Trezor warns of possible seed-stealing hardware wallet implant

Last updated: November 3, 2026

Trezor has warned that a Safe 5 hardware wallet sold by CryptoBilis may contain concealed hardware capable of stealing the owner’s recovery phrase. Its advisory covers Trezor purchases from CryptoBilis made from March 2026 onward, including orders fulfilled through Tokopedia and other stores supplied by the reseller.

The alert is precautionary. Trezor has not yet examined the reported device, but is advising covered buyers to move any funds into a newly created wallet, generate a fresh seed and preserve the suspect unit for investigation.

The warning, and what prompted it

An Indonesian buyer contacted Trezor through its responsible disclosure program on October 28. He had purchased the Safe 5 during August from a CryptoBilis storefront on Tokopedia and gave the company a video interview describing what he had discovered.

According to his account, an additional slim board had been fitted beneath the screen and above the wallet’s primary circuitry. It included a cellular module and antenna. The board could capture information displayed on the screen, including a wallet backup, and send that information through a mobile connection whenever the device was plugged in.

Trezor had not obtained the unit when it issued the warning. Nevertheless, it accepted the customer’s account as credible and chose to notify buyers rather than delay. The company said that postponing action until laboratory verification was finished would unnecessarily expose CryptoBilis customers.

The person responsible remains unidentified. At the time of the warning, no additional CryptoBilis customer had told Trezor that cryptocurrency was stolen. The Indonesian buyer who discovered the board had already withdrawn his funds.

The advisory follows separate reports involving compromised Ledger devices in Southeast Asia. Ledger said every confirmed case involved hardware purchased from CryptoBilis, with one wallet containing unauthorized added circuitry. Researchers tracking the on-chain activity estimated the resulting losses at more than $93 million.

Trezor stopped working with CryptoBilis on October 9 and subsequently reduced the number of resellers in its network. A Trezor community specialist also said the company planned to strengthen the security reviews applied to resellers.

Why it matters

A recovery phrase provides everything needed to recreate a cryptocurrency wallet and control its private keys. If an attacker obtains that phrase, owning the original hardware offers no protection: the attacker can restore the wallet elsewhere and transfer the funds without needing the physical device.

The distinction between an inspected device and an unverified customer report is important. Trezor has not established that every wallet covered by its advisory contains added hardware, and it has not identified who installed the reported board. Even so, warning buyers before the laboratory review was completed was a sensible way to reduce the potential exposure.

The case also exposes a weakness that occurs before a customer begins using the wallet. A legitimate hardware wallet cannot protect a seed entered on a device whose internal components have already been tampered with. Purchase records, seller names and the provenance of the device remain relevant parts of wallet security.

The risk could also spread through ordinary impersonation scams. Trezor expects fraudsters to use the warning as the basis for fake emails, physical letters and phone calls. These approaches may claim to assess a suspected device but instead try to collect the seed through a fraudulent website or a supposed support agent.

Is your purchase covered? A decision checklist

Affected buyers should take these steps:

• Review the purchase date. The advisory applies to CryptoBilis purchases made from March 2026 onward.
• Confirm the seller. Coverage includes direct orders, Tokopedia purchases and orders through other shops supplied by CryptoBilis.
• If the seller’s identity is unclear, check the receipt or ask Trezor Support.
• For a wallet that has been used, create a fresh wallet and seed, then transfer the balance as soon as possible.
• For an unused wallet, avoid setup and never enter a recovery phrase.
• Contact Trezor about a replacement device or voucher while retaining the CryptoBilis unit.
• Leave the suspect wallet closed and intact. There is no reliable user-level inspection method, and small changes in weight can have innocent explanations.

This guidance extends to every Trezor model sold through CryptoBilis during the covered period, even though the reported case involved a Safe 5.

What affected buyers should do now

Trezor’s main instruction is to place funds into a new wallet with a different seed. If another secure hardware wallet is unavailable, users may temporarily use a software wallet or an exchange they already know. They should inspect the complete destination address before authorizing a transfer.

Copying the previous backup onto different hardware will not remove the danger. If the original seed was observed or transmitted, the same backup can recreate the compromised wallet on another device.

Affected owners should preserve the suspect product and contact Trezor about a replacement or voucher. Trezor specifically advises against opening the wallet or checking it by weight. These steps could damage evidence, and buyers have no dependable way to determine whether concealed hardware is present.

Treatment of follow-up communications matters as much as the device response. Messages impersonating Trezor may emerge in the wake of the warning. The company states that its support team will never request a wallet backup, so a seed should never be disclosed to another person or submitted to a website.

What to watch next

Laboratory testing of the Safe 5 is the clearest next milestone. Trezor’s findings may establish how the added circuitry worked, whether additional units were altered and how the compromised product moved through the reseller network. Stronger reseller checks will show whether distribution controls are changing in response.

For customers, the key rule is immediate and uncomplicated: treat every request for a recovery phrase as an attempted theft. Use Trezor’s official support channel when seeking assistance rather than responding to unsolicited contact.

Key takeaways

• Move funds from any covered CryptoBilis Trezor into a newly generated wallet with a fresh seed.
• Never enter the old recovery phrase on the suspect device or share it with anyone.
• Contact Trezor for a replacement or voucher, and preserve the original unit.
• Expect phishing attempts disguised as security checks or support outreach.