Our CryptoBilis investigation: what we found and what we’ve changed

Trezor has updated its investigation into hardware implants found in Trezor Safe 5 devices purchased from reseller CryptoBilis, revealing that three devices contain an extra circuit board that copies screen data and transmits it to an attacker-controlled server. In response, Trezor has released firmware update 2.13.1 to neutralize the current batch of implants, reduced its reseller network by approximately 80%, and offered replacement devices to affected customers who bought a hardware unit from CryptoBilis since March 2026. Open article →