- Trezor has issued an urgent warning after receiving a credible report of a tampered Safe 5 hardware wallet containing a rogue circuit board and cellular transmitter.
- The issue impacts devices purchased from former authorized reseller CryptoBilis starting from March 2026 onward, prompting recommendations to immediately transfer funds to fresh wallet seeds.
- Trezor terminated CryptoBilis as an authorized distributor on Oct. 9 and is offering replacement hardware or vouchers to affected customers while lab examinations are pending.
Trezor Investigates Suspected Hardware Implant in Safe 5 Device
Hardware wallet manufacturer Trezor has escalated its security posture following a credible report of a physical supply chain compromise affecting a Trezor Safe 5 wallet. The development represents a notable shift from the company’s previous assessment on Oct. 13, when it stated it had received no notifications of altered units from CryptoBilis or any other authorized distributor and maintained that there is no indication that Trezor devices are affected.
While Trezor’s internal laboratory confirmation is still pending, the company is treating the alert as a serious security event.
According to the newly received report outlined by Trezor, the compromised Safe 5 was fitted with an unauthorized extra circuit board placed between the device’s screen and its primary printed circuit board (PCB). This secondary component allegedly incorporates an antenna alongside a cellular module designed to read sensitive on-screen data—including private recovery seed backups—and exfiltrate that data over a mobile telecommunications network whenever the unit is connected to power. Trezor emphasized that it has not yet independently verified the physical description and has not determined who is responsible for the manufacturing or distribution of the implant.
Action Steps for CryptoBilis Customers
The reported breach follows Trezor’s decision on Oct. 9 to de-list CryptoBilis as an authorized reseller. The move came immediately prior to competitor Ledger confirming an implant inside a unit belonging to an affected user the following day. Trezor’s updated precautionary guidance applies across all Trezor models procured through CryptoBilis or secondary retailers supplied by the vendor from March 2026 onward.
Crypto Liquidations Surge to $1.57 Billion as Binance Hack Pushes Bitcoin and Ether Lower
Trezor advises customers actively operating an affected unit to transfer all assets to a newly established wallet with an entirely new seed phrase immediately. Users must avoid importing the compromised recovery phrase into any replacement hardware or software wallet. If an alternative hardware device is unavailable, Trezor suggests transferring funds to a reputable software wallet or trusted cryptocurrency exchange as a temporary measure, taking care to verify the complete destination address prior to broadcasting transactions. For units that remain unboxed or unconfigured, owners are warned not to initialize the hardware or input existing wallet backups.
Replacements and Tamper Verification Protocols
Trezor is facilitating replacements for eligible customers, offering either a direct shipment from its primary facility or a digital voucher to redeem an authentic device. Users are instructed to retain the suspicious CryptoBilis units and reach out directly to Trezor Support, with the company reminding users that its official support staff will never request a seed backup or private recovery phrase.
Furthermore, Trezor cautioned users against attempting end-user physical checks, clarifying that weighing a unit or prying it open does not constitute a reliable method for detecting sophisticated hardware modifications. The company’s internal hardware security specialists plan to perform a full forensic tear-down of the flagged Safe 5 as soon as the physical sample reaches its testing facility.
Why This Matters
Supply chain attacks represent one of the most severe threat vectors in the cryptocurrency custody sector, as they bypass cryptographic protections by subverting physical trust before a device ever reaches the end user. Because the reported implant covertly transmits secret recovery phrases over cellular frequencies without requiring host computer access, it eliminates the traditional protection provided by air-gapped or offline storage. The incident reinforces the necessity of strict supply chain provenance and demonstrates the risks associated with acquiring hardware wallets via third-party regional intermediaries rather than directly from the original manufacturer.
Frequently Asked Questions
Which Trezor products and purchases are subject to the advisory?
The warning applies to every Trezor hardware wallet model sourced through reseller CryptoBilis—as well as retailers carrying stock supplied by CryptoBilis—purchased from March 2026 onward.
Can users determine if their device is tampered with by opening or weighing it?
No. Trezor specifically warned that measuring the weight of a wallet or manually disassembling the casing are not dependable ways to identify internal hardware modifications.
What remediation does Trezor offer to affected device owners?
Impacted owners can keep their hardware and contact Trezor Support to obtain either a replacement unit shipped directly from the company or a credit voucher to purchase a new hardware wallet.
