Key points
- Trezor is investigating a suspected cellular communication implant within Safe 5.
- The company urges CryptoBilis customers to transfer their cryptocurrencies.
- The report that the device was tampered with has not yet been confirmed by laboratory testing.
Hardware wallet manufacturer Trezor has issued an urgent security alert after an Indonesian customer reported discovering a suspected surveillance implant inside their Trezor Safe 5 device, which may have been capable of stealing cryptocurrency recovery phrases via mobile networks.
In its security notice on October 30, Trezor stated that the device was purchased by the customer on August 2026 through the Indonesian e-commerce platform Tokopedia from the previously authorized distributor CryptoBilis.
Safe 5 is allegedly equipped with hidden cellular hardware.
This discovery was reported to the company's security team on October 28 through Trezor's responsible disclosure program.
According to this client, an additional circuit board was installed between the motherboard and the display of the Safe 5. This board is said to contain a cellular communication module and an antenna.
This suspected implant device appears capable of capturing information displayed on the wallet screen, including the recovery phrase, and transmitting this data via mobile connectivity when the device is powered on.
If this claim is verified, such an attack could bypass a key security assumption behind hardware wallets without compromising their underlying cryptographic mechanisms.
A recovery phrase can be used to recreate a cryptocurrency wallet on another device, allowing anyone who obtains the phrase to authorize transactions even without the original hardware.
However, Trezor emphasized that the affected device has not yet been tested by an independent laboratory.
Before issuing the warning, the company reviewed the photos and conducted a video interview with the client.
Trezor states that no CryptoBilis customers have reported losing funds due to suspected compromised devices.
The same dealer was previously involved in another Ledger wallet attack.
Prior to this warning, a confirmed hardware tampering incident occurred with Ledger devices distributed by CryptoBilis.
In early October, Ledger discovered that unauthorized hardware was capable of capturing the recovery phrase displayed during wallet setup.
Ledger subsequently suspended hardware wallet sales in multiple Southeast Asian markets and investigated the affected distribution channels.
Independent investigators also traced significant cryptocurrency losses related to previous incidents.
The theft investigation by Coinpaper estimated close to $93 million, but the total amount attributable to the compromised hardware remains uncertain.
Trezor removed CryptoBilis from its authorized distributor network on October 9, prior to receiving the Safe 5 report.
Subsequently, the company inspected four additional wallets obtained through the distributor, including two Safe 5 units, but found no evidence of tampering.
However, these findings do not prove where the Safe 5 modifications in the report occurred, nor do they confirm whether these incidents involved the same group of perpetrators.
What should Trezor wallet users do?
The Trezor warning applies specifically to customers who purchased any of its hardware wallet models through CryptoBilis since March 2026.
Affected users who have already initialized their device should create a new wallet using a completely new recovery phrase and transfer their cryptocurrencies there.
Simply importing the original recovery phrase onto another device does not eliminate potential risks, as attackers may already have access to the compromised credentials.
Customers who have not yet initialized their device should avoid setting up the device and should not enter any existing wallet backups.
Trezor is providing replacement devices or vouchers to eligible CryptoBilis customers through its official support channels.
The company also warns against attempting to identify tampered wallets by weighing them, noting that weight differences cannot reliably prove the presence of unauthorized hardware.
This warning comes amid broader concerns about the security of hardware wallets.
Coinpaper previously reported on SecuX’s phishing alert, and its hardware wallet security guide examines how various attacks can compromise cryptocurrency holdings.