In October we covered how wallet attacks moved off the chip: reseller implants, hijacked marketing email, fake browser extensions, and social media impersonation. The failures were in trust channels around the device, not in the secure element itself.
On 2 November 2026, Trezor added a development that was not public when that article shipped. A customer reported that a Trezor Safe 5 bought through Southeast Asian reseller CryptoBilis on Tokopedia may contain a concealed board that transmits what appears on the device screen, including the wallet backup during setup. The customer contacted Trezor through its responsible disclosure channel on 28 October. Trezor has not yet received the physical unit for laboratory analysis, but it published a precautionary warning while the report is investigated.
Trezor’s CryptoBilis warning
Trezor’s guidance applies to every Trezor model purchased from CryptoBilis from March 2026 onward, whether bought directly, on marketplaces such as Tokopedia, or through another storefront CryptoBilis supplied. Press reporting on the Safe 5 case describes an extra circuit board between the main board and the display, with a cellular module and antenna. According to that account, the board may read on-screen content and send it over a mobile network when the device is powered.
Trezor is treating the customer’s description as credible enough to warn buyers before lab confirmation. It asks anyone still using a CryptoBilis-sourced Trezor to move funds to a newly created wallet with a newly generated recovery phrase as soon as possible. Restoring the old backup on another device does not help if the seed was exposed during the compromised setup flow.
If you have an unused CryptoBilis Trezor, Trezor advises not initializing it. Trezor also discourages opening or weighing devices to hunt for implants at home; small weight differences can have other causes, and tampering can destroy evidence.
Buyers uncertain about provenance should check the seller name on the receipt or contact Trezor support. Trezor has described replacement device or voucher options for affected customers and asks users to keep the CryptoBilis unit for any future investigation. See Trezor’s November Suite update post for official wording and Help Net Security’s summary of the implant report.
The same reseller, more brands
The CryptoBilis name already appeared in October’s Ledger drain cluster. Bitquery’s on-chain analysis counted $92.9 million across 311 wallets and five chains linked to devices bought through that reseller. Ledger reported an unauthorized hardware implant in one examined Nano X. Those figures come from Bitquery’s measurement and from Ledger’s investigation; they do not by themselves prove that every affected wallet contained an implant.
The November Trezor report suggests the reseller channel, not a single vendor’s firmware, is the common risk. A chip that stores keys offline cannot protect a backup phrase that is copied from the screen and transmitted out of band. Our October supply-chain roundup walks through the Ledger cases and related phishing waves in more detail.
128-character passphrases on genuine Trezor hardware
Separately from the implant warning, Trezor’s 1 November 2026 Suite update raises the optional passphrase limit on supported models from 50 to 128 characters, with Trezor Suite 26.10.x and core firmware 2.13.0 rolling out in stages. The October 2026 forum release notes list the firmware changes; older firmware keeps the previous limit until updated.
Trezor Safe 3, Safe 5, Safe 7, and Model T can use the longer passphrase after both Suite and device firmware are current. Trezor Model One remains capped at 50 characters.
A passphrase is an optional secret layered on top of the recovery phrase. It opens a separate wallet with its own addresses and balances. Trezor framed the longer limit partly in the context of the July 2026 Coldcard entropy issue: users who had already stored a strong unique passphrase alongside an affected backup gained time before attackers could spend funds, because spending required both secrets. That history does not make passphrases a remedy for a tampered device or a seed captured during setup on an implanted unit.
Passphrases are advanced. Typing them wrong or forgetting them can lock funds permanently. Trezor publishes a passphrase FAQ that should be read before enabling the feature. Firmware updates and passphrases help on trusted hardware; they do not neutralize supply-chain implants.
For readable transaction data on supported contracts, see our Trezor Clear Signing overview.
Other Suite and firmware notes
The same release wave added product features that do not change the CryptoBilis guidance but matter for regular Trezor users:
- Arc EVM network support in Suite
- Cardano sending from the mobile app
- LI.FI swaps from Bitcoin into selected EVM chains inside Suite’s trade flow
- CSV export of trade history
- Tron resource delegation signing through WalletConnect on supported dApps
Treat these as routine maintenance items on devices you already trust.
Ledger firmware email
On 3 November 2026, Ledger emailed customers about a critical bug and a firmware update, without publishing detailed CVE text in that message. If you use Ledger hardware, check Ledger Wallet for updates through the normal in-app process and read the release notes there. This notice is separate from the CryptoBilis reseller investigation.
Companion-app phishing this month
On 17 October, NGRAVE reported that attackers compromised a third-party service used for LIQUID companion-app push notifications, leading to phishing that NGRAVE and Bitquery linked to roughly $2.65 million in losses across multiple chains. The hardware devices were not described as compromised; victims were steered to sites that asked for recovery material. That pattern fits the same trust-channel theme. We may return to companion apps in a future post; the urgent CryptoBilis Trezor warning takes priority for November.
What to do
- Buy from official channels. Use the manufacturer’s store or authorized resellers you can verify. See Trezor’s official store and Ledger’s official store. If you already bought from CryptoBilis, follow Trezor’s or Ledger’s current migration guidance before using the device.
- Migrate on a new seed if you are in scope. Generate a new recovery phrase on hardware you trust. Do not reuse a backup that may have been displayed on a tampered screen.
- Update Suite and firmware on devices from trusted sources, then review release notes before installing.
- Consider passphrases only after reading the FAQ, and only on genuine hardware with backups stored offline.
- Verify receiving addresses on the device screen before moving large balances.
- Read our device reviews for specs and setup context: Trezor Safe 5, Trezor Safe 3, Trezor Safe 7.
- Revisit fundamentals in our hardware wallet security guide.
WalletLab take
November extends a story we started in October: attackers keep targeting everything around the secure element. Trezor’s public warning is a sequel, not a duplicate, because it names a new brand and gives concrete migration steps for CryptoBilis buyers. The passphrase update is constructive news for users on untampered devices, but it cannot fix a seed that already left the screen through an implant.
Official purchase links and honest advisories are how we earn trust on comparison pages. If you are shopping now, start with verified retailers and on-device verification, not urgency messages from unknown senders.