Hardware wallet manufacturer Trezor has issued a security warning to customers who purchased its devices through Southeast Asian reseller CryptoBilis, following reports of an alleged physical implant inside a Safe 5 wallet.
On October 28, Trezor received a responsible disclosure describing an additional circuit board allegedly installed inside the device. The company is advising affected customers to move their cryptocurrency to a newly generated wallet rather than wait for its investigation to conclude. The warning applies to customers who purchased Trezor hardware wallets through CryptoBilis from March 2026 onward.
Details of the Alleged Modification
According to the disclosure, the suspicious Safe 5 device was purchased through Indonesian marketplace Tokopedia in August 2026. The alleged modification involved an additional circuit board positioned between the wallet's main board and its display.
The component reportedly contained a cellular module and antenna capable of reading information displayed on the device, potentially including the user's recovery phrase, before transmitting the captured information over a mobile network.
Trezor has not physically examined the device in question. Its preliminary assessment is based on a video interview with the customer who reported the discovery. Despite the lack of a laboratory inspection, the company considers the disclosure credible enough to issue an immediate warning.
"We'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime," said Trezor Chief Commercial Officer Danny Sanders.
Trezor confirmed that customers who contact its support team will be offered replacement devices. The company has inspected four other returned CryptoBilis devices and found no evidence of tampering in those units. No customer fund losses connected to the alleged Trezor incident have been reported.
Broader Supply Chain Issues
Trezor had already removed CryptoBilis from its authorized distribution network in October, following reports of tampered Ledger hardware wallets being sold through the same distributor. Ledger previously confirmed physical tampering involving devices distributed through CryptoBilis, while OneKey also ended its relationship with the reseller, suspended new approvals, and offered customers free replacements.
Onchain analysts estimated that more than $86 million in cryptocurrency was lost across Bitcoin, Ethereum, and Tron in connection with the Ledger incident, though Ledger has not independently confirmed that figure.
Implications for Hardware Wallet Security
The incident highlights a broader issue facing cryptocurrency investors: hardware wallet security depends on more than the technology inside the device. Although cold wallets are designed to keep private keys offline, physical interference during distribution can introduce risks that ordinary software protections may not detect.
For now, Trezor's warning remains precautionary, as the company has not yet completed a physical examination of the reported Safe 5 device. The incident serves as a reminder that securing cryptocurrency requires careful attention to where hardware wallets are purchased, how devices are handled, and whether recovery phrases remain protected.
