Trezor Safe 5 Screen Implants Captured Wallet Recovery Words

Trezor Safe 5 hardware wallets acquired through CryptoBilis contained an unexpected passenger: an extra circuit board watching the screen. In its November 12 investigation update, Trezor says the implant copied information without altering the legitimate firmware or security chip, then sent captured data over a mobile network.

The attraction of a hardware wallet is separation. It holds the private keys that authorize cryptocurrency transactions, while the assets themselves are recorded on the blockchain. A connected computer can supply a transaction for signing and receive the signed result without receiving the private key. That arrangement is meant to keep the most valuable secret away from the everyday internet-connected machine.

A screen presents a different opportunity. The implanted board sits between the main electronics and display. Trezor's analysis says it can collect wallet recovery words shown or entered there. Picture a strongbox whose lock remains intact while a hidden camera watches someone copy its spare key. Breaking the lock is no longer necessary.

Recovery words are an ordered backup from which a wallet can be restored. Trezor's backup guidance explains that someone with this information can gain access without possessing the original device. That makes the words fundamentally different from a disposable verification code. They are not merely a record of what happened on the screen; they can recreate access elsewhere. Keeping the physical device therefore does not settle the question of who holds the keys.

BleepingComputer reports that the three affected Safe 5s came from CryptoBilis. Trezor examined one in its laboratory and identified two more from owners' internal photographs. No associated fund losses have been reported to the company. The company says its firmware update blocks the implants already found, but cannot undo an earlier capture of recovery words.

This technique has a precedent. Ledger confirmed hardware implants in devices distributed through the same reseller in October, following cryptocurrency-loss reports. The development here is another manufacturer's confirmed exposure and response, rather than an unprecedented way to attack a wallet.

For buyers, the episode makes the journey from factory to owner part of the security story. Trezor still advises CryptoBilis customers to use a new wallet with a new recovery phrase, and warns against handing those words to anyone offering replacement assistance. A patch may close the window through which a secret escaped. It cannot retrieve a copy already outside.

Original investigation update: November 12, 2026.