- Messages
- 96
- Likes
- 10
- Points
- 8
Hardware crypto wallet manufacturer Trezor is investigating a possible supply chain attack. An additional circuit board was discovered inside a Trezor Safe 5 device purchased from reseller CryptoBilis. This circuit board could allegedly intercept the wallet's seed phrase and transmit it over a mobile network.
The suspicious device was reported by a user in Indonesia on October 28, 2026. The user purchased the Safe 5 wallet through the CryptoBilis store on the Tokopedia marketplace in August 2026 and later opened the device to find an additional, apparently non-standard circuit board inside the casing, containing a cellular module and antenna. Judging by photographs and the user's description, the discovered implant could read information displayed on the device's screen, including the seed phrase, and then transmit it over a mobile network when the wallet was connected to a USB-C port.
Trezor specialists report that they have examined photographs of the device and spoken with its owner via video link, but the wallet itself is still en route to the company's lab. Therefore, experts have yet to definitively confirm the presence and capabilities of the implant found. However, Trezor emphasizes that they have deemed this report credible enough to not wait for the results of the investigation and now recommends that anyone who purchased a Trezor device from CryptoBilis in March 2026 or later transfer their funds to a new wallet with a new seed phrase as soon as possible. If the wallet was indeed compromised, transferring the old seed phrase to another device is pointless: the implant could have already intercepted it and transmitted it to the attackers. Therefore, Trezor recommends creating a new wallet with a new seed phrase and transferring funds to it. If another hardware wallet is unavailable, a trusted software wallet or exchange can be used temporarily. Experts also advise against using or configuring new devices purchased through CryptoBilis, and especially against entering the seed phrase into them. Owners of such wallets can contact Trezor support, who will provide them with a replacement or a voucher for a new device. However, they do not recommend independently detecting the presence of an implant by weight or opening the Trezor wallet. The company noted that it has not yet received reports of theft of funds from CryptoBilis customers, nor have they encountered similar cases of implants at other resellers. As a reminder, CryptoBilis was recently involved in a similar story involving Ledger wallets. Following a series of reports of cryptocurrency thefts, Ledger specialists confirmed that at least one wallet contained an unauthorized hardware modification to intercept the seed phrase. Trezor reports that the circuit board found in their case appears similar and likely operates on the same principle.
Amid the ongoing Ledger investigation, Trezor ceased sales through CryptoBilis and removed the company from its list of authorized sellers back in October 2026, and also announced that it would review its entire global reseller network.
The suspicious device was reported by a user in Indonesia on October 28, 2026. The user purchased the Safe 5 wallet through the CryptoBilis store on the Tokopedia marketplace in August 2026 and later opened the device to find an additional, apparently non-standard circuit board inside the casing, containing a cellular module and antenna. Judging by photographs and the user's description, the discovered implant could read information displayed on the device's screen, including the seed phrase, and then transmit it over a mobile network when the wallet was connected to a USB-C port.
Trezor specialists report that they have examined photographs of the device and spoken with its owner via video link, but the wallet itself is still en route to the company's lab. Therefore, experts have yet to definitively confirm the presence and capabilities of the implant found. However, Trezor emphasizes that they have deemed this report credible enough to not wait for the results of the investigation and now recommends that anyone who purchased a Trezor device from CryptoBilis in March 2026 or later transfer their funds to a new wallet with a new seed phrase as soon as possible. If the wallet was indeed compromised, transferring the old seed phrase to another device is pointless: the implant could have already intercepted it and transmitted it to the attackers. Therefore, Trezor recommends creating a new wallet with a new seed phrase and transferring funds to it. If another hardware wallet is unavailable, a trusted software wallet or exchange can be used temporarily. Experts also advise against using or configuring new devices purchased through CryptoBilis, and especially against entering the seed phrase into them. Owners of such wallets can contact Trezor support, who will provide them with a replacement or a voucher for a new device. However, they do not recommend independently detecting the presence of an implant by weight or opening the Trezor wallet. The company noted that it has not yet received reports of theft of funds from CryptoBilis customers, nor have they encountered similar cases of implants at other resellers. As a reminder, CryptoBilis was recently involved in a similar story involving Ledger wallets. Following a series of reports of cryptocurrency thefts, Ledger specialists confirmed that at least one wallet contained an unauthorized hardware modification to intercept the seed phrase. Trezor reports that the circuit board found in their case appears similar and likely operates on the same principle.
Amid the ongoing Ledger investigation, Trezor ceased sales through CryptoBilis and removed the company from its list of authorized sellers back in October 2026, and also announced that it would review its entire global reseller network.