48 people contacted; seed-stealing boards confirmed in 3 hardware wallets
Trezor published its investigation results last night. The lab has dismantled one reported Safe 5, and internal photos submitted by users confirmed two more cases, bringing the total to three hardware wallets containing circuit boards designed to steal recovery phrases. All three were purchased from Southeast Asian reseller CryptoBilis between August 20 and September 23, 2026.
After the report in October, Trezor asked anyone who had bought a device from this reseller to get in touch. So far, 48 people have responded. Their devices are either at the lab or being checked using internal photos. Trezor also examined devices from other resellers in the same region, but found no tampering and no other affected models. The owners of all three devices said their funds were still safe.
On November 11, Trezor released firmware version 2.13.1. The company says that once installed, the implanted boards can no longer steal information displayed on the screen. But if a recovery phrase has already been sent out, this update can't undo that. Anyone who bought from this reseller should still move their coins to a new wallet created with a new recovery phrase. Anyone who bought any model from this reseller since March 2026 can contact Trezor for a replacement. The reseller network has also been cut by around 80%.
The board is sandwiched between the mainboard and the screen. It only steals information; it doesn't alter anything. When recovery words or a passphrase appear on the screen, the board records them, encrypts them, and sends them over a mobile network to the attacker’s server. If it can't connect, it stores the data and keeps retrying.
My take: the vulnerability still lies in the supply chain. Trezor has been clear about the numbers and the patch, but anyone who bought from this reseller shouldn't assume that a firmware update is enough.
Beginners: observe more, do less. If you're buying crypto, stick to $BTC
Trezor published its investigation results last night. The lab has dismantled one reported Safe 5, and internal photos submitted by users confirmed two more cases, bringing the total to three hardware wallets containing circuit boards designed to steal recovery phrases. All three were purchased from Southeast Asian reseller CryptoBilis between August 20 and September 23, 2026.
After the report in October, Trezor asked anyone who had bought a device from this reseller to get in touch. So far, 48 people have responded. Their devices are either at the lab or being checked using internal photos. Trezor also examined devices from other resellers in the same region, but found no tampering and no other affected models. The owners of all three devices said their funds were still safe.
On November 11, Trezor released firmware version 2.13.1. The company says that once installed, the implanted boards can no longer steal information displayed on the screen. But if a recovery phrase has already been sent out, this update can't undo that. Anyone who bought from this reseller should still move their coins to a new wallet created with a new recovery phrase. Anyone who bought any model from this reseller since March 2026 can contact Trezor for a replacement. The reseller network has also been cut by around 80%.
The board is sandwiched between the mainboard and the screen. It only steals information; it doesn't alter anything. When recovery words or a passphrase appear on the screen, the board records them, encrypts them, and sends them over a mobile network to the attacker’s server. If it can't connect, it stores the data and keeps retrying.
My take: the vulnerability still lies in the supply chain. Trezor has been clear about the numbers and the patch, but anyone who bought from this reseller shouldn't assume that a firmware update is enough.
Beginners: observe more, do less. If you're buying crypto, stick to $BTC
