Daily Crypto Briefs 
CASABLANCA, Nov. 13, 2026
Trezor confirmed Thursday that three Safe 5 hardware wallets sold by former reseller CryptoBilis contained unauthorized implants, a day after releasing a firmware update to block the implants from capturing wallet backups.
Trezor said none of the three owners had lost funds and no customer had reported a loss. As of 19:03 UTC Friday, Daily Crypto Briefs found no public victim report, blockchain transaction or independent loss estimate that established a theft from the affected Trezor devices.
Bitcoin closed Thursday at $71,369.90, down 3.46% from Wednesday and about 13% below its Oct. 12 close, according to ChartExchange. It reached a session low of $71,000.
Trezor said it examined the first device in its lab and identified the other two from photos their owners supplied. The company had disclosed one suspected case on Oct. 30, before it received the device for inspection.
Bitcoin
BTCSampled daily UTC closes from ChartExchange.
Trezor Safe 5 cases trace to CryptoBilis
The three owners bought their devices between Aug. 20 and Sept. 23. The purchases came through CryptoBilis directly and through its stores on Tokopedia and Shopee. Trezor said 48 buyers had contacted the company and it was checking devices in its lab or through photos. It did not say how many inspections it had finished.
Trezor reported no signs of tampering in the other units it had checked, including devices from other regional resellers. It removed CryptoBilis from its authorized network on Oct. 9 after reports of tampering in Ledger hardware wallets sold by the same reseller.
The October Ledger theft has documented on-chain losses. Bitquery’s Oct. 16 accounting put that theft at $102 million from 335 wallets across six blockchains. The analytics firm attributed that figure to the Ledger investigation. Trezor has published no comparable evidence of funds moving from its customers’ wallets.
What Trezor firmware 2.13.1 fixes
Trezor said the added hardware could copy sensitive information displayed on the Safe 5, including the recovery words used to regain access to a wallet. The company’s release history dates the fix to Nov. 11. Trezor says the update blocks data capture by the implants it identified.
Someone who already has the recovery words could still use them to recreate the wallet. Trezor advises customers using a device bought from CryptoBilis since March to transfer funds to a new wallet with a fresh recovery phrase. It advises buyers with a suspect device that is still unused to avoid setting it up and contact support.
Trezor also said it cut its reseller network by about 80%. Remaining partners face stricter requirements for how they source and store devices and who can access the stock. Trezor said the partners it dropped posed no immediate threat.
Who qualifies for a Trezor replacement
Trezor’s replacement offer covers purchases of any Trezor model from CryptoBilis starting in March 2026. The company asks buyers to keep the old device and arrange a replacement through Trezor Support. The company may offer another model, delivery to a different country or a refund where shipping rules limit its options.
Trezor warned that scammers may pose as support agents offering replacements or refunds. Its phishing guidance says support will never ask for recovery words. In a separate October case, fake NGRAVE wallet alerts led users to a page that collected recovery credentials.
The Bitcoin-focused Crypto Fear & Greed Index fell to 20 on Friday from 28 the previous day, moving into Extreme Fear.
Fear & Greed Index
Nov. 13, 2026Trezor said it would update its notice if it confirms a fund loss, finds an implant in another model or traces one to another seller. The company has yet to say how many units may still need inspection.
Stay up to date
Get the latest crypto insights delivered to your inbox
Primary sources and further reading
| Source | Title |
|---|---|
| | Trezor's Nov. 12 CryptoBilis investigation update |
| | Trezor's Oct. 30 CryptoBilis customer alert |
| | Trezor Safe 5 firmware release history |
| | Bitquery's on-chain accounting for the October Ledger theft |
Fact-checked by: Daily Crypto Briefs Fact-Check Desk
Related Articles
Frequently Asked Questions
Which Trezor Safe 5 wallets were tampered with?
Trezor found implants in three Safe 5 devices bought from CryptoBilis between Aug. 20 and Sept. 23, 2026. It reported no confirmed cases involving another seller or model.
Did Trezor Safe 5 owners lose crypto in the CryptoBilis incident?
Trezor said none of the three owners had lost funds and no customer had reported a loss in its Nov. 12 update. As of Nov. 13 at 19:03 UTC, public reporting reviewed by Daily Crypto Briefs did not establish a Trezor-linked theft.
Does firmware 2.13.1 make an old Trezor recovery phrase safe?
The firmware blocks the implants Trezor found. A recovery phrase captured before the update can still give someone control of the old wallet, so Trezor advises affected customers to move funds to a new wallet with a fresh phrase.
Who qualifies for a Trezor CryptoBilis replacement?
Anyone who bought a Trezor from CryptoBilis starting in March 2026 qualifies. Customers should keep the device and contact Trezor Support. Shipping restrictions may affect which replacement or refund options are available.