Introduction
Trezor, a hardware wallet device maker, has received reports of a suspected hardware crypto-theft implant in a Trezor Safe 5 device sold by its reseller CryptoBilis in Southeast Asia. Although the company has not examined the device, it has advised potentially affected users to move their private keys and digital assets to known safe wallets. The Safe 5 is one of Trezor’s latest models and is currently available for purchase from the official store.
Device Details
Trezor wallets are physical devices that store cryptocurrency private keys and authorize transactions. The Safe 5 is one of its latest models and is currently available for purchase from the official store. The Safe 5 is equipped with a cellular module and antenna, which raises concerns about potential security vulnerabilities.
Incident Details
An Indonesian user who purchased a Safe 5 device from CryptoBilis through Tokopedia in August 2026 reported finding an extra circuit board between the wallet's main board and screen. The implant appears capable of reading information displayed on the screen, including the wallet recovery phrase, and transmitting it over a mobile network when plugged in. The implant is similar to the one found in a Ledger device compromised earlier this month.
Response from Trezor
Trezor has advised potentially affected users to move their private keys and digital assets to known safe wallets. The company has also stopped device sales through CryptoBilis and announced it would restructure and tighten its reseller network globally to maintain higher levels of security. The company is unaware of any funds being stolen as a result of a supply-chain attack and is awaiting confirmation from the device manufacturer.
Industry Response
Ledger confirmed the compromise and asked resellers and distributors in Southeast Asia and Hong Kong to halt all sales until the investigation confirms their safety. Binance has probed a potential $5.8 billion crypto-theft hack, and Uranium crypto exchange hacker was convicted for stealing $53 million. Bitget was hacked via a zero-day in third-party security products, and Microsoft urged Entra ID admins to migrate users to passkeys. Tailscale warned of SSH flaws allowing root privilege escalation, and CISA warned of hackers exploiting critical Node2Shell flaw. These incidents highlight the importance of maintaining robust security measures and vigilance in the cryptocurrency industry.
Conclusion
Trezor’s warning serves as a reminder of the importance of security in the hardware wallet industry. Users are advised to move their funds to a newly created wallet with a new recovery phrase and contact Trezor for a replacement device or a voucher for a new device. The incident underscores the need for continuous monitoring and updates in the industry to prevent such security breaches from occurring in the future.