Trezor issued a security warning on October 30, 2026, after receiving a report of a suspected malicious hardware implant in a Trezor Safe 5 wallet purchased from former reseller CryptoBilis. The modified device allegedly uses an extra circuit board with a cellular module to transmit recovery phrases over mobile networks. The alert follows a $93 million supply chain attack affecting rival manufacturer Ledger, which was also linked to CryptoBilis. Trezor urges users who bought devices from CryptoBilis since March 2026 to transfer their assets to fresh wallets immediately.
Trezor Safe 5 hardware implant
- ▪Trezor reported on October 30, 2026, that it received a customer report regarding a suspected malicious hardware implant in a Trezor Safe 5 wallet purchased from reseller CryptoBilis.
- ▪An Indonesian user reported finding an extra circuit board with a cellular module and antenna between the screen and main board of a Trezor Safe 5 bought from CryptoBilis via Tokopedia in August 2026.
- ▪The reported hardware implant inside the Trezor Safe 5 allegedly reads information displayed on the screen, including the recovery phrase, and transmits it over a mobile network when plugged into power.
- ▪Trezor stated that device weight is not a reliable method for customers to determine if a Trezor hardware wallet has been tampered with.
- ▪Trezor stated on October 30, 2026, that it treats the hardware implant report as credible while arranging to examine the affected Trezor Safe 5 device in its laboratory.
- ▪Trezor confirmed that as of October 30, 2026, no customer funds have been reported stolen in connection with the suspected Trezor Safe 5 compromise.
CryptoBilis reseller supply chain attack
- ▪Trezor warned customers that scammers may attempt to use news of the CryptoBilis implant incident to conduct phishing attacks via email, letters, and phone calls.
- ▪Trezor revoked authorization for Malaysia-based reseller CryptoBilis
- ▪Trezor stated that four other CryptoBilis-sourced Trezor hardware wallets examined by the company showed no evidence of physical tampering.
Customer device replacement program
- ▪Trezor is offering replacement devices shipped directly by the company or vouchers for a new wallet to customers who purchased Trezor devices through CryptoBilis.
- ▪Trezor advised all customers who purchased devices from CryptoBilis since March 2026 to immediately transfer their cryptocurrency to a new wallet with a fresh recovery phrase.
- ▪Trezor advised users who have not yet initialized devices purchased from CryptoBilis to refrain from setting them up or entering existing recovery phrases into them.
Ledger security incident connection
- ▪The Singapore Police Force issued a public advisory on October 28, 2026, regarding tampered Ledger hardware wallets carrying malicious components that resulted in $3.5 million in reported losses.
- ▪Hardware wallet manufacturer Ledger launched an investigation into physically modified devices distributed through reseller CryptoBilis
- ▪Ledger asked authorized resellers and distributors across Malaysia, Indonesia, Singapore, Thailand, Philippines, Vietnam, and Hong Kong to halt device sales following supply chain security compromises.
- ▪Estimated cryptocurrency losses resulting from compromised Ledger hardware wallets distributed through reseller CryptoBilis reached $93 million.
Reseller network restructuring
- ▪Trezor stated on October 30, 2026, that it is currently reviewing its active reseller relationships across Asia following supply chain compromises.
- ▪Trezor announced plans to significantly reduce and restructure its global authorized reseller network beginning January 1, 2027, to strengthen supply chain control.
Story comments
Loading comments…