Trezor, one of the best-known names in hardware wallets, is urging customers who bought its devices from former authorized reseller CryptoBilis since March to move their funds immediately, after a customer reported a suspected hardware implant inside a Trezor Safe 5.
The warning, published Friday, marks a sobering moment for the hardware wallet industry. The entire premise of a hardware wallet is that the device physically isolates your private keys from the internet. Now security researchers and manufacturers are confronting the possibility that the supply chain itself, the channel between the factory and your front door, can compromise that promise.
What was found
According to Trezor, a customer in Indonesia reported an unauthorized circuit board inside a Trezor Safe 5 bought on Tokopedia in August. The suspected implant could capture information displayed on the device’s screen, including the wallet recovery phrase, and transmit it over a cellular network.
That detail deserves attention. The implant does not need to modify the wallet’s software or steal keys directly. It simply reads the screen. When you set up a hardware wallet, the device displays your recovery seed, the master backup of your entire crypto holdings, so you can write it down. An implant that photographs that moment owns your wallet forever, no hacking required afterward.
Trezor said it has not yet examined the device and has received no reports of related losses. “We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” chief commercial officer Danny Sanders told Cointelegraph.
Part of a wider pattern
This is not an isolated incident. On October 9, reports surfaced of crypto losses involving Ledger wallets sold through the same reseller, CryptoBilis. Ledger confirmed an unauthorized hardware implant in one device, with losses that may exceed 86 million USD according to some estimates. Singapore police separately reported that tampered Ledger wallets cost users in the country 2.7 million USD.
The thread goes back further. Security researcher Joe Grand said he alerted Trezor in August about tampered Trezor One and Model T wallets bought through unauthorized sellers on TikTok and Facebook. Trezor responded at the time that its setup checks targeted counterfeit devices and modified firmware, while the implant found in a CryptoBilis-sold Ledger read the screen without changing the firmware at all. That distinction is exactly what makes this class of attack so difficult: nothing about the wallet’s software looks wrong, because nothing about the software was touched.
Trezor has taken steps in response, announcing plans on October 13 to reduce its reseller network. A spokesperson described sales through the reseller as “very small” but declined to provide figures, and said the company has not established where the suspected tampering occurred, acknowledging that existing safeguards including seals and packaging are not sufficient on their own.
What to do if this might be you
If you bought a Trezor from CryptoBilis since March, or a Ledger from the same seller, the advice is simple and urgent: move your funds now. Do not wait for confirmation of the implant. Create a fresh wallet on a device you trust, bought directly from the manufacturer, and transfer your holdings to new addresses generated by that device. Treat the recovery phrase of the old device as burned.
For everyone else, the guidance is broader. Buy hardware wallets only directly from the manufacturer or from the short list of currently authorized resellers published on the manufacturer’s own site, not from a marketplace listing, a social media shop, or a third-party seller with a suspicious discount. Be suspicious of any sealed box that looks repackaged. And whenever possible, regenerate your seed on a device you are confident in before loading it with meaningful holdings.
The uncomfortable lesson
For years, the standard advice in crypto has been: not your keys, not your coins, and the safest keys live on hardware. That advice is still correct. The Binance hack, with billions stolen from the largest centralized exchange in the world, is a vivid reminder of why self-custody matters. But the CryptoBilis saga shows that self-custody has its own supply chain, and that chain is only as trustworthy as its weakest link.
Hardware wallets remain one of the best tools available for protecting crypto holdings. The flaw is not the technology, it is the route the device takes to reach you. Buy from the source, verify everything, and never assume that a shrink-wrapped box is proof of integrity. The few extra dollars spent buying direct are the cheapest insurance in crypto.
an implant that reads the screen and beams the seed phrase over cellular is nightmare fuel. bought my Safe 5 direct and im still checking the seals
worse than the fake ledger devices. this one came through a former authorized reseller, so even careful buyers got hit
rule never changes, buy hardware wallets straight from the manufacturer. that Tokopedia discount costs you the whole stack
bought my Safe 5 from CryptoBilis in April. funds moved before i even finished reading the headline
april purchase here too. swept to a different brand device with a fresh seed. not waiting on a lab report to tell me what the cellular radio already knows
same boat, april order. moved to a different brand entirely, not just a new trezor. if that channel was compromised once im not trusting the next sealed box from the same region
What bothers me is the window. Former authorized reseller means buyers who did everything right still got tampered units. If you bought a Safe 5 since March, move the coins today and ask questions later. Waiting for Trezor to confirm is how you become the first confirmed loss.
since march is the part that stings. people who checked the hologram and bought from a listed reseller are still in the maybe pile tonight
an implant that reads the screen and beams the seed over cellular. firmware untouched. my paranoia budget just doubled
mine tripled. bought direct in may and im still moving everything to a fresh device tonight because why gamble on a tamper window nobody can rule out
the cellular part is what gets me. no wifi, no usb, nothing to airgap. it just quietly phones home from inside a sealed box
and a faraday bag kills the radio but not the implant reading your screen. only full migration to new hardware actually closes this one
fresh hardware only helps if it doesn’t ship through the same channel. buying factory direct and still x-raying the device sounds paranoid but here we are
the faraday bag is beside the point, the screen is the leak not the radio. fresh hardware from the vendor shop and never type a seed near anything a reseller shipped
same. and the scariest part is trezor still hasnt even examined the thing. one report from indonesia, no confirmed losses yet, and every Safe 5 sold through CryptoBilis since march is a maybe
trezor has not even examined the unit so the maybe pile is everyone. new device from the shop, new words, one test send. the implant reads the screen so reseeding on it solves nothing
exactly, seals and packaging were never going to catch this. buying straight from the manufacturer is the only real fix
sending to a fresh wallet on a NEW device from trezor direct. not redoing the seed on anything that touched that reseller chain
86M gone from the ledger implants via the same reseller and people are still buying wallets off tokopedia. spend the extra 20 bucks, buy direct
buying direct helps but the indonesia unit came through a former authorized channel. reseller vetting was the actual failure point
a cellular radio inside the case means no airgap survives the supply chain. xray the device or accept the risk, those are the options now
who is really x-raying an 80 dollar wallet though. factory direct plus a test transaction is the realistic ceiling for most buyers, everything past that is cosplay
realistic ceiling is exactly it. fresh device from the vendor, small test send, done in an hour. no shame in skipping the airport xray cosplay
^ this. the realistic fix is vendor direct plus an actual tamper seal check, everything past that is security theater for an 80 dollar device
bought direct from the trezor shop in june and still reseeded this morning. probably nothing, but a cellular radio reading my seed words for free is not a risk im willing to price
one detail nobody flags: trezor calling the report credible sight unseen is the right move but it also means every Safe 5 sold in asia stays suspect until they say how many units CryptoBilis actually moved