Trezor confirms spy chips in three Safe 5 wallets sold by CryptoBilis

What Trezor found

Trezor said on 12 November that three of its Safe 5 hardware wallets contained a malicious circuit. The devices had been bought from CryptoBilis, a reseller that operated in Southeast Asia.

The chip sat inside the casing, between the main circuit board and the screen, according to bitcoin.fr. In that position it could copy what appeared on the display, including the recovery phrase, the seed words a owner uses to restore a wallet.

Trezor examined 48 devices that customers had sent in after an initial report in late October, Journal du Coin reported. The company checked the first unit in its laboratory and identified the other two from photographs their owners provided.

Dates and the software fix

The three affected wallets were bought between 20 August and 23 September 2026, according to Journal du Coin. Trezor said a software update, version 2.13.1, blocks the identified implants from capturing data.

As of the company's review, no customer had reported a loss of funds, Journal du Coin wrote. Trezor has not said whether the update would stop a different implant design.

Resellers cut and replacements offered

Trezor said it has reduced its reseller network by about 80 percent. Customers who bought a Trezor from CryptoBilis since March 2026 can request a replacement, the company said.

The case follows a similar disclosure at Ledger, the other large hardware-wallet maker, bitcoin.fr noted. Neither report says whether the two cases are connected.