Trezor has confirmed that several of its Safe 5 hardware wallets, purchased through the reseller CryptoBilis, were tampered with—specifically implanted with hidden circuits capable of capturing users’ recovery phrases. The compromised units include an extra board inserted between the main board and display. When the wallet shows or a user enters their recovery phrase—or if a passphrase appears—this implant copies the sensitive information, then encrypts and transmits it over a mobile network to a server under the attacker’s control.
Although three affected wallets have been confirmed—two identified through lab analysis and one via photos from the owners—Trezor reports that none of these devices have been linked to any funds theft to date. The company discovered the implant’s firmware in the first unit, verified its behavior, and has rolled out firmware version 2.13.1 to block all implants found so far. However, the update can’t protect against data already stolen prior to the upgrade.
What Trezor Is Advising Affected Users to Do
If you purchased a Trezor device from CryptoBilis since March, the company strongly recommends moving all crypto assets to a new wallet with a brand-new recovery phrase. Restoring your existing phrase on another device does not mitigate the risk, since the phrase could already have been compromised. For unused wallets bought from CryptoBilis, do not set them up, and for any wallet whose origin is uncertain, refrain from entering an existing recovery phrase.
Trezor is offering to replace wallets purchased from CryptoBilis since the relevant period. Affected users are encouraged to contact Support to arrange a replacement. The company warns against using weight, opening the case, or other home inspection methods to detect the implants—none are reliable. It also stresses not disclosing the recovery phrase under any circumstance, emphasizing that it never asks for such information.
Scope of the Incident and Supply Chain Fallout
So far, all identified implants were found only in Safe 5 units sold via CryptoBilis between August 20 and September 23. No compromised units have been confirmed from other models or other resellers. The concealed hardware works by intercepting the data display and keystrokes related to backup phrase setup or wallet restoration, without altering any firmware or tampering with the secure element inside the device.
CryptoBilis was an authorized reseller in Southeast Asia until October 9. After the first reports emerged, Trezor removed it from its reseller program. Ledger, another major hardware wallet maker, also discovered shipments through CryptoBilis had included compromised units—these Ledger devices were fitted with similar implants aimed at capturing recovery phrases during setup. Trezor has slashed its network of authorized resellers by about 80%, dropping partners that don’t meet its stricter vetting rules, though some have been allowed to sell existing stock until January 1, 2027.
The company is still investigating whether implants exist outside CryptoBilis-sold Safe 5 wallets, or whether any attributed fund losses have occurred. It will publish updates if new cases emerge or if further protections become available.
This incident highlights serious vulnerabilities in hardware wallet supply chains. Even devices with secure elements and verified firmware aren’t immune if illicit components evade inspection and gain access to sensitive user data. If you have one of the affected wallets, act quickly—backup your assets elsewhere, get a clean device, and ensure you’re getting it straight from trusted sources. Going forward, hardware wallet makers must intensify oversight over authorized resellers, implement tamper-evident hardware checks, and provide faster audits when anomalies appear. Vigilance is now the price of real security in physical crypto custody.
