Cryptocurrency hardware wallet maker Trezor has warned customers who purchased its devices through Southeast Asian reseller CryptoBilis to move their digital assets after receiving a report of a suspected malicious hardware implant inside a Trezor Safe 5 device.
The company said on October 30 that an Indonesian customer reported finding an additional circuit board inside a wallet purchased through the online marketplace Tokopedia in August. The reported component contained a cellular module and antenna that could capture the wallet’s recovery phrase and transmit it over a mobile network.
Trezor has not yet physically examined the specific device. However, it considers the report credible enough to issue a warning before laboratory confirmation.
Extra Circuit Board Allegedly Captured Wallet Recovery Phrase
The customer reported finding an unauthorised circuit board fitted between the wallet’s main board and its screen.
According to the information supplied to Trezor, the component could read information displayed on the screen, including the wallet’s recovery phrase, and send it to an external recipient through a cellular connection whenever the device was plugged in.
A recovery phrase is the set of words that allows users to restore access to their cryptocurrency wallets. Anyone who obtains it can potentially recreate the wallet on another device and transfer its funds without possessing the original hardware wallet.
Trezor said it had received photographs and a description of the suspected implant and had interviewed the customer through a video call. The device was being sent to the company’s laboratory for examination.
The customer had moved his funds before discovering the additional component. Trezor said no other CryptoBilis buyer had reported a loss of funds to the company as of October 30.
Warning Covers All Trezor Models Sold Through CryptoBilis
Trezor has advised customers who purchased any of its hardware wallet models supplied by CryptoBilis from March 2026 onwards to move their cryptocurrency to a newly created wallet with a completely new recovery phrase.
The warning also applies to devices sold by other retailers if CryptoBilis supplied the inventory.
Customers who have already used such a wallet should not simply restore their existing recovery phrase on another device. If the suspected implant captured the original phrase, transferring it to a different wallet would not remove the risk.
People who have not yet configured their devices should not set them up or enter an existing recovery phrase. Trezor has asked affected buyers to retain their devices and contact its support team for a replacement or a voucher covering a new device.
The company has also warned users against trying to identify tampering by weighing or opening their wallets. A difference in weight alone cannot reliably establish whether a device has been modified.
Earlier Ledger Incident Triggered Reseller Scrutiny
The warning follows a separate hardware tampering incident involving Ledger devices sold through the same reseller.
Ledger confirmed earlier in October that at least one affected hardware wallet contained an unauthorised component designed to capture users’ recovery phrases from the screen and transmit them over a mobile network.
The resulting investigation prompted Trezor to remove CryptoBilis from its authorised reseller network on October 9.
Trezor has since inspected four other devices purchased through the reseller, including Safe 5, Safe 7 and Safe 3 models. Those inspections found no evidence of tampering. The newly reported Safe 5 is a separate device that the company had not yet received for laboratory examination.
Trezor has not identified who may be responsible for the suspected implant or where the reported modification took place.
What This Means For Crypto Investors
The incident highlights a supply-chain risk that can affect hardware wallets even when the manufacturer’s software and internal systems have not been compromised.
Hardware wallets are designed to keep cryptocurrency recovery information away from internet-connected devices. But a physical component capable of reading the wallet’s display could bypass that protection by capturing sensitive information as it appears on the screen.
For investors, the warning underlines the importance of buying hardware wallets through verified distribution channels and treating recovery phrases as highly sensitive credentials.
Trezor has also cautioned that scammers may exploit the incident through fake emails, phone calls and messages claiming to offer technical support. Users should never disclose their recovery phrases to anyone, including people claiming to represent a wallet manufacturer.
