[Single source] Trezor releases firmware 2.13.1 against implants in three Safe 5 wallets

A DarkWebInformer post says Trezor released firmware 2.13.1 on November 11 to neutralize malicious implants allegedly found in three Safe 5 wallets bought from reseller CryptoBilis. The post says no customer funds have been reported stolen, but the supplied evidence does not include a primary Trezor statement confirming these details.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

According to the post, the three wallets contained implants that could capture recovery phrases and passphrases, then send that information to attacker-controlled servers through mobile networks. It attributes Trezor's firmware update and a roughly 80% reduction in its reseller network to the discovery.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

If the account is accurate, the case shows how a compromised device in the retail supply chain could bypass protections inside an otherwise legitimate wallet. An implant that watches secrets outside the firmware and Secure Element could expose everything needed to access funds later, even if the wallet's core security components remain unchanged.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

The post urges anyone who bought a device from CryptoBilis to move funds to a new wallet using a newly generated recovery phrase. It also says Trezor is offering replacement devices to eligible customers, although the supplied evidence provides no eligibility rules or official contact instructions.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

The report identifies three Safe 5 devices, CryptoBilis as the reseller and firmware 2.13.1 as the mitigation. It does not provide device serial numbers, purchase dates, implant photographs with technical validation, affected regions, server indicators or evidence establishing who installed or controlled the alleged implants. The statement that no funds have been reported stolen also does not establish that no recovery data was exposed.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

DarkWebInformer says Trezor confirmed the implants and describes them as secretly stealing recovery phrases. In the supplied lot, however, that characterization comes only from this third-party account and is not accompanied by a direct quotation or linked announcement from Trezor.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

The sequence presented by the post begins with three Safe 5 wallets purchased through CryptoBilis, followed by the discovery of hardware placed between the main board and screen. It then points to the November 11 release of firmware 2.13.1, replacement offers and a major contraction of Trezor's reseller network as the response.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

1 independent groups, 1 updates, and 10 engagements.

The post places the implants between each wallet's main board and screen and says they monitored recovery phrases and passphrases without altering the firmware or Secure Element, the protected chip intended to isolate sensitive operations. It further alleges that captured data could leave the device over mobile networks, but supplies no teardown, code, network trace or independent laboratory analysis.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

The evidence lot contains one DarkWebInformer post on X and an attached image. It contains no primary Trezor advisory, firmware release notes, CryptoBilis response, forensic report or independently corroborating source, so the attribution, implant capabilities, number of affected devices and effectiveness of firmware 2.13.1 cannot be independently verified from this material alone.[1]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list