Trezor warns of suspected Safe 5 hardware implant tied to CryptoBilis sales

Traders Union
All News
Crypto
Trezor warns Safe 5 buyers

Highlights

Trezor warns customers who purchased hardware wallets from CryptoBilis since March 2026 to migrate funds due to suspected Safe 5 device tampering involving an extra circuit board.
Trezor's inspection of four devices from CryptoBilis showed no tampering, but past physical tampering with Ledger signers at CryptoBilis led to estimated $86 million losses across Bitcoin, Ethereum and Tron.
Earlier security incidents saw an August ShipMonk breach exposing 13,700 customer records and a subsequent incident affecting 67,000 U.S. customers, alongside email provider phishing risks disclosed in September.

Tampering alert prompts customer migration

As reported by The Block, citing Trezor in a blog post published Friday, the company received a responsible disclosure on Oct. 28 about a Safe 5 device bought through Tokopedia and sold by CryptoBilis. The Czech hardware wallet maker says it has not yet received the device for a full examination, but after interviewing the customer by video call it is treating the report as credible.

Trezor says the alleged implant is an extra circuit board placed between the main board and the screen. The component reportedly includes a cellular module and antenna that can read information shown on the display, including a wallet recovery phrase, and transmit it over a mobile network.

The company says customers who purchased Trezor hardware wallets from CryptoBilis since March 2026 should migrate funds to a new wallet and contact support for a replacement device. Chief commercial officer Danny Sanders says the company prefers to warn users before confirmation if there is a risk that funds could be lost.

Broader wallet security pressure grows

Trezor says it began inspecting devices bought from the reseller after removing CryptoBilis from its network. It has received four customer devices for examination so far and says it has found no signs of tampering in those units.

The case adds to wider pressure on crypto wallet vendors over supply-chain security. Ledger previously confirmed physical tampering in signers sold through CryptoBilis, while OneKey also cut ties with the reseller, froze new approvals and offered free replacements. No loss of user funds has been reported in Trezor's case, although onchain analysts estimated losses linked to the Ledger incident at more than $86 million across Bitcoin, Ethereum and Tron, figures Ledger has not confirmed.

Trezor is also dealing with other security issues this year. In August, a breach at shipping provider ShipMonk exposed personal data for about 13,700 customers, and in September the company disclosed that another roughly 67,000 U.S. customers were affected by the same breach. In the same month, Trezor also said a breach at its third-party email provider enabled phishing messages to be sent from the company's official domain.

Cybersecurity and privacy startups drew strong investor demand in Q3 2026, with total funding climbing to $6.8 billion even as the number of deals declined. Our earlier report highlighted that capital was increasingly concentrated in larger late-stage rounds—especially across AI-driven and identity-security companies—alongside ongoing consolidation through major acquisitions as firms ramp up defenses against evolving threats.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.