Trezor Warns of a Suspected Hardware Implant in a Reseller's Safe 5

Trezor has warned that one of its hardware wallets may have been fitted with a covert implant somewhere in the reseller channel, not on the production line. On October 30, 2026, the company said it was treating as credible a report of a suspected hardware implant inside a Trezor Safe 5 that a customer in Indonesia had bought from the reseller CryptoBilis. The buyer found an extra circuit board wedged between the wallet's main board and its screen, carrying a cellular module and an antenna that could reportedly read what the screen displays, including the recovery phrase, and send it out over a mobile network. Trezor has not yet examined the device, and it is careful to call the implant suspected rather than confirmed. The device itself appears genuine. The weak link was the reseller channel it passed through.

What happened

The account came from a customer in Indonesia who bought a Trezor Safe 5 from CryptoBilis through the online marketplace Tokopedia in August 2026. After opening the device, the customer found an extra circuit board that did not belong there, sitting between the wallet's main board and its display. On that board were a cellular module and an antenna. By the report Trezor relayed, the added hardware could read information shown on the screen, including the recovery phrase a user writes down when first setting the wallet up, and transmit it over a mobile network to whoever placed it there, as The Hacker News reported.

Trezor has been deliberate about what it does and does not know. It has not yet received or examined the device, so it describes the implant as suspected rather than confirmed, while treating the risk as credible enough to warn customers now, according to The Block. So far, no CryptoBilis customer who bought a Trezor has reported losing funds to the company. That distinction matters. A suspected implant under investigation is not the same as a proven theft, and the two should not be folded together. Trezor's own blog post carrying the warning is dated October 30, 2026, though some outlets reported the disclosure two days earlier.

The warning did not come out of nowhere. Trezor had already cut ties with CryptoBilis on October 9, 2026, dropping it as the authorized reseller for Southeast Asia. That decision followed the start of a separate investigation by Ledger, a rival hardware wallet maker, into losses reported by Ledger customers who had also bought from CryptoBilis. In Ledger's case the picture is firmer. The company has confirmed a hardware implant in one affected device, and some of its customers reported losing funds. Trezor says the board found in the Safe 5 appears to work in a similar way to the implants seen in the Ledger devices, but it will not draw a direct comparison while both investigations remain open. A tampered device is hard to catch by eye, because the implant hides inside a sealed case that looks exactly like the real product. The common thread is not a brand of wallet. It is the reseller.

Why it matters

A hardware wallet exists to solve one problem. It keeps the private keys that control your cryptocurrency off any internet-connected computer, so that even a compromised laptop cannot move funds without the physical device in your hand. That promise rests on an assumption that is easy to overlook: the device in your hand is the device the manufacturer built. This incident puts a crack in exactly that assumption. The Safe 5 appears to have left the factory genuine, then been opened, altered, and resealed somewhere in the reseller channel before it reached the buyer. Nothing here points to a design flaw in the wallet. The failure sits in the chain of custody between the maker and the owner.

That reframes the recovery phrase as the real target. The phrase, also called a seed phrase, is the human-readable backup of every key the wallet holds, and anyone who reads it can rebuild the wallet and empty it from anywhere. An implant that can see the screen during setup and quietly phone the phrase home never has to break the device's cryptography. It only has to watch the one moment the secret is shown. The crown jewel was never the circuitry. It was the twelve or twenty-four words.

This is the hardware version of a story that has become routine in software. The same logic drives software supply chain security: the risk lives not only in the thing you build or buy, but in every hand it passes through on the way to you. The industry saw it again when malicious extensions reached developers through a trusted marketplace, turning an ordinary install into a compromise. Code or hardware, the pattern holds. Trust handed to a distribution channel becomes the attacker's easiest way in.

SOURCE: TREZOR

A hardware wallet can only be as trustworthy as the hands it passed through to reach you.

The supply-chain read

The lesson is not that hardware wallets are unsafe. It is that the channel a device travels through is part of its security, and a trusted-looking reseller can be the soft spot an attacker aims for. This is the premise we build on at Threatless, where AI-native security treats supply chains and third-party exposure as first-class risks rather than someone else's problem, the same thread that ran through the record crypto theft that began with one trusted endpoint. Keep the takeaway narrow: buy hardware wallets from the manufacturer or a verified channel, and check a device's integrity before you ever enter a recovery phrase into it.