TL;DR:
Trezor issued a Safe 5 warning, strongly advising clients who bought hardware wallets via CryptoBilis starting in March 2026 to migrate their assets to a fresh device. This alert comes after a disclosure claimed a Safe 5 wallet housed a concealed cellular implant designed to intercept recovery phrases.
Hardware wallet maker Trezor has broadcasted a security alert to buyers who acquired its products through Southeast Asian reseller CryptoBilis, responding to claims of a suspected physical modification inside a Safe 5 wallet.
In a Friday blog post, the company stated that it obtained a responsible disclosure on October 28 detailing an extra circuit board purportedly built into the device. Trezor is urging impacted clients to transfer their digital assets to a newly created wallet instead of waiting for the company’s investigation to wrap up.
This advisory targets anyone who bought Trezor hardware wallets via CryptoBilis from March 2026 onward.
Alleged Cellular Implant Raises Concerns About Wallet Security
Based on the disclosure, the suspicious Safe 5 unit was bought on the Indonesian marketplace Tokopedia in August 2026. The reported tampering consisted of an extra circuit board placed right between the wallet’s main circuit board and its screen.
This added piece allegedly featured a cellular module and an antenna capable of reading data shown on the screen—potentially capturing the user’s recovery phrase—and broadcasting that stolen data across a mobile network.
That said, Trezor has not yet physically inspected the specific device in question. Its initial evaluation relies on a video interview conducted with the customer who uncovered the issue. Even without a direct laboratory review, the firm views the report as credible enough to trigger an immediate advisory.
“We’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor Chief Commercial Officer Danny Sanders said.
Trezor also verified that replacement units will be provided to customers who reach out to its support staff.
So far, the business has checked four other returned CryptoBilis devices and found no signs of manipulation in those units. No losses of customer funds linked to this reported Trezor incident have surfaced.
CryptoBilis Faces Scrutiny Following Ledger Incident
This new warning compounds existing security troubles facing CryptoBilis.
Earlier in October, Trezor dropped the vendor from its list of authorized distributors after reports emerged that modified Ledger hardware wallets were being sold through the same vendor.
Ledger previously verified that physical tampering took place on units distributed by CryptoBilis, while OneKey likewise cut ties with the reseller, halted new authorizations, and provided free replacements to buyers.
The financial impact tied to the Ledger breach could prove significant. Onchain experts estimate that upwards of $86 million in crypto assets was stolen across the Bitcoin, Ethereum, and Tron networks, though Ledger has not independently validated that total.
Hardware Wallet Supply Chains Become a Growing Security Concern
Trezor’s Safe 5 warning spotlights a wider vulnerability impacting digital asset investors: hardware wallet safety relies on more than just the internal device technology.
While cold storage tools aim to keep private keys completely offline, physical interference during the supply chain can create hazards that standard software defenses may fail to spot.
The necessity of safeguarding recovery phrases has also grown more urgent following past events involving crypto wallet phishing and supply-chain exploits. Bitcoinist previously covered a Ledger seed phrase scam aimed at hardware wallet users.
For the time being, Trezor’s advisory is purely precautionary, as the organization has not yet finished a physical review of the reported Safe 5 hardware. Even so, individuals who made purchases through CryptoBilis are being prompted to act quickly.
This event acts as another reminder that keeping digital currency secure demands vigilance regarding trusted purchase sources, device handling, and the protection of recovery phrases.
Written by
Yuki Yamamoto
