A suspected physical modification to a Trezor Safe 5 could intercept recovery phrases through an unauthorized component connected to its display. Affected customers should transfer their asse
Trezor has urged customers who purchased hardware wallets from CryptoBilis since March 2026 to move their cryptocurrency after receiving a credible report of a suspected physical implant inside a Safe 5 device.
CryptoBilis update
We’ve been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:
Already using it?
Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.
Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.
We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.
On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far.
NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it. If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://t.co/5EasOVDDQh
We’re investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.
For more information, visit our blog: https://t.co/2LmFV8L2oe
— Trezor (@Trezor) October 30, 2026
The wallet was purchased in August through the Indonesian reseller, but Trezor has not yet received it for independent examination. The manufacturer issued its precautionary warning following earlier reports of tampered Ledger devices associated with the same distributor.
According to Trezor’s official security advisory, no CryptoBilis customer has reported losing funds to the company.
Trezor’s guidance covers customers who purchased its devices through CryptoBilis during the identified period, regardless of the hardware wallet model.
Customers should verify destination addresses before transferring funds and avoid unsolicited support messages. Trezor will never request a recovery phrase.
The suspected attack targets information displayed during wallet initialization rather than necessarily compromising the cryptographic operations protected by the device’s secure element.
According to the reported evidence, an additional printed circuit board was installed between the Safe 5’s main board and display. The component allegedly contained a cellular communications module and antenna capable of capturing information shown on the screen and transmitting it externally.
An attacker obtaining the recovery phrase could reconstruct the wallet on another device, even if the original hardware’s firmware and cryptographic protections remained intact.
The distinction matters because a recovery phrase is effectively a portable backup of the wallet’s underlying secrets. Once exposed, replacing the physical device does not revoke the compromised credentials.
Three attack methods illustrate the different security risks:
Attack Method Primary Target Potential Consequence Malicious Firmware Device software Manipulation of wallet operations or exposure of sensitive information. Recovery Phrase Theft Wallet backup Reconstruction of the wallet on another device, potentially allowing unauthorized transactions. Physical Display Interception Information shown during setup Recovery phrase exposure without extracting private keys from the secure element.Hardware wallet attack methods and their potential security consequences.
Unlike a conventional software exploit, a display-interception implant could operate independently of the wallet application or connected computer.
A firmware update would therefore not necessarily eliminate the threat. If unauthorized hardware continued monitoring the display, the device could remain vulnerable despite running legitimate software.
This also explains why Trezor recommends moving funds to a wallet with an entirely new recovery seed rather than simply resetting or replacing the original device.
The suspected component’s capabilities remain unverified. Trezor has received photographs and interviewed the reporting customer, but laboratory examination is still required to establish whether the alleged interception and transmission mechanism works.
Trezor removed CryptoBilis from its authorized reseller network on October 9 after reports emerged of physically modified Ledger hardware wallets distributed through the same company.
Ledger’s separate investigation confirmed unauthorized hardware tampering in devices associated with the reseller. However, those findings do not establish that the suspected Trezor modification involved the same individuals or distribution-stage compromise.
Trezor has examined four other devices obtained through CryptoBilis and found no evidence of tampering.
The incident nevertheless illustrates the risks associated with supply-chain interdiction, where legitimate hardware is intercepted and modified before reaching its intended owner.
Such interference may occur without changes to the manufacturer’s original firmware or secure-element architecture. Device-authenticity checks can help verify certain components and software, but they should not be assumed to detect every unauthorized physical addition.
The manufacturer has reported no comparable incidents involving other resellers, and the available evidence does not establish a broader compromise of Trezor’s production systems.
For affected CryptoBilis customers, the immediate priority is securing funds under a fresh recovery phrase. Investigators must still determine whether the suspected implant functioned as described and at what point the hardware may have been modified.
The post Trezor Warns CryptoBilis Buyers Over Suspected Wallet Implant appeared first on ETHNews.
