TREZOR SAFE 5 · CMP-202611-ykpygz · Vendor
FIX → firmware 2.13.1 (blocks known implants; does not protect already captured phrases)
Trezor confirmed on 12 Nov 2026 that three Trezor Safe 5 hardware wallets sold by former reseller CryptoBilis (directly or via its Tokopedia and Shopee stores, bought between 20 Aug and 23 Sep 2026) contain an extra circuit board with a cellular module and antenna between the main board and the screen. It captures the recovery phrase and passphrase from the screen and sends them over the mobile network to an attacker server. 48 customers' devices are being checked; no lost funds reported so far; Trezor says no other models or resellers' devices were found tampered. Firmware 2.13.1 (11 Nov) blocks the known implants but cannot protect phrases already captured. Trezor has cut its reseller network by about 80%.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
2.13.1 or laterUpgrade to firmware 2.13.1 (blocks known implants; does not protect already captured phrases)
2.13.1 and buy hardware wallets only from the maker or an authorised resellerPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.