Trezor cuts reseller network by 80% after finding three tampered wallets

What happened

Trezor said on Nov. 12 that three Safe 5 hardware wallets bought from CryptoBilis carried unauthorized hardware implants. The devices were purchased between Aug. 20 and Sept. 23 through CryptoBilis directly or via its Tokopedia and Shopee stores, according to Bitcoin.com News. The outlet described CryptoBilis as a former authorized reseller in Southeast Asia; Protos described it as a Malaysian vendor. Trezor found the first reported implant in its laboratory and identified two more from photographs supplied by owners. Forty-eight customers had contacted the company, which was checking their devices in the lab or through internal photos.

The implant sits between the screen and the main board, according to Trezor's analysis. It copies information shown on the display without modifying the firmware or the Secure Element, the dedicated security chip. It records recovery words during wallet creation or restoration, along with displayed passphrases, which are optional secrets for separate wallets. The added board encrypts what it captures and sends it over a mobile network to an attacker-controlled server. If no signal is available, it stores the data and keeps retrying, Trezor said. The company said the implant works in the same way as those found in some Ledger devices.

Trezor released firmware version 2.13.1 on Nov. 11 to block the identified implants. Protos reported that a Trezor spokesperson said the implant monitors communication between the MCU and the display and triggers capture when it sees a specific sequence. Trezor said it changed the order of commands sent to the display, without altering what appears on screen, to stop that trigger. Protos reported that Trezor still maintains no crypto has been stolen from the affected devices. Even so, Trezor advised CryptoBilis buyers to move funds to newly created wallets because the update cannot protect a backup captured before it was installed.

Trezor also said it had cut its reseller network by about 80% and imposed stricter requirements on how devices are sourced, stored and accessed. It described the removed partners as trustworthy and said they posed no immediate threat. Replacement eligibility covers every model bought from CryptoBilis from March onward. Shipping limits may mean a different model with a price-difference refund, delivery to another country, or a refund. Trezor told customers to arrange replacements through official support and warned that scammers may impersonate staff. It said it never asks for recovery phrases, was working with SEAL 911, and would reward the customer who first reported the implant.

Why it matters

Hardware wallets are meant to keep recovery phrases away from networked computers, so tampering in the distribution chain attacks the point where users are supposed to establish trust. A modified device sold by a reseller can expose a seed while appearing to work normally. Trezor's decision to shrink its reseller network shows how much of that trust depends on logistics and retail partners, not only on firmware and secure chips. The reports also link the issue to a wider regional problem: Protos said Ledger wallets were drained of more than $86 million in an attack that involved tampered wallets sold by CryptoBilis, and Tether froze $10 million in stolen funds. Trezor's findings were limited to Safe 5 devices from CryptoBilis, but the episode raises questions for buyers who rely on third-party sellers.

What the data shows

The confirmed cases involve three Safe 5 wallets purchased from CryptoBilis between Aug. 20 and Sept. 23. Trezor said 48 customers had come forward and were being checked. The company cut roughly 80% of its resellers and released firmware 2.13.1 on Nov. 11. Replacements are available for any model bought from CryptoBilis from March onward. In the separate Ledger incident cited by Protos, more than $86 million was drained and Tether froze $10 million. Trezor said checks of other regional resellers' devices found no tampering and that it had no confirmed implants in other models.

Background

Ledger confirmed an unauthorized hardware implant in an affected customer's wallet in October, according to Bitcoin.com News. In that case, attackers bought genuine devices, modified them and put them back on sale through resellers in Southeast Asia. Protos reported that Ledger asked multiple wallet vendors across Asia to halt sales, and that an investigation uncovered an organized crime group spending millions on infrastructure for logistics, seed-collection servers and laundering. Bitcoin.com News reported that Trezor's reseller reduction plans emerged in October. Protos said it took several weeks before Trezor disclosed that it too had found an implant in one of its devices. Trezor has since examined the first Safe 5 in its lab and used owner photographs to identify two more.

What to watch

Trezor's investigation is not necessarily closed. The company was still checking devices for the 48 customers who contacted it, and it said previously captured backups remain compromised even after the firmware update. Buyers who suspect tampering were told to keep the device and avoid setting it up or using it until support gives guidance. Customers should also watch for fraudulent messages offering replacements or refunds; Trezor said it never requests recovery phrases. The scope of the reseller changes and the outcome of the Ledger-linked investigation are likely to shape how hardware wallet makers handle distribution in Southeast Asia.

Questions readers ask