Essential Insights
- A reported tampered Trezor Safe 5 contains a cellular implant that reads and transmits the recovery phrase when powered on; lab confirmation is pending.
- Trezor warns buyers of CryptoBilis-supplied wallets since March 2026 to move funds to a new wallet with a new recovery phrase; restoring the old phrase is unsafe.
- Singapore police report at least two cases of Ledger wallets sold by some retailers containing implants capable of stealing recovery phrases or private keys.
Threat, Techniques, and Targets
A customer in Indonesia reported a suspected hardware implant in a Trezor Safe 5 bought from CryptoBilis. Trezor has not examined the device yet, but it considers the report credible enough to warn buyers.
According to the customer, an added circuit board sits between the wallet’s main board and screen. It includes a cellular module and antenna. The board reads the screen, captures the recovery phrase, and sends it over a mobile network when someone plugs in the wallet.
The warning covers every Trezor model that CryptoBilis supplied and sold from March 2026 onward, including devices from other stores and CryptoBilis’s Tokopedia store. As of October 30, Trezor had no reports of implants from other resellers.
Impact, Security Implications, and Remediation
A recovery phrase could give someone access to the funds in a wallet. However, Trezor has received no reports of lost funds from CryptoBilis buyers. The customer moved his funds before he found the circuit board. Trezor is arranging to examine the device in its lab.
Therefore, Trezor advises affected owners to move their funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old phrase on another device will not protect funds if the suspected implant already sent it out. If you lack another secure hardware wallet, use a trusted software wallet or exchange temporarily.
If you have not set up the device, do not set it up or enter an existing recovery phrase. Keep the device and contact Trezor Support. Trezor offers a replacement device or a voucher toward one. If you are unsure where you bought your device, check your receipt or contact Trezor Support. Do not open or weigh the device to check it.
Also, Trezor warns that scammers may use fake emails, letters, or calls to exploit the incident. Verify any messages through official Trezor channels.
Stay Ahead with the Latest Tech Trends
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
