Trezor has warned users about a sophisticated hardware implant discovered in one of its Safe 5 cryptocurrency wallets. The affected device was purchased in August 2026 from CryptoBilis, a Southeast Asian reseller, through the e-commerce platform Tokopedia.
According to the responsible disclosure report, the compromised wallet contains a hidden circuit board, an antenna, and a cellular communication module. The components are designed to capture recovery seed phrases directly from the device’s screen and send the information to attackers through mobile networks.
CryptoBilis update
We’ve been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:
Already using it?
Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.
Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.
We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.
On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far.
NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.
If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://t.co/5EasOVDDQhWe’re investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.
For more information, visit our blog: https://t.co/2LmFV8L2oe
— Trezor (@Trezor) October 30, 2026
Although Trezor is still waiting to physically examine the device, the company considers the report credible. It also confirmed that no funds have been lost so far.
Trezor had already ended its relationship with CryptoBilis on October 9, 2026, following similar reports of tampered Ledger devices. The company is now advising anyone who purchased a Trezor wallet from the reseller since March 2026 to move their funds immediately to a newly created wallet.
Read also: Trezor Launches “Safe 5” Hardware Wallet and New Self-Custody Services
Supply chain attacks expose weaknesses in hardware wallet security
The discovery of a hidden cellular transmitter in a hardware wallet highlights a major weakness in cryptocurrency security involving the physical supply chain.
Manufacturers invest heavily in secure hardware and cryptographic software to protect users’ funds. However, these protections may not be enough if someone tampers with a device before it reaches the buyer.
X commenter @Light pointed out that cryptocurrency security goes beyond the wallet itself. According to Light, the physical supply chain creates a separate security risk, meaning where users buy their wallets is just as important as the brand they choose.
One thing people overlook about hardware wallets is that security doesn’t start and end with the device.
You can have a wallet designed to keep your keys safe, but the supply chain is another attack surface.
Where you buy your wallet matters just as much as which one you buy.
— Light (@Thee_Lightt) October 30, 2026
This type of attack can bypass the Trezor’s internal security systems entirely. The hidden components capture information directly from the device’s screen and send it through a cellular network without interacting with the wallet’s internal software.
Another user on X, Macro bombastic, made a similar point, describing supply chain attacks as a fundamental weakness that hardware wallet manufacturers cannot address on their own.
@Trezor supply chain attacks are the one thing hardware wallets can’t fully solve tbh
— Macro Bombastic (@MacroBombastic) October 30, 2026
When attackers intercept packages and install additional cameras, antennas, or other malicious components, security becomes a shared responsibility. Shipping companies and logistics providers also play an important role in ensuring that devices reach customers without being tampered with.
Repeated security breaches increase investor frustration
The discovery is not an isolated incident. The crypto community is already dealing with several high-profile security incidents involving both centralized and decentralized platforms.
X user @Unfinished expressed frustration with the continuous stream of security problems. He listed several recent incidents, noting that investors had barely finished dealing with reports of tampered Ledger devices and a major drain from a Binance vault before the Trezor hardware implant was discovered. This reaction reflects growing frustration among retail investors who are finding it increasingly difficult to feel safe in the cryptocurrency market.
@Trezor can’t catch a break: first the ledger shelves, then binance’s vault, now a trezor implant from the same reseller.
— unfinished (@unfinished_kek) October 30, 2026
Self-custody is built around the idea that users should have direct control over their assets. However, that promise becomes harder to trust when centralized exchanges struggle to protect trading funds and regional resellers cannot guarantee that hardware wallets are genuine and untampered.
When users cannot confidently rely on either exchanges or hardware wallet suppliers, their options for protecting their assets become more limited, and could eventually push some investors away from the market.
Frequently Asked Questions
What happened to Trezor Safe 5 wallets?
Trezor received a report that a Safe 5 hardware wallet purchased from Southeast Asian reseller CryptoBilis contained a hidden circuit board, antenna, and cellular communication module. The suspected implant was designed to capture recovery seed phrases displayed on the device screen and transmit them to attackers over mobile networks.
Was Trezor hacked, or were the wallets physically tampered with?
The incident involves suspected physical tampering rather than a breach of Trezor’s software or internal systems. The additional hardware reportedly bypasses the wallet’s internal security by capturing information directly from its screen.
Which Trezor wallets are affected by the security warning?>
The reported compromised device was a Safe 5 wallet purchased in August 2026 through Tokopedia.
How much cryptocurrency was stolen from affected Trezor wallets?
No financial losses have been reported so far. Trezor confirmed that no funds had been lost in connection with the reported incident, although the company is still waiting to physically inspect the compromised device.
What did Trezor advise customers who purchased wallets from CryptoBilis do?
Trezor advises anyone who purchased its hardware wallets from CryptoBilis since March 2026 to immediately transfer their cryptocurrency to a newly created wallet. Customers should generate a completely new recovery phrase rather than reuse the one associated with the potentially compromised device.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
