According to CoinMeta, Trezor confirmed that 3 Safe devices sold by Cryptobilis contained malicious implants that could steal mnemonic phrases and passwords. These implants would intercept screen data and send it to servers controlled by attackers via mobile networks. Trezor has released firmware version 2.13.1 to neutralize the identified implants, reducing the affected dealer network by about 80%. So far, no customers have reported any theft of funds. Starting from March 2026, customers who purchased these devices through Cryptobilis can request a replacement. Affected users should transfer their funds to wallets that use completely new recovery seeds, as the firmware update cannot erase the information that has already been leaked.