Key facts
- The suspected hardware implant allegedly contains a cellular module and antenna designed to capture the recovery phrase displayed on the wallet’s screen and send it via mobile network when the device is powered on.
- Singapore Police reported on October 28, 2026, that at least two tampered Ledger wallets sold in Singapore resulted in combined losses of approximately S$3.5 million.
- Trezor advises customers not to open, weigh, or attempt to inspect devices themselves for tampering, as weight differences are inconclusive.
- Trezor offers eligible customers a replacement device or voucher for a new wallet, provided they retain the suspected device and contact support.
Trezor warned customers on Oct. 30, 2026, that Trezor Safe 5 hardware wallets bought from reseller CryptoBilis since March 2026 may contain a malicious circuit board implant. The report came from an Indonesian customer who bought a device from CryptoBilis through Tokopedia in August 2026; Trezor said it considers the report credible even though it has not physically examined the wallet.
The suspected implant allegedly contains a cellular module and antenna that captures the recovery phrase shown on the wallet’s screen and sends it over a mobile network when powered on, with the extra circuit board between the main board and the screen. Trezor has not confirmed that the Safe 5 implant works like the implants found in Ledger devices, nor established whether the same group is behind both incidents or how the tampering occurred; investigations are ongoing. Trezor’s setup checks target counterfeit devices and modified firmware, so this screen-reading method would evade them.
Trezor removed CryptoBilis from its authorized reseller network on Oct. 9, 2026, after Ledger reported tampered devices sold through the same reseller; Ledger suspended sales and shipments through CryptoBilis that day after investigating reports of missing funds. OneKey terminated CryptoBilis’ authorization on Oct. 12, 2026, and offered free replacements for all devices purchased from the reseller starting March 1, 2026. Singapore Police reported on Oct. 28, 2026, that at least two tampered Ledger wallets sold in Singapore produced combined losses of approximately S$3.5 million.
Trezor’s warning covers every Trezor model bought from CryptoBilis since March 2026, not only the Safe 5, because similar tampering could exist across the product line. The company inspected four other devices from the reseller — two Safe 5 units, one Safe 3, and one Safe 7 — and found no signs of tampering, leaving only the reported Safe 5 unexamined.
Trezor described sales through CryptoBilis as small but gave no exact figures, and it has received no reports of stolen funds tied to the suspected implant; the customer who reported the issue had already moved assets, and losses may go unreported because Trezor cannot see customer wallet contents.
Trezor advised all buyers of any Trezor model from CryptoBilis since March 2026 to move funds immediately to a new wallet with a new recovery phrase, and it offers eligible customers a replacement device or voucher if they keep the suspected device and contact support with proof of purchase. Customers should not open, weigh, or inspect devices themselves because weight differences are inconclusive and physical inspection can damage evidence or the device.
Those without another secure hardware wallet may temporarily use a trusted software wallet or exchange after verifying the full receiving address. Trezor warned of phishing scams using fake e-mails, letters, or phone calls seeking recovery phrases, and said legitimate support never asks for a recovery phrase, PIN, or private keys.
Trezor’s chief commercial officer, Danny Sanders, announced on Oct. 30, 2026, that the company issued the warning before finishing its lab analysis, preferring to alert customers now rather than risk potential fund losses while waiting for definitive proof. Trezor considers the customer’s report credible even though it has not physically examined the device.
Security researcher Joe Grand alerted Trezor in August 2026 about tampered Trezor One and Model T wallets bought from unauthorized sellers on TikTok and Facebook, a separate episode from the CryptoBilis incident. Trezor acknowledged that existing safeguards, including seals and packaging, are insufficient to prevent supply-chain hardware attacks, and the company is reviewing hardware protections. Trezor announced on Oct. 13, 2026, plans to restructure and tighten its global reseller network to improve security.
Hardware wallets store cryptocurrency private keys securely and authorize transactions, making physical device integrity essential for protecting digital assets. Supply-chain attacks compromise that model by tampering with devices after they leave the manufacturer but before they reach the customer, and recovery phrases let users restore wallet access without the original hardware, which makes them a prime target for attackers.
Join the discussion