Trezor confirms three Safe 5 devices contained malicious implants and is reducing its dealer network.

Trezor has confirmed that three Safe 5 devices sold by CryptoBilis contained a malicious implant that could steal recovery phrases and passphrases. The implant intercepts screen data and sends it over the mobile network to a server controlled by the attacker. Trezor has released firmware 2.13.1 to disable discovered implants and reduce its reseller network by approximately 80%. No customers have reported any theft of funds. Customers who purchased devices through CryptoBilis starting in March 2026 can apply for a replacement. Affected users should transfer their funds to a wallet using a new recovery seed, as the firmware update cannot erase the previously leaked information. (Source: Bitcoin News)