Trezor confirmed on November 12, 2026, that three Safe 5 hardware wallets sold through Southeast Asian reseller CryptoBilis between August 20 and September 23 contained unauthorized circuit boards installed between the main board and screen. The implants included cellular modules and antennas intended to capture and transmit sensitive data, but no user funds were lost. Firmware version 2.13.1, released on November 11, blocks the implants from capturing screen content, including seed phrases and private keys, making the current batch ineffective even if the hardware remains installed. Trezor advised CryptoBilis customers who bought devices from March 2026 onward to move funds to a new wallet with a fresh seed phrase, contact support for a free replacement, and ended its CryptoBilis relationship on October 9. The company also cut its authorized reseller network by approximately 80% and introduced stricter supply-chain controls for remaining partners. No implants were found in devices from other distributors or in other Trezor models, and the investigation remains ongoing.