. The manufacturer has now identified three compromised crypto devices. All were purchased between August 20 and September 23, 2026, from CryptoBilis, directly or on the Tokopedia and Shopee platforms.

The first device was examined in Trezor’s laboratories. The other two were identified from photographs provided by their owners. Since the initial alerts, 48 CryptoBilis customers have contacted the manufacturer. Their devices are being verified in the laboratory or from photographs. No similar device has been found on other inspected devices.

The investigations also did not identify any implant on other Trezor models or with other distributors. The assessment remains provisional. The three owners of the compromised devices have reported no loss of cryptos. Nevertheless, Trezor continues its checks and is working with SEAL 911, an intervention service specialized in crypto security incidents.

How spy devices recover secret phrases

Technical analysis now allows understanding the attack’s method. The hackers installed an additional electronic board between the screen and the main board of the Trezor Safe 5 crypto wallet. This component monitors the information displayed without directly altering the operating system or the Secure Element, the chip responsible for protecting cryptographic secrets.

It can notably record recovery words when a user creates or restores their crypto wallet. Passphrases displayed on the screen can also be intercepted. Once collected, this data is encrypted and then transmitted via mobile network to a server controlled by the attackers.

If the connection fails, the implant retains the information and tries to send it later. This method resembles that of spy devices already discovered in Ledger wallets, also distributed by CryptoBilis. A hacker who recovers a recovery phrase can access the assets from another device, without needing the victim’s physical wallet.

Trezor responded by releasing firmware 2.13.1 on November 11. According to the manufacturer, this update prevents identified implants from capturing new information. However, it presents a significant limitation: a previously intercepted recovery phrase remains compromised. Changing only the software is therefore not enough.

Trezor reduces its resellers by 80% and offers replacements

The manufacturer’s response goes beyond the three identified devices. Trezor announces having reduced its network of authorized resellers by about 80% to strengthen the security of its supply chain. The crypto company specifies that the excluded partners were considered reliable and did not pose an immediate threat. However, they did not meet the manufacturer’s new requirements regarding the origin of devices, their storage, and authorized personnel access.

This decision had begun taking shape in October, after the first incidents at CryptoBilis. For the buyers concerned, the recommendations remain unchanged. Anyone who bought a Trezor device from CryptoBilis since March 2026 must transfer their cryptos to a new wallet created with a new recovery phrase.

The recommendation applies to all models purchased from this distributor, even if only three Safe 5 wallets were identified as compromised. Trezor also offers a replacement. Depending on delivery restrictions, customers may receive another model, get a refund of the price difference, or request a full refund.

Requests must be addressed to official support. The manufacturer also warns that fraudsters could exploit the incident to send fake replacement offers. No genuine Trezor advisor will ask a client for their recovery phrase. The distribution network reduction comes after several alerts concerning physical wallets. Cointribune had already reported the first measures taken by Trezor against modified Ledger devices. The investigation now confirms three implants on its own devices. The manufacturer recommends buying directly from its official site to reduce risks of manipulation before delivery.