Trezor Warns of Suspected Hardware Implant in Safe 5 Wallets Sold via CryptoBilis
Customer reports extra circuit board exfiltrating recovery phrases; advisory issued for devices purchased since March 2026.
Key Takeaways
- Trezor Safe 5 wallets bought from CryptoBilis since March 2026 may contain a suspected hardware implant.
- The alleged extra circuit board could transmit recovery phrases over a mobile network.
- Trezor has not yet physically examined the device; details are based on customer report.
- Affected users are urged to migrate funds to a new wallet with a new recovery phrase immediately.
- No firmware patch is available; device replacement is the recommended mitigation.
Quick answers
- What happened?
- A Trezor Safe 5 hardware wallet purchased from the reseller CryptoBilis was found to contain an unauthorized extra circuit board. The board allegedly transmits the device's recovery phrase over a mobile network, potentially compromising user funds. Trezor has not yet physically examined the device but is treating the report as a serious supply chain security incident.
- Which products are affected?
- Trezor Safe 5
- What should defenders do?
- Affected users should immediately move funds to a new wallet with a new recovery phrase. No firmware patch available; device replacement is required.
Trezor has issued a security advisory warning users who purchased a Trezor Safe 5 hardware wallet from the reseller CryptoBilis since March 2026 to immediately move their funds to a new wallet with a fresh recovery phrase. The warning follows a customer report that their device contained an extra circuit board not present in legitimate units, which transmits the recovery phrase over a mobile network.
The report, initially highlighted by The Hacker News, describes the discovery of an unauthorized hardware component inside the Safe 5 casing. If confirmed, this would represent a significant supply chain attack vector targeting cryptocurrency hardware wallets. Trezor stated it has not yet examined the physical device internally, and the details currently rely on the customer's report.
In response, Trezor advised all affected users to assume their current recovery phrase is compromised and generate a new one on a verified, new device. The company emphasized that no firmware patch can address a physical hardware implant, making device replacement the only viable mitigation at this time.
Security Details
Extra circuit board allegedly transmits recovery phrase over mobile network; Trezor has not yet examined the device physically.
Affected products
Trezor Safe 5
Mitigation
Affected users should immediately move funds to a new wallet with a new recovery phrase. No firmware patch available; device replacement is required.
Sources
The Hacker News
Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis
Oct 30, 2026 · 12:21
Original link
Related Security News
SS7 and Diameter Signaling Protocol Vulnerabilities Enable Global Mobile Interception
A recent analysis highlights persistent vulnerabilities in the SS7 and Diameter signaling protocols. These flaws allow threat actors to track subscriber locations, intercept voice calls and SMS messages, and impersonate users by exploiting trust relationships between carrier networks. The report emphasizes that no device compromise is required, and that SMS-based two-factor authentication remains particularly at risk. Mitigation strategies focus on network-level defenses and the migration toward app-based authentication methods.
