Trezor Confirms Three Implants in 48 Safe 5 Devices and Cuts 80% of Its Resellers

A Trezor Safe 5 bought from the Southeast Asian reseller CryptoBilis carried a hardware implant that copied what appeared on its screen, including the recovery phrase. On 12 November the company said its lab had confirmed the modification and that two more units among 48 customer devices showed the same board. The finding, published in Trezor’s investigation update , turns a single credible report into a confirmed supply-chain compromise and narrows the affected sales to a 34-day window between 20 August and 23 September 2026. The 48 shapes what the three mean.