Key takeaways
- Trezor investigates suspected cellular implant inside Safe 5
- Customers of CryptoBilis urged to move cryptocurrency
- Reported device compromise remains unconfirmed by laboratory testing
Hardware wallet manufacturer Trezor has issued an urgent security warning after a customer in Indonesia reported finding a suspected surveillance implant inside a Trezor Safe 5 device that could potentially steal cryptocurrency recovery phrases over a mobile network.
In its October 30 security advisory, Trezor said the device was purchased from former authorized reseller CryptoBilis through Indonesian marketplace Tokopedia in August 2026.
Trezor Safe 5 Reportedly Contained Hidden Cellular Hardware
The discovery was reported to Trezor's security team on October 28 through its responsible disclosure program.
According to the customer, an additional circuit board had been installed between the Safe 5's main board and its display. The board reportedly contained a cellular communication module and an antenna.
The suspected implant appeared capable of capturing information displayed on the wallet's screen, including its recovery phrase, and transmitting that information over a mobile connection when the device was connected to power.
If confirmed, the attack could bypass an important security assumption behind hardware wallets without breaking their underlying cryptography.
A recovery phrase can be used to recreate a cryptocurrency wallet on another device, allowing someone who obtains it to authorize transactions without possessing the original hardware.
However, Trezor emphasized that the reported device has not yet undergone independent laboratory examination.
The company reviewed photographs and interviewed the customer by video before deciding to issue its warning.
No CryptoBilis customer has reported losing funds to Trezor in connection with the suspected implant.
Same Reseller Linked to Earlier Ledger Wallet Attack
The warning follows a confirmed hardware-tampering incident involving Ledger devices distributed through CryptoBilis.
Earlier in October, Ledger identified unauthorized hardware capable of capturing recovery phrases displayed during wallet setup.
As Coinpaper reported, Ledger subsequently halted wallet sales across several Southeast Asian markets while investigating the compromised distribution chain.
Independent investigators also tracked substantial cryptocurrency losses associated with the earlier incident.
Coinpaper's theft investigation detailed estimates approaching $93 million, although the full amount attributable to compromised hardware remains uncertain.
Trezor removed CryptoBilis from its authorized reseller network on October 9, before receiving the Safe 5 report.
The company has since inspected four other wallets obtained through the reseller, including two Safe 5 devices, without identifying evidence of tampering.
However, the findings do not establish where the reported Safe 5 modification occurred or whether the incidents involved the same perpetrators.
What Should Trezor Wallet Owners Do?
Trezor's warning specifically applies to customers who purchased any of its hardware wallet models through CryptoBilis from March 2026 onward.
Affected owners who have already initialized their devices should transfer cryptocurrency to a newly created wallet using a completely new recovery phrase.
Simply importing the original recovery phrase into another device would not eliminate the potential exposure because an attacker might already possess the compromised credentials.
Customers who have not initialized their devices should avoid setting them up or entering existing wallet backups.
Trezor is offering eligible CryptoBilis customers replacement devices or vouchers through its official support channels.
The company also cautioned against trying to identify tampered wallets by weighing them, noting that weight differences cannot reliably establish whether unauthorized hardware is present.
The warning comes amid broader concerns about hardware wallet security.
Coinpaper previously covered a SecuX phishing alert, while its hardware wallet security guide examined how different attacks can compromise cryptocurrency holdings.
