Trezor has advised customers who purchased hardware wallets from former authorized reseller CryptoBilis since March to immediately move their funds following a report of a suspected unauthorized implant in a Safe 5 device. The warning stems from an incident involving a customer in Indonesia who reported finding an extra circuit board inside a Trezor Safe 5 bought on Tokopedia in August. According to the report, this suspected implant could capture screen information, including wallet recovery phrases, and transmit it via cellular network.
Trezor stated that it had not yet physically examined the specific device but was treating the report as credible. Chief Commercial Officer Danny Sanders emphasized the precautionary nature of the alert, noting the company preferred to warn users rather than wait for confirmation while potential losses occurred. A spokesperson described the volume of sales through CryptoBilis as "very small" without providing exact figures, and confirmed that the origin of the tampering remains under investigation. The company acknowledged that existing physical safeguards, such as seals and packaging, are insufficient to prevent such attacks.
This development follows earlier reports of crypto losses involving Ledger wallets sold through CryptoBilis, which surfaced on October 9. Ledger subsequently confirmed an unauthorized hardware implant in one affected device. Security researcher Joe Grand had previously alerted Trezor in August regarding tampered Trezor One and Model T wallets purchased through unauthorized sellers on social media platforms. Trezor clarified that its prior statements about no compromised devices applied only to new wallets sold through authorized channels. On October 13, Trezor announced plans to reduce its reseller network.
The incident highlights a critical vulnerability in the supply chain security of hardware wallets, specifically demonstrating how physical implants can bypass software-based protections like firmware checks. By capturing screen data directly, attackers can steal recovery phrases without altering the device's code, rendering traditional counterfeit detection methods ineffective. This underscores the limitation of relying solely on packaging seals and visual inspections for high-value cryptographic assets.
From an operational risk perspective, Trezor’s decision to issue a broad warning based on an unexamined device reflects a shift toward prioritizing user safety over reputational caution. However, the lack of clarity regarding where the tampering occurred—whether at the manufacturer, distributor, or retailer level—leaves significant uncertainty for consumers. The reduction of the reseller network is a logical step, but it raises questions about the vetting processes for remaining partners and the ability to trace compromised units once they enter the secondary market.
