Trezor warns of suspected hardware implant in reseller-sold Safe 5

Hardware-wallet maker Trezor warned on 30 October 2026 of a suspected crypto-theft implant inside a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. The warning rests on a single customer report, not Trezor's own teardown — the company has not yet received the device to examine — but it is telling owners to act anyway. If you bought a Safe 5 from CryptoBilis since March 2026, move your funds to a new wallet now. Devices from Trezor's official store are not implicated.

What was reported

An Indonesian customer bought the wallet through the Tokopedia marketplace in August 2026 and later opened it. According to Trezor, the buyer found an extra circuit board wedged between the main board and the screen, carrying a cellular module and an antenna. Based on the customer's (unconfirmed) account, the implant can read screen content — including the recovery phrase shown during setup or recovery — and transmit it over a mobile network whenever the device is plugged in. The report reached Trezor on 28 October; the warning followed two days later.

Trezor is explicit that the implant is unverified: "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," the company said, choosing to warn before its lab has the hardware in hand. It is aware of no funds stolen through a supply-chain attack so far.

What to do today

1. If you own a CryptoBilis-sold device bought since March 2026, assume the recovery phrase is compromised. Create a brand-new wallet with a new recovery phrase and move funds to it as soon as possible.
2. Don't restore the old seed onto another device — that just re-exposes the same phrase. If you have no second hardware wallet, move funds temporarily to a reputable software wallet or exchange.
3. Don't set up or use an untrusted device, and never type an existing recovery phrase into one.
4. Don't try to detect tampering by weighing the device — Trezor says that is not reliable.
5. Keep the device and contact Trezor Support with proof of purchase for a replacement or voucher.

Context

Trezor had already dropped CryptoBilis as an authorized reseller on 9 October 2026, before it had any sign this unit was affected — the move followed a similar implant incident involving a Ledger device sold by the same reseller. Trezor says it is tightening its reseller network globally as a result.

Hardware supply-chain tampering is harder to pull off than a malicious app but far harder to detect: the attack lives below the firmware the user can inspect, and a wallet whose entire job is to keep the seed off any networked surface is defeated the moment a cellular radio sits inside the case. The practical defense is unchanged and boring — buy hardware wallets direct from the vendor, and treat any seed that has ever been displayed on a questionable device as already leaked.