Suspected Hardware Implant Found in Trezor Safe 5
Trezor has reported a potential security issue involving a Trezor Safe 5 hardware wallet purchased through CryptoBilis, a former authorized reseller in Southeast Asia. The device, purchased through the Indonesian marketplace Tokopedia in August 2026, was reportedly found to contain an unauthorized electronic component. After receiving the initial report on October 28, Trezor reviewed photographs and contacted the affected customer. While the company has not yet physically examined the device, it considers the information credible enough to issue a public security warning.
How the Implant Could Affect Wallet Security
According to the information shared by Trezor, the suspected modification involves an additional circuit board installed between the device's mainboard and display. The component reportedly includes a cellular communication module and antenna, potentially allowing information displayed on the screen to be captured and transmitted externally. This could include sensitive information such as the recovery phrase shown during wallet initialization. Unlike traditional software-based attacks, this type of hardware modification could compromise wallet security without necessarily interfering with the device's firmware or private-key storage. However, the exact capabilities of the reported implant have not yet been independently confirmed.
Connection to Previous Hardware Wallet Incidents
The report follows similar security concerns involving Ledger hardware wallets distributed through CryptoBilis. Earlier in October, Ledger confirmed that certain devices sold through the reseller had been physically modified with malicious components designed to capture recovery phrases. Following these findings, Trezor removed CryptoBilis from its authorized reseller network on October 9 and introduced additional precautions within its distribution processes. Although the reported modification of the Trezor Safe 5 shares similarities with the earlier Ledger cases, there is currently no confirmation that the incidents are connected or involve the same individuals.
Recommended Steps for Affected Users
As a precaution, Trezor recommends that anyone who purchased a device supplied by CryptoBilis from March 2026 onward move their funds to a newly generated wallet with a completely new recovery phrase. This is particularly important because transferring an existing recovery phrase to another device would not eliminate the risk if the phrase had already been exposed. Users who have not yet initialized their devices are advised not to proceed with the setup. Trezor is also offering eligible affected customers either a replacement device shipped directly by the company or a voucher for purchasing a new one. Users should contact Trezor exclusively through its official support channels and remain cautious of potential phishing attempts.
What This Means for Hardware Wallet Security
This incident highlights the importance of supply-chain security when using hardware wallets for cryptocurrency self-custody. While hardware wallets provide an additional layer of protection by keeping private keys isolated from internet-connected devices, their security also depends on the integrity of the physical device and the distribution process. Purchasing directly from manufacturers or trusted authorized resellers, carefully following security recommendations, and protecting recovery phrases remain essential practices. As of October 30, Trezor has not reported any confirmed loss of funds associated with this suspected implant, and there is currently no indication that devices distributed through other resellers are affected. The investigation remains ongoing.
