Trezor Reduces Reseller Network by 80% After Spy Modules Found in Wallets

Trezor, a manufacturer of hardware wallets for cryptocurrency storage, has reduced its network of official resellers by approximately 80% following the detection of modified Safe 5 devices. According to a report published on November 12, 2026, experts discovered three wallets with embedded spy modules sold through the Malaysian supplier CryptoBilis. The devices were purchased between August 20 and September 23, 2026. The company confirmed the presence of foreign electronic components, but has not received reports of funds being stolen from the owners of these wallets.

How Spy Modules Entered Trezor Safe 5 Wallets

The investigation began after the discovery of suspicious devices distributed through CryptoBilis, a former official partner of Trezor in Southeast Asia. The first report of possible interference with the Safe 5 design was received by the company on October 28.

During subsequent checks, experts confirmed the presence of foreign equipment in three wallets. One of them was examined directly in Trezor's laboratory, while the other two were identified through photographs of internal components provided by the owners.

In total, following the company's appeal, 48 CryptoBilis customers contacted support to check their devices. Preliminary investigation results indicate that similar modifications have not been found in other Trezor models and wallets purchased from other verified resellers.

How the Spy Equipment Worked

The detected module was an additional electronic board installed between the wallet's main controller and its screen. The device could intercept information displayed on the screen, including recovery phrases and additional passwords.

The obtained data was stored in the module's memory, encrypted, and transmitted via mobile network to the attackers' server. In the absence of a connection, the equipment continued to store information until the next attempt to send it.

Meanwhile, the module did not alter the operation of the wallet's main firmware and Secure Element. This scheme allowed the interception of confidential data without direct intervention in the device's software.

On November 11, Trezor released firmware update 2.13.1, which blocks the operation of the identified spy modules. However, the company warned that the fix does not protect recovery phrases that may have been copied before the update was installed.

Trezor Tightens Reseller Requirements

Following the incident, the company revised its partner policies and reduced its reseller network by approximately 80%. The new requirements provide for stricter control over the origin of devices, storage conditions, and access to equipment before transferring to customers.

Trezor emphasized that the excluded partners were previously considered reliable and did not pose a direct threat. The decision is related to the transition to stricter supply chain security standards.

Customers who purchased Trezor devices through CryptoBilis since March 2026 are advised to transfer cryptocurrencies to a new wallet with a new recovery phrase. This requirement applies to all models purchased from the specified reseller, regardless of whether foreign components were found in them.

Trezor also offered such customers device replacements or refunds depending on delivery availability. The investigation continues in collaboration with cybersecurity experts SEAL 911. As of the publication date, the company has not recorded confirmed cases of cryptocurrency loss due to the discovered modules.