Trezor removes most resellers after three tampered wallets surface

A smaller vendor list after a supply-chain check

Trezor has removed roughly 80% of its resellers after a review of how devices reach customers. The hardware wallet maker said only about a fifth of its vendors met the stricter requirements it introduced in response to tampered devices sold through the Malaysian seller CryptoBilis.

The new rules cover where devices come from, how they are stored and who can handle them. Trezor said the resellers it dropped had done nothing wrong and did not present an immediate danger.

The company's update came on 12 November 2026, a day after it published firmware version 2.13.1.

What the hidden board did

The investigation covered wallets bought between August and September 2026. Trezor found three compromised Safe 5 devices among 48 customers who got in touch after the company's first warning in October. According to Trezor, none of those customers has reported losing funds.

In each case an extra circuit board sat between the main board and the screen. It recorded what the display showed, including recovery phrases and passphrases, which can be used to reach a wallet's funds. The implant encrypted what it captured and sent it over a mobile network to servers run by the attackers. If no connection was available, it kept the data and sent it once a connection returned.

Firmware change and what customers were told

Trezor says version 2.13.1 blocks the implants it identified from capturing sensitive information. A company spokesperson described the mechanism to Protos: "The implant listens to the communication between the MCU and the display and triggers the capture when it sees a specific sequence."

To defeat that trigger, Trezor said it reordered the commands sent to the screen without changing what the screen shows. The company said this makes the implants useless.

Owners of affected devices were still advised to move their funds to newly generated wallets. Trezor has not said how many devices from the CryptoBilis batch remain in use, or whether the reseller review will be extended to other markets.