A hardware wallet is supposed to keep cryptocurrency keys away from internet-connected devices. But a new supply-chain security concern has raised questions about what happens when a wallet may have been physically modified before reaching its owner.

Trezor issued its warning on October 30 after an Indonesian customer reported finding an additional circuit board inside a Safe 5 device purchased through CryptoBilis. The manufacturer says it has reviewed photographs and spoken with the customer, but the reported device has not yet arrived at its laboratory for examination.

The distinction matters: the report is serious enough to trigger a precautionary warning, but the suspected implant and its capabilities have not yet been independently confirmed by Trezor.

What Was Reportedly Found Inside the Trezor Safe 5?

According to the customer's report, the device contained an extra circuit board positioned between its main board and screen. The board reportedly included a cellular module and an antenna.

The customer alleged that the added hardware could read information displayed on the wallet's screen, including its recovery phrase, and transmit that information over a mobile network when the device was connected to power. Trezor has not verified these alleged capabilities through a physical laboratory examination.

A recovery phrase is a series of words that can restore access to a cryptocurrency wallet. Anyone who obtains a valid phrase may be able to recreate the wallet on another compatible device and transfer its assets without possessing the original hardware wallet.

That makes the allegation significant. If a malicious component could capture a recovery phrase, the risk would extend beyond the device itself: the phrase could potentially expose the assets protected by that wallet.

However, the alleged mechanism should not be treated as a confirmed technical finding until the device has been examined and the investigation provides further evidence.

Who Needs to Take Action?

Trezor's warning applies to customers who purchased its hardware wallets through CryptoBilis from March 2026 onward. The reported device was a Safe 5 bought through the Indonesian e-commerce platform Tokopedia in August. The advisory covers the reseller's Trezor devices more broadly, rather than only that particular model.

Affected customers should not assume their device is safe simply because it looks normal or appears to work correctly. The reported concern involves hardware that may be installed inside the device, rather than a problem that necessarily produces obvious software warnings.

Trezor has also said that it has not received reports from CryptoBilis buyers of cryptocurrency losses connected to this incident. The company cannot independently see customers' wallet balances, so the absence of reports should not be interpreted as proof that every device is safe.

What Trezor recommends

Customers covered by the warning should follow the manufacturer's current guidance:

• If the wallet has already been used: Transfer funds to a newly created wallet with a new recovery phrase as soon as possible.
• Do not reuse the old recovery phrase: Creating another device with the same potentially exposed phrase does not eliminate the underlying risk.
• If the device has not been initialized: Do not set it up or use it until the issue has been addressed.
• Contact official Trezor support: Eligible customers can ask about a replacement device or voucher.
• Do not disclose your recovery phrase: A support representative should not need your secret recovery words to arrange assistance.

Before moving assets, users should verify the destination address carefully and make sure the new wallet and its recovery phrase are generated in a trusted environment. Anyone who is unsure how to move funds safely should consult the manufacturer's official guidance rather than follow instructions received through unsolicited messages.

These precautions are particularly important because security incidents can create opportunities for impersonation and phishing. A person claiming to offer a replacement or recovery service should never be given a wallet's recovery phrase.

Trezor Has Not Confirmed the Suspected Implant

Trezor said it considered the report credible after reviewing photographs and interviewing the customer by video. It nevertheless had not received the reported Safe 5 for laboratory testing when it issued the warning.

The company also reported inspecting four other devices purchased through CryptoBilis and finding no evidence of tampering in those units. Those inspections are relevant, but they do not establish whether the separately reported Safe 5 was modified or how widespread any potential issue might be.

The manufacturer removed CryptoBilis from its reseller network on October 9, after an investigation into devices sold through the same reseller raised concerns involving another hardware wallet brand.

The reported incident therefore remains under investigation. Important unanswered questions include whether the component was malicious, how it may have been installed, whether it could perform the alleged functions, and whether any other devices were affected.

Neither the identity of any person responsible nor the exact point in the supply chain where the suspected modification may have occurred has been established in the available reporting.

Why Hardware Wallet Security Depends on More Than Software

Hardware wallets are designed to reduce exposure to online threats by keeping sensitive cryptographic operations within a dedicated device. They can help protect users against many forms of malware and unauthorized access, but they cannot automatically eliminate every risk associated with manufacturing, distribution or physical tampering.

A device that has been altered before reaching its owner presents a different security challenge from an ordinary software vulnerability. Security checks that focus on firmware or counterfeit products may not necessarily identify every possible physical modification.

The CryptoBilis report highlights the importance of purchasing hardware wallets through trusted channels, checking a seller's authorization status and responding promptly when a manufacturer issues a specific security advisory.

At the same time, buyers should avoid assuming that every unit sold through a particular reseller has been compromised. The available evidence does not establish that conclusion, and Trezor has reported finding no signs of tampering in four other devices it inspected.

The practical response is to follow the warning if the purchase falls within its stated scope, rather than trying to determine the device's safety through appearance alone.

A Wider Warning for the Crypto Hardware Supply Chain

The Trezor advisory follows a separate hardware-tampering investigation involving Ledger devices sold through CryptoBilis. Ledger has reported finding a physical implant in a device connected to that case, making supply-chain security a wider concern for hardware wallet manufacturers and their customers. The two investigations should not automatically be treated as the same incident, however.

The broader issue is that a wallet's security depends on the integrity of the device users receive, not just the security claims associated with its brand. Manufacturers and distributors may need to strengthen reseller oversight, inspection procedures and processes for investigating suspicious devices.

For users, the immediate lesson is straightforward: a hardware wallet can reduce certain risks, but it is not a guarantee against every possible attack. When a manufacturer issues a targeted warning, users should take it seriously while distinguishing confirmed findings from allegations that are still being tested.

What Happens Next?

The next major development will be Trezor's physical examination of the reported Safe 5. Laboratory testing could help establish whether an additional component is present, what it can do and whether the customer's description matches the device's actual construction.

Until that examination is completed and further findings are published, the suspected implant should be described as unconfirmed. The precautionary warning remains important for affected buyers, but the available information does not establish that CryptoBilis buyers generally have lost funds or that every device sold through the reseller was altered.

Customers who purchased a Trezor device through CryptoBilis from March 2026 onward should consult Trezor's official advisory and contact its support team for the latest instructions.

Frequently Asked Questions

1. Did Trezor confirm that a Safe 5 contained a malicious implant?

No. A customer reported a suspected implant, and Trezor said it considered the report credible. The company had not yet received the device for laboratory examination when it issued its warning.

2. Which Trezor customers are covered by the warning?

The warning covers customers who bought Trezor hardware wallets through CryptoBilis from March 2026 onward.

3. What should affected users do with their cryptocurrency?

Trezor recommends moving funds to a newly created wallet with a new recovery phrase. Users should consult the manufacturer's current guidance and avoid reusing a potentially exposed phrase.

4. Have customers reported losing cryptocurrency in this incident?

Trezor said it had not received reports of losses from CryptoBilis buyers connected to this case. That does not independently prove that every affected device is safe.

5. Is this the same incident as the Ledger hardware-wallet case?

The reports involve the same reseller, but they are separate investigations. Ledger has reported a confirmed hardware implant in its case, while the alleged implant in the Trezor Safe 5 had not yet been confirmed by laboratory testing.

6. Where can affected buyers seek assistance?

Customers should contact Trezor through its official website and follow the instructions in its security advisory. They should never share their recovery phrase with anyone claiming to provide support.

---

Sources

• TokenPost — Trezor Urges CryptoBilis Wallet Buyers to Move Funds After Implant Report
• Decrypt — Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5
• BleepingComputer — Trezor Warns of Suspected Crypto-Theft Implant in Hardware Wallet

Disclaimer: This article is for informational purposes only and is not financial or investment advice. The reported implant and its alleged capabilities remain unconfirmed pending examination of the device. Readers should consult official manufacturer guidance before taking action.