Trezor identified three Safe 5 hardware wallets that were physically tampered with before reaching customers. Unauthorized circuit boards containing cellular modules and antennas were installed between the main board and the screen of these devices.
The affected units were sold through the Southeast Asian reseller CryptoBilis between August 20 and September 23, 2026. Trezor terminated its partnership with this reseller on October 9, 2026, following similar security concerns involving Ledger devices.
Trezor inspected 48 devices in total to confirm the scope of the breach. The company concluded that the tampering was limited to this specific sales channel and did not affect its own manufacturing line or other resellers.
On November 11, 2026, Trezor released firmware version 2.13.1 to prevent the unauthorized hardware from capturing sensitive data. The company reported that no financial losses have occurred to date.
Trezor advises customers who purchased devices from CryptoBilis to transfer their funds to a new wallet with a fresh seed phrase. Additionally, the company has reduced its authorized reseller network by approximately 80% and implemented stricter partner requirements.
