Hardware wallet maker Trezor confirmed on November 12 that three Safe 5 wallets sold through Southeast Asian reseller CryptoBilis contained hardware implants: an extra circuit board installed between the mainboard and the screen that could copy everything displayed on the screen, including recovery phrases and entered passphrases, and attempt to send it to attackers over a mobile network. The three devices were all sold between August 20 and September 23, 2026. Trezor said no affected users had reported losing funds so far. On November 11, the company released firmware version 2.13.1, which can prevent the discovered implants from continuing to steal information but cannot protect recovery phrases that were already stolen. It also cut its network of authorized resellers by about 80% and advised CryptoBilis buyers to transfer their assets to wallets generated with brand-new recovery phrases. Source: Trezor investigation update (November 12). $BTC $ETH