# Trezor confirms recovery-phrase stealing implants in three Safe 5 wallets

_Published Friday, November 13, 2026 at 3:40 PM EST · Security · Latest · Tier 2 — Notable_

![Trezor confirms recovery-phrase stealing implants in three Safe 5 wallets — Primary](https://www.bleepstatic.com/content/hl-images/2026/09/07/Trezor.jpg)

Trezor says its investigation has confirmed malicious hardware implants in three Safe 5 wallets sold by reseller CryptoBilis. It examined the originally reported device in its laboratory and identified two more through owner photographs, resolving earlier uncertainty about the implant's capabilities.

An added circuit board between the main board and display captures recovery words and passphrases, then sends encrypted data over a mobile network. Firmware 2.13.1, released November 11, blocks the identified implants from capturing information but cannot protect phrases already stolen. Trezor advises affected buyers to move funds to a new wallet with a new recovery phrase; no affected customers have reported losing funds.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/cryptocurrency/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix/)

---
Canonical: https://techandbusiness.org/newswire/WSoAgUO8IOrm3pgW2GNVhY
Published: 2026-11-13T20:40:22.794Z
Story chronology: 2026-11-13T19:38:36.000Z
Retrieved: 2026-11-13T23:13:46.016Z
Publisher: Tech & Business (techandbusiness.org)