Trezor found malicious implants in three Safe 5 wallets sold by CryptoBilis, with no confirmed fund losses. The devices may have captured recovery phrases and passphrases shown on-screen.

  • Three affected wallets were identified; checks continue among 48 contacted buyers
  • Purchases occurred from August 20 to September 23 through CryptoBilis, Tokopedia, and Shopee
  • Trezor urges users to move funds to a fresh wallet; unused devices must remain unconfigured

LaunchBar takeaway: a firmware patch can block the trigger, but not erase a seed already recorded by hardware. Treat every affected device as compromised, rotate funds immediately, and only buy through verified channels after Trezor’s 80% reseller-network purge.