Trezor told customers on October 30 that a Safe 5 hardware wallet bought through a Southeast Asian reseller may have carried a hidden cellular implant built to steal the recovery phrase shown on its screen. The company has not yet examined the device and has not verified the report. It judged the evidence credible enough to warn every buyer who purchased from the reseller CryptoBilis since March 2026 to move their funds to a fresh wallet right away.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The report came from a customer in Indonesia who bought the Safe 5 in August through CryptoBilis’s store on the Tokopedia marketplace. After opening the casing, he found an extra circuit board sitting between the main board and the screen, carrying a cellular module and an antenna. He filed the finding through Trezor’s responsible disclosure channel on October 28, and he had already moved his money off the device before he discovered the board.
What the customer found inside the Safe 5
Trezor’s own post of October 30, credited to the Trezor Team rather than to an individual, describes the suspected design in plain terms. The added board allegedly reads whatever the screen displays, which includes the wallet backup shown during setup, and transmits it over a mobile network whenever the device is plugged in. Anyone holding that backup phrase can empty the wallet from any other device, so a copy leaving the hardware at setup defeats the point of owning a hardware wallet.
Trezor stressed that the account is unconfirmed. The security team has the customer’s photographs and description and has interviewed him by video call, and it is arranging for the device to be shipped to its lab. No CryptoBilis buyer has reported stolen funds, the company said, and it knows nothing about who built the board.
Ledger’s CryptoBilis case as the backdrop
The warning arrives three weeks after a near-identical problem surfaced at a competitor. Ledger began investigating customer losses on October 9, and its Donjon security team went on to confirm an unauthorized hardware implant in a device sold through CryptoBilis. BleepingComputer’s reporting describes a component that captures the display output, identifies the seed phrase and sends it out over LTE through an eSIM, with the original secure chip left untouched so the wallet still looks and behaves normally. Researchers at Tibane Labs published a teardown of two implant variants, both small enough to hide under the display.
Law enforcement has noticed the pattern as well. On October 28, the same day the Trezor customer filed his report, the Singapore Police Force issued an advisory on tampered hardware wallets, saying Ledger units from some Singapore retail stores contained malicious components and that at least two cases had been reported since September 10. An on-chain investigator named Specter put suspected thefts above $86 million, a number Ledger said it had not verified, according to Decrypt’s coverage of Trezor’s reseller cuts.
Trezor’s instructions for CryptoBilis buyers
The guidance covers every Trezor model purchased from CryptoBilis since March 2026, including units sold through its Tokopedia shop and any other store that carried CryptoBilis-supplied devices. Owners who already use such a wallet should create a new wallet with a new recovery phrase and transfer their funds as soon as possible; restoring the old phrase onto another device does not help, because an attacker may already hold it. Where no second hardware wallet is at hand, Trezor suggests parking money temporarily in a software wallet or an exchange the owner trusts, after checking the full receiving address.
Owners who never set up the device should leave it sealed and should never type an existing recovery phrase into it. The Hacker News summary of the statement adds that eligible customers can keep the device, contact Trezor Support and receive a replacement or a voucher. Trezor also advised against weighing or opening the hardware, calling those checks unreliable, and predicted phishing emails, letters and calls that exploit the incident. Its support staff will never ask for a recovery phrase.
Four inspected devices and the questions still open
Trezor is not starting from zero. Decrypt reported that the company had already inspected four devices bought from CryptoBilis, a Safe 7, two Safe 5 units and a Safe 3, and found no sign of tampering. The company removed CryptoBilis from its authorized seller list on October 9, and on October 13 it said there was not a single piece of evidence that its devices had been compromised, while announcing that all reseller authorizations would end on January 1, 2027.
The lab result is now the deciding fact. If the Indonesian unit proves genuine, Trezor will have to explain how an implant of the kind Ledger described reached a Safe 5 despite four clean inspections; if the board turns out to be something else, the warning will stand as a precaution. The company says the suspected device resembles the Ledger implants but declines to compare the two while both inquiries continue.
Until the unit reaches the lab, BleepingComputer’s account of the warning and Trezor’s own post rest on the same thin base: one reporter, one photographed board and no confirmed loss.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
