FHN 
Trezor has issued a security warning after a customer reported a suspected hardware implant inside a Trezor Safe 5 crypto wallet. The added component may be capable of capturing recovery phrases displayed on the device and sending them through a mobile network.
The warning applies as a precaution to Trezor devices purchased through CryptoBilis from March 2026 onward. So far, the company has received a report involving only one suspected device.
In its October 30, 2026 security notice, Trezor advised potentially affected customers to create a completely new wallet with a fresh recovery phrase and move their funds. The company has not yet examined the reported device, and no stolen funds have been reported by CryptoBilis customers.
The March 2026 date is a precautionary measure. It does not mean that every device sold during this period has been tampered with.
How the Suspected Hardware Implant Works
The incident was reported by a customer in Indonesia who purchased a Trezor Safe 5 through CryptoBilis on Tokopedia in August 2026.
According to the customer’s report, an additional circuit board was installed between the wallet’s main board and its screen. The component reportedly contains a cellular module and antenna.
This hardware may be able to capture information displayed on the wallet screen, including recovery phrases, and transmit that information over a mobile network when the device is connected to power.
If confirmed, this would create a serious security risk. Anyone who obtains a wallet’s recovery phrase could potentially restore it on another device and gain control of the funds.
Trezor reviewed photographs and spoke with the customer over a video call. The device is now being sent to the company’s security laboratory for further investigation. Until testing is complete, the reported implant’s capabilities have not been independently confirmed.
The incident also highlights a wider risk involving counterfeit or physically modified crypto hardware. In another case, fake crypto wallet screens were reportedly used to trick users into revealing their recovery phrases.
Connection to the Ledger Hardware Incident
This warning follows a separate investigation involving Ledger devices sold through the same reseller.
Ledger reportedly began investigating customer fund losses on October 9 and later confirmed physical tampering in some devices. Trezor removed CryptoBilis from its authorized reseller network on the same date.
However, Trezor has not confirmed whether the incidents involve the same attackers or a connected operation. The company is working with Ledger and other security teams to investigate the matter.
The customer who reported the suspected Trezor implant had already transferred their funds before discovering the issue. Trezor says it has not received similar reports involving devices purchased from other resellers.
What Trezor Users Should Do Now
Trezor recommends that customers who purchased devices through CryptoBilis from March 2026 onward take precautions.
- Create a completely new wallet with a freshly generated recovery phrase.
- Transfer all funds from the existing wallet to the new one.
- Do not reuse the old recovery phrase on another device.
- If the device has not been set up, do not use it or enter an existing recovery phrase.
- Contact official Trezor Support to check replacement options.
Simply restoring an existing wallet on another device is not enough because the old recovery phrase may already be exposed.
Trezor also advises users not to open or weigh their devices to check for tampering. These methods cannot reliably identify a modified wallet.
Eligible customers can contact Trezor Support for a replacement device or a voucher. They should keep their original device for investigation.
Important: Never share your recovery phrase with anyone, including someone claiming to be from Trezor Support. The company will never ask users to provide their recovery words.
The incident is a reminder that crypto security depends on more than software protection. Buying hardware wallets from trusted sources and protecting recovery phrases are equally important.
About the Author
