Trezor has warned that it received a credible report of a possible crypto-theft implant in a Safe 5 wallet sold by reseller CryptoBilis in Southeast Asia, BleepingComputer reports. A user in Indonesia found an extra circuit board with a cellular module between the main board and the screen, which appears able to read the recovery phrase. The same reseller was involved in a similar case with Ledger devices in October. Trezor advises against using any device bought from CryptoBilis since March 2026 and moving funds to a new wallet.

What it means: Hardware wallets rest on the assumption that the device reaching the user is the one the manufacturer built. The CryptoBilis case shows that a reseller can open the device, add a component and repackage it without the buyer noticing. A cellular module that sends out the recovery phrase defeats all the protection, because anyone holding the phrase can recreate the wallet anywhere. The fact that the same sales channel is linked to an incident with another manufacturer points to a targeted operation in the distribution chain rather than a one-off defect. For users in Greece the rule is simple: buy only from the manufacturer's official store or an authorised reseller, run the authenticity check in the app on first connection, and create a new recovery phrase on the device, never use one that came pre-filled. Businesses that hold their own or customers' crypto-assets should record where every custody device came from. Trezor notes that weighing is not a reliable check, so the choice of purchase channel matters more than any inspection after delivery.

Read the original on BleepingComputer

Related service: Consulting

Related stories