Trezor Warns of Suspected Hardware Implant Targeting Crypto Wallet Recovery Phrases
Trezor has issued a warning about a suspected hardware implant in Trezor Safe 5 devices purchased from CryptoBilis, which could potentially capture and transmit recovery phrases.
Trezor has alerted its users to a potential security threat involving a suspected hardware implant found in some Trezor Safe 5 devices. The warning specifically targets devices purchased from the reseller CryptoBilis since March 2026. While only one such device has been reported and sent for examination, Trezor is advising a broad precautionary scope for customer action.
The suspected implant reportedly contains a cellular module and antenna, integrated between the wallet's main board and screen. This hardware is alleged to capture information displayed on the screen, including the critical recovery phrases shown during the setup process. Once captured, this sensitive data could be transmitted over a mobile network when the device is plugged in, bypassing the wallet's core security measures.
The alert was triggered by a customer in Indonesia who purchased a Trezor Safe 5 through CryptoBilis in August 2026. Upon receiving the report and reviewing initial evidence, Trezor urged affected users to immediately move their funds to a new wallet with a fresh seed phrase. The company has not yet conducted its own laboratory examination of the compromised device, and there have been no confirmed reports of stolen funds linked to this specific implant.
This incident follows a separate investigation involving Ledger wallets, also supplied by CryptoBilis, which confirmed physical tampering in some devices leading to customer fund losses. Trezor took action by removing CryptoBilis from its authorized reseller network on October 9 and initiated checks on customer devices. However, Trezor has not yet identified the attackers or confirmed if the same threat actor targeted both brands, though it is collaborating with Ledger and other parties.
Trezor emphasizes that simply moving the existing wallet backup to another device does not eliminate the risk. Users must generate a completely new seed phrase on a secure device and then transfer their funds to this new wallet. For those who have not yet set up a potentially affected device, Trezor advises leaving it unused and never entering an existing recovery phrase. Temporary use of a software wallet or a trusted exchange is recommended if a secure hardware wallet is not immediately available.
Users are cautioned against attempting to detect tampering by weighing or opening their devices, as these methods are unreliable. Trezor also warns of potential scams exploiting this incident, such as fake emails or calls requesting recovery phrases. Official Trezor Support will never ask for a recovery phrase. Eligible customers who purchased from CryptoBilis can contact Trezor Support for a replacement or voucher, and should retain their original wallet.
The new article provides further details on the suspected hardware implant affecting Trezor Safe 5 wallets sold by CryptoBilis, including the specific reseller marketplace (Tokopedia) and the customer's location (Indonesia). It also elaborates on Trezor's immediate advisory, urging affected users to move funds to a new wallet, even if it means temporarily using a less secure software wallet or exchange. Trezor has confirmed it is arranging for the compromised device to be sent to its lab for examination, though it has already issued the warning due to the credibility of the customer's report and photos.