Trezor warns of suspected crypto-theft implant in hardware wallet

Hardware wallet manufacturer Trezor has received credible reports regarding a suspected hardware crypto-theft implant found in a Trezor Safe 5 device sold by reseller CryptoBilis in Southeast Asia.

Although the company has not yet physically examined the device to confirm the malicious implant, it has strongly warned potentially affected users to move their private keys and digital assets to known safe wallets.

- Reports arose after an Indonesian user bought a Safe 5 device from CryptoBilis through Tokopedia in August 2026. - An extra circuit board with a cellular module and antenna was found between the main board and screen. - The implant appears capable of reading screen data, including the recovery phrase, and transmitting it over mobile networks. Trezor halted sales through CryptoBilis on October 9, 2026, and is restructuring its reseller network.

Supply Chain Attack Details and Investigation

According to Trezor, the security concerns began when an Indonesian customer reported finding an extra circuit board inside a Safe 5 device purchased via Tokopedia. The unauthorized component was equipped with a cellular module and antenna, positioned between the wallet's main circuit board and screen. Unconfirmed customer reports suggest the implant can capture data displayed on the screen, such as the wallet recovery phrase, and transmit it wirelessly when powered on.

CryptoBilis is the exact same retailer implicated in a Ledger hardware wallet implant incident earlier this month. The physical implants found in both brands' devices appear strikingly similar in form and function. Prompted by the Ledger security breach, Trezor proactively halted all device sales through CryptoBilis on October 9, 2026, before confirming any direct impact on its own supply chain, and subsequently announced global reseller network tightening.

Recommendations and Security Measures for Users

Trezor has stated it is currently unaware of any actual funds being stolen as a result of this supply-chain attack. The suspicious device is being shipped to Trezor for comprehensive analysis, and updates will follow once the investigation concludes. In the meantime, the company strongly advises users not to set up or use any devices purchased through CryptoBilis from March 2026 onward.

Users who have already configured such devices should immediately transfer their funds to a newly created wallet utilizing a fresh recovery phrase. Buyers possessing valid proof of purchase can contact Trezor customer support to arrange a replacement device or obtain a voucher. Additionally, Trezor emphasized that weighing hardware wallets is an unreliable method for detecting physical tampering.

Implications for the Crypto Hardware Market

Supply chain security remains a critical bottleneck for hardware wallet manufacturers as attackers target intermediaries and local distributors. With similar incidents affecting Ledger users in Southeast Asia resulting in substantial financial losses, hardware vendors are drastically tightening their global distribution channels. Strengthening accountability across reseller networks is now vital to maintaining consumer trust in cold storage security.