# Trezor finds hidden implants in three ‘Safe 5’ wallets sold via reseller, enabling remote crypto theft

*Friday, November 13, 2026 at 2:07 PM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-13T14:07:55.674Z (50m ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: https://t.me/BossBotOfficial/21700 | https://t.me/BossBotOfficial/21699 | https://t.me/BossBotOfficial/21698 | https://t.me/BossBotOfficial/21697 | https://t.me/BossBotOfficial/21696
**Permalink**: https://hamerintel.com/data/articles/23361.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Crypto hardware maker Trezor says three ‘Safe 5’ wallets sold through former reseller CryptoBilis contained covert implants that could capture recovery phrases and send them over mobile networks. Because the tampering is physical, a firmware update can’t undo exposure for users who already initialized one of the altered devices.

A supply‑chain tampering case has pierced one of the core assumptions behind hardware crypto wallets: that the device itself is the trustworthy boundary.

Trezor has confirmed that three of its ‘Safe 5’ hardware wallets sold through a former reseller, CryptoBilis, were modified with hidden hardware implants. These additions were designed to steal users’ recovery phrases and transmit them via mobile networks.

The recovery phrase is the master key for a wallet owner’s digital assets. The implants were physically integrated into the device’s circuitry and configured to record that phrase as the user entered it. According to security reporting on the case, the malicious hardware could then exfiltrate the captured data over cellular channels, sidestepping the usual protection that comes from keeping a wallet offline.

Because the compromise is baked into altered hardware, Trezor has warned that installing new firmware cannot retroactively protect users who have already set up and used a tampered unit. Anyone who initialized one of the affected Safe 5 devices has to assume that their recovery phrase may have been exposed.

Hardware wallets are marketed to individuals and institutions that want insulation from hacks on exchanges and software wallets. They rely on the idea that secrets stay inside a sealed device that never directly connects to the internet. When that device has been altered somewhere along the distribution chain, that security model fails.

For users who bought Safe 5 wallets through CryptoBilis, the uncertainty is acute. Trezor has identified three compromised units, but it has not physically inspected every device that passed through the reseller. Cautious owners who used such wallets for significant funds now face hard choices about moving assets and rotating recovery phrases where possible.

The case will reverberate among exchanges, custodians, and funds that depend on hardware wallets as a final layer of protection. Procurement teams will be pushed to scrutinize distributors more closely, demand clearer proof of device origin, and consider extra physical checks on high‑value hardware.

It also feeds into a larger concern about supply‑chain security. As more wealth is stored in small, portable devices, those devices become attractive points of attack for criminal groups and potentially for state‑linked actors. A handful of compromised units can still represent large sums if they are placed with the right targets.

Key developments to watch include any confirmed thefts tied to these implants, further findings by Trezor about how many devices were altered, and possible regulatory or law‑enforcement action against CryptoBilis. How other wallet makers and institutional custodians respond will show whether this becomes a broader shift in how the industry handles hardware sourcing and verification.