Trezor is investigating a suspected hardware implant in a Safe 5 wallet purchased from reseller CryptoBilis. Customers who bought Trezor devices from CryptoBilis since March 2026 are urged to
Trezor has issued an urgent security warning after receiving a credible report of a suspected malicious hardware implant in one of its cryptocurrency wallets.
The affected product is a Trezor Safe 5, reportedly purchased from reseller CryptoBilis in August 2026.
The Trezor hardware wallet warning comes amid growing concerns about physically modified cryptocurrency storage devices entering retail distribution channels.
However, Trezor has not yet received the suspected device for examination.
As a result, the company has not confirmed whether the wallet actually contains a malicious implant.
Importantly, no CryptoBilis customer has reported losing cryptocurrency funds in connection with the suspected incident.
The manufacturer is continuing its investigation while taking precautionary steps to protect customers.
Hardware wallets are designed to store cryptocurrency private keys securely, making physical device integrity essential.
A compromised device could potentially expose sensitive wallet information, depending on how it has been modified.
Following the Trezor hardware wallet warning, the company advised customers who purchased Trezor devices from CryptoBilis since March 2026 to move their cryptocurrency to newly created wallets.
Trezor specifically recommends generating new recovery seeds rather than continuing to rely on existing ones.
A recovery seed is a set of words used to restore access to a cryptocurrency wallet.
If an attacker obtains that information, they may be able to access the associated funds.
Customers should create their replacement wallets using a trusted, verified device and ensure the new recovery seed is generated independently.
Simply resetting a potentially compromised device or reusing an existing recovery phrase may not adequately address the risk.
Users should also avoid entering recovery phrases into websites or sharing them with anyone claiming to provide support.
The warning is precautionary and does not establish that every Trezor wallet sold through CryptoBilis has been compromised.
World’s Second-Largest Hardware Wallet Maker Trezor Warns of Suspected Hardware Implant in Device Sold by Reseller Trezor said it received a credible report of a suspected hardware implant in a Trezor Safe 5 device purchased from reseller CryptoBilis in August 2026. The… pic.twitter.com/Ho7T37aDhn
— Wu Blockchain (@WuBlockchain) October 30, 2026
The latest Trezor hardware wallet warning follows earlier concerns involving tampered Ledger devices.
Trezor removed CryptoBilis from its reseller network on October 9, following reports about modified Ledger hardware wallets.
The company has also inspected four Trezor devices as part of its investigation.
None of those four devices showed signs of tampering.
However, the suspected Safe 5 device has not yet been examined, leaving the central allegation unresolved.
The incident highlights the importance of securing cryptocurrency hardware throughout the distribution process.
Even well-designed hardware wallets can face risks if devices are physically modified before reaching customers.
For now, Trezor is urging potentially affected CryptoBilis customers to prioritize moving their assets to wallets protected by fresh recovery seeds.
The company has not confirmed a successful attack involving the suspected Safe 5 device, and its investigation remains ongoing.
