******** Opinion about Trezor Safe 5 (hardware)
<!--HEADER END-->
On October 30, 2026, Trezor warned customers about a reported hardware implant in a Trezor Safe 5 sold by CryptoBilis. Until October 2026, CryptoBilis was an official Trezor and Ledger reseller in Southeast Asia. The warning follows an earlier case. On October 9, Ledger began investigating fund losses among customers who had bought from CryptoBilis, and later confirmed some of those devices had been physically tampered with in a sophisticated supply chain attack. Trezor removed CryptoBilis as a reseller that same day and limited its authorized sellers as a precaution. On October 28, a customer in Indonesia reported an implant through Trezor's responsible disclosure program. The device was bought in August 2026 through CryptoBilis's store on Tokopedia. According to the report, an extra circuit board with a cellular module and an antenna sits between the main board and the screen. It reportedly reads what the screen shows, including the wallet backup, and sends it over a mobile network whenever the device is plugged in. Trezor has not yet examined the device. It treats the report as credible based on photos and a video interview, and decided to warn customers now rather than wait for lab results. No customer has reported lost funds, and the reporter had moved his funds off the device before finding the implant. Trezor's advice applies to every Trezor model bought from CryptoBilis from March 2026 onwards. Owners who already use one should move their funds to a new wallet with a new seed. Restoring the old backup on another device does not help. If no secure hardware wallet is available, Trezor suggests moving funds temporarily to a software wallet or a familiar exchange. Owners who have not set up their device should not use it. Weighing or opening the device is not a reliable check. Affected buyers can get a free replacement or a voucher through Trezor Support. Trezor also warns that scammers will likely use this incident for phishing, and that support will never ask for a recovery phrase.
<!--FOOTER START-->
#WalletScrutiny #nostrOpinion
Comments
No comments yet. Start the conversation.