Trezor Slashes Reseller Network 80% Following Crypto Wallet Security Breach

Hardware wallet manufacturer Trezor has reduced its authorized reseller network by approximately 80% after discovering malicious hardware implants in three Safe 5 cryptocurrency wallets. The company also released a firmware update designed to prevent the identified implants from stealing sensitive wallet information.

In its November 12, 2026, investigation update, Trezor confirmed that all three compromised devices came from former Southeast Asian reseller CryptoBilis. Although no customers have reported losing cryptocurrency, the company continues to recommend transferring funds to newly created wallets.

Three Compromised Wallets Identified During Investigation

Trezor discovered the implants in Safe 5 devices purchased between August 20 and September 23, 2026. Customers bought the affected wallets directly from CryptoBilis or through its Tokopedia and Shopee online stores.

The company physically examined one compromised wallet in its laboratory and identified two additional implants through photographs submitted by customers. Following its initial October warning, 48 CryptoBilis customers contacted Trezor for assistance.

Investigators have found no evidence of tampering in devices purchased from other resellers or in other Trezor models. However, the investigation remains ongoing.

How the Hardware Implants Steal Cryptocurrency Data

The malicious implant consists of an additional circuit board positioned between the Safe 5’s main board and display. It secretly captures information appearing on the screen, including wallet recovery phrases and passphrases.

The implant encrypts stolen information and transmits it through a mobile network to an attacker-controlled server. If connectivity fails, it stores the information and attempts transmission later.

Importantly, the implant does not modify the wallet’s original firmware or Secure Element. This makes the attack particularly concerning because the device’s core security components remain unchanged.

Firmware Update and Stricter Reseller Controls

Trezor released firmware version 2.13.1 on November 11 to block the identified implants from capturing additional information. However, the update cannot secure recovery phrases that attackers may have already obtained.

Consequently, Trezor advises CryptoBilis customers to transfer their cryptocurrency into new wallets with newly generated recovery phrases. Customers who purchased Trezor devices from CryptoBilis since March 2026 also qualify for replacements.

Meanwhile, the company has eliminated approximately four-fifths of its reseller network and introduced stricter requirements for device sourcing, storage, and handling.

Trezor emphasized that the removed partners were not necessarily security threats. The restructuring aims to strengthen supply-chain protection and reduce opportunities for future hardware tampering.