You buy a cold wallet precisely because it’s offline. But an Indonesian buyer opened his Trezor and found an extra circuit board inside—capable of connecting to the internet. In August, he purchased a Safe 5 from CryptoBilis, a Southeast Asian distributor, on Indonesia’s e-commerce platform Tokopedia. Upon receiving it, he noticed the weight felt off. When he opened it, he discovered a board sandwiched between the mainboard and the screen, equipped with a cellular modem and antenna. According to him, this board can read the mnemonic phrase displayed on the screen and transmit it via mobile network as soon as it’s powered on. The device hasn’t yet been sent to the manufacturer for inspection, and Trezor hasn’t confirmed anything—but it has already issued a warning: anyone who bought a Trezor from CryptoBilis since March, regardless of model, should immediately transfer their funds to a new wallet created with a newly generated mnemonic phrase. Trezor will ship replacement units free of charge. No losses have been reported yet. But since wallets are self-custodial, the manufacturer cannot see users’ balances—so no reports don’t mean no compromises. Last month, Ledger faced a nearly identical scam: a group bought genuine devices, installed hidden components to steal mnemonic phrases, then resold them back to the market through Southeast Asian distributors. According to Arkham, an estimated $95 million was stolen in just three days. In response, Ledger has suspended all sales in six Southeast Asian countries plus Hong Kong.