Summary
- A customer reported an additional circuit board inside a Trezor Safe 5.
- Trezor has not physically examined the device and has received no reports of related fund losses.
- Customers who purchased through CryptoBilis since March have been advised to migrate their funds.
Czech hardware wallet manufacturer Trezor has warned customers who bought devices through former reseller CryptoBilis after receiving a credible report of a suspected hardware implant inside a Trezor Safe 5. The company is examining whether an unauthorised component could intercept information presented on the device.
The report originated with a customer in Indonesia who bought a wallet through the Tokopedia marketplace in August 2026. The customer subsequently found what appeared to be an extra circuit board between the main electronics and the display, raising concerns that the physical hardware had been modified before reaching the purchaser.
The component was described as incorporating a cellular communications module and antenna. The alleged purpose was to observe information displayed during the wallet’s setup and transmit sensitive recovery information to an external recipient. Those functions remain an allegation until the hardware can be independently inspected and tested.
Trezor said on 30 October that it had reviewed images and other evidence supplied by the customer and conducted a video interview. The company considered the information credible enough to issue a precautionary warning, although it had not yet received the wallet for physical examination when it made its findings public.
The manufacturer also said it had no reports of customers losing funds as a result of the suspected modification. It has not established that other resellers or production batches were affected. A warning intended to limit potential loss should therefore not be treated as confirmation of a wider hardware tampering campaign.
Trezor advised people who purchased wallets through CryptoBilis from March 2026 onwards to move their assets to a fresh wallet generated using a new recovery phrase. Simply changing the device or the PIN would not resolve a situation in which another person had already obtained the secret used to restore the wallet.
A hardware wallet aims to keep private keys isolated from an ordinary computer that may be running untrusted applications. The device’s display is used to verify sensitive operations and, during setup, may show recovery information intended only for the owner. Physical modification of that display path could threaten protections that operate correctly at the software level.
A malicious circuit inserted between internal components would create a different security problem from a phishing website or a vulnerability in the wallet’s firmware. Its effects would depend on the component’s electrical connections, available power, data access, and ability to communicate externally, none of which has been conclusively established by the current investigation.
The provenance of security-sensitive products is therefore important from manufacture through final delivery. Warehouses, resellers, marketplaces, and logistics providers can handle a device before the end user opens it. Packaging or serial-number records can provide clues to authenticity without proving conclusively that each internal component remains unchanged.
CryptoBilis had already been removed from Trezor’s authorised reseller network following separate concerns about products distributed through that business. That history explains the manufacturer’s particular focus on this sales channel but does not establish that the same individuals were involved in the suspected Safe 5 modification.
Trezor is examining additional information concerning devices sold through the former reseller and assisting customers potentially affected by the warning. Any conclusion about a broader campaign will require evidence linking other devices to the same component, alteration method, or distribution route.
Physical analysis will also need to determine whether the reported board is operational, whether it can observe the recovery phrase, and whether it is capable of transmitting that information outside the wallet. Without those findings, the suggested mechanism should remain described as a suspicion rather than a confirmed exfiltration technique.
If the device is shown to contain an unauthorised circuit, investigators will still need to establish when and where the modification was made. The presence of a changed component would not automatically demonstrate compromise at Trezor’s manufacturing facilities or in its official distribution systems.
The current confirmed development is a manufacturer warning grounded in a credible customer report and an investigation that remains open. No examination has yet established the device’s capabilities or demonstrated resulting financial loss.
