Trezor has issued a warning about a potential hardware implant discovered in its Safe 5 crypto wallets sourced from reseller CryptoBilis, which could expose users’ recovery phrases. While only one device has so far been reported, all models purchased from CryptoBilis since March 2026 are considered potentially affected. Owners are urged to move funds to a fresh wallet generated with a new seed. No thefts from this issue have been confirmed yet.
Details of the Suspected Implant
The issue was first flagged by a customer in Indonesia who bought a Safe 5 via CryptoBilis on Tokopedia in August 2026. Their device apparently had an extra circuit board inserted between the main board and the screen. This board includes a cellular module and antenna, and allegedly reads whatever is displayed—such as the recovery phrase—then sends that data over a mobile network whenever the wallet is plugged in. This would allow attackers to capture the seed during setup without needing to compromise Trezor’s internal firmware or main processor.
The hardware tampering is still considered a reported suspicion rather than a confirmed finding across devices. Trezor is currently awaiting examination of the suspect unit in its security lab. The March 2026 date marks the start of the warning period—not definitive proof that all devices sold after that are compromised.
What Trezor Is Doing
Trezor removed CryptoBilis from its authorized reseller list on October 9, 2026, following similar tampering findings in devices of another brand also sold via CryptoBilis. The company is collaborating with Ledger and other organizations in investigating the broader scope of potential attacks. Performance lab tests are underway to assess how widespread the issue might be.
To mitigate risk, Trezor recommends that anyone who has already set up a Safe 5 device obtained from CryptoBilis move funds to a new wallet generated with a fresh seed. A device that hasn’t been set up yet should remain unused. If a hardware wallet isn’t immediately available, temporarily using a trusted software wallet or familiar crypto exchange is suggested. Close attention should be paid when transferring funds—double check the full receiving address every time.
Trezor strongly advises against consumers trying to detect tampering by weight or opening the case themselves, as these methods are unreliable. Affected customers can request a replacement or receive a voucher for a new device through official support channels. They should retain their original device, and beware of phishing attempts—Trezor staff will never ask for recovery phrases in any communication.
While no confirmed thefts have arisen from this incident, both Trezor and Ledger are probing the issue for signs that the same attacker may have targeted multiple wallet manufacturers via the same reseller. The investigation remains active and no definitive connection has yet been established.
Why this matters: Recovery phrases are the key to accessing and restoring control of crypto assets. Any vulnerability that exposes them—especially through hardware tampering—is extremely serious. Users store large sums using hardware wallets precisely to avoid digital attacks; when the security is breached at the physical level, entire funds become vulnerable.
