Trezor Warns of Suspected Hardware Implant Targeting Crypto Wallet Recovery Phrases
Trezor has issued a warning about a suspected hardware implant in Trezor Safe 5 devices purchased from CryptoBilis, which could potentially capture and transmit recovery phrases.
Trezor, a prominent manufacturer of hardware cryptocurrency wallets, has alerted its customers to a potential security threat involving its Trezor Safe 5 devices. The company is advising users who purchased the wallet from the Southeast Asian reseller CryptoBilis since March 2026 to immediately transfer their funds to a new, freshly created wallet.
This advisory stems from a report by a customer who claims to have discovered an implant within a Trezor Safe 5 device. According to the unverified report, the device contained an additional circuit board equipped with a cellular module and antenna. This component is suspected of being capable of capturing the recovery phrase displayed on the screen and transmitting it over a mobile network whenever the device is connected to power.
CryptoBilis has a history of involvement in tampering with hardware wallets, as they were also implicated in selling Ledger devices that were later found to have been compromised. This prior association raises significant concerns about the integrity of devices sold through this reseller.
While Trezor has not yet officially verified the existence of the implant, the company is taking a precautionary approach to protect its users. The recommendation to move funds to a new wallet is a standard security measure when there is any suspicion of seed phrase compromise, as the recovery phrase is the master key to all cryptocurrency assets held within a wallet.
As of the latest reports, no stolen funds have been confirmed in connection with this alleged implant. However, the potential for such a device to exfiltrate sensitive recovery information poses a severe risk to users' digital assets. The security of hardware wallets relies heavily on the physical integrity of the device and the secrecy of the recovery phrase.
This incident underscores the critical importance of purchasing hardware wallets directly from the manufacturer or authorized resellers to mitigate the risk of tampering and supply-chain attacks. Users are urged to remain vigilant and follow Trezor's guidance to ensure the security of their cryptocurrency holdings.