TL;DR:
Trezor issuses Safe 5 warning and urged customers who purchased hardware wallets through CryptoBilis since March 2026 to transfer their funds to a new device. The warning follows a disclosure alleging that a Safe 5 wallet contained a hidden cellular implant capable of capturing recovery phrases.
Hardware wallet manufacturer Trezor has issued a security warning to customers who purchased its devices through Southeast Asian reseller CryptoBilis, following reports of an alleged physical implant inside a Safe 5 wallet.
In a blog post published Friday, the company said it received a responsible disclosure on October 28 describing an additional circuit board allegedly installed inside the device. Trezor is advising affected customers to move their cryptocurrency to a newly generated wallet rather than wait for its investigation to reach a final conclusion.
The warning applies to customers who purchased Trezor hardware wallets through CryptoBilis from March 2026 onward.
Alleged Cellular Implant Raises Concerns About Wallet Security
According to the disclosure, the suspicious Safe 5 device was purchased through Indonesian marketplace Tokopedia in August 2026. The alleged modification involved an additional circuit board positioned between the wallet’s main board and its display.
The component reportedly contained a cellular module and antenna capable of reading information displayed on the device, potentially including the user’s recovery phrase, before transmitting the captured information over a mobile network.
However, Trezor has not physically examined the device in question. Its preliminary assessment is based on a video interview with the customer who reported the discovery. Despite the lack of a laboratory inspection, the company considers the disclosure credible enough to issue an immediate warning.
“We’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor Chief Commercial Officer Danny Sanders said.
Trezor also confirmed that customers who contact its support team will be offered replacement devices.
The company has reportedly inspected four other returned CryptoBilis devices so far, finding no evidence of tampering in those units. No customer fund losses connected to the alleged Trezor incident have been reported.
CryptoBilis Faces Scrutiny Following Ledger Incident
The latest warning adds another complication to the ongoing security concerns surrounding CryptoBilis.
Trezor had already removed the reseller from its authorized distribution network earlier in October, following reports of tampered Ledger hardware wallets being sold through the same distributor.
Ledger previously confirmed physical tampering involving devices distributed through CryptoBilis, while OneKey also ended its relationship with the reseller, suspended new approvals, and offered customers free replacements.
The financial consequences of the Ledger incident could also be substantial. Onchain analysts have estimated that more than $86 million in cryptocurrency was lost across Bitcoin, Ethereum, and Tron. However, Ledger has not independently confirmed that figure.
Hardware Wallet Supply Chains Become a Growing Security Concern
As Trezor issues safe 5 warning, it only highlights a broader issue facing cryptocurrency investors: hardware wallet security depends on more than the technology inside the device.
Although cold wallets are designed to keep private keys offline, physical interference during distribution can introduce risks that ordinary software protections may not detect.
The importance of protecting recovery phrases has also become increasingly apparent following previous incidents involving cryptocurrency wallet phishing and supply-chain attacks. Bitcoinist has previously examined a Ledger seed phrase scam targeting hardware wallet customers.
For now, Trezor’s warning remains precautionary, as the company has not yet completed a physical examination of the reported Safe 5 device. Nevertheless, customers who purchased through CryptoBilis are being encouraged to take immediate action.
The incident serves as another reminder that securing cryptocurrency requires careful attention to where hardware wallets are purchased, how devices are handled, and whether recovery phrases remain protected.
Discover more from Coin Gazette
Subscribe to get the latest posts sent to your email.
