Trezor Cuts Reseller Network 80% After 3 Wallet Implants

Hardware wallet manufacturer Trezor has cut its global reseller network by approximately 80% and released an emergency firmware update after discovering physical hardware implants in three Safe 5 wallets purchased from former reseller CryptoBilis, according to CryptoNews.

All three affected devices were acquired between Aug. 20 and Sept. 23, 2026, through CryptoBilis stores on Tokopedia and Shopee or directly from the reseller. Trezor removed CryptoBilis as an authorized partner on Oct. 9 after separate reports involving tampered Ledger wallets sold through the same business.

Firmware Patch and Seed Exposure

Trezor released firmware version 2.13.1 on Nov. 11, which changes the order of commands sent to the screen to block the identified listening devices. The hardware implant consists of an extra circuit board placed between the device's main board and display, recording recovery words and passphrases displayed during setup and transmitting encrypted data over a mobile network to an attacker-controlled server.

Despite the firmware update, Trezor warned that customers who purchased devices from CryptoBilis must still move their cryptocurrency to a newly created wallet with a new seed phrase, as recovery words captured before installing the protection may already be compromised. The company stated that no customers have reported losing funds and no implants have been confirmed outside of CryptoBilis.

Stricter Reseller Requirements

Trezor stated that the removed resellers were trustworthy and posed no immediate threat, but failed to meet newly introduced, stricter handling requirements regarding how devices are sourced, stored, and accessed across remaining partners.

Out of 48 CryptoBilis buyers who contacted Trezor following an October appeal, laboratory examinations and photo checks confirmed tampering on only three devices. The company confirmed that every other examined wallet showed no evidence of tampering and no implants were found in other Trezor models.

Key facts

• Trezor cut its reseller network by roughly 80% due to new handling standards.
• Three Safe 5 wallets bought from CryptoBilis between Aug. 20 and Sept. 23, 2026, contained hardware implants.
• Firmware version 2.13.1 blocks the identified listening implants but cannot protect recovery phrases already exposed.
• Trezor removed CryptoBilis as an authorized reseller on Oct. 9.
• Customers who bought devices from CryptoBilis from March 2026 onward are eligible for replacements.