Trezor has issued a warning regarding a potential security threat involving its Safe 5 hardware wallet. A customer reported discovering an additional circuit board in a wallet purchased from the reseller CryptoBilis, which sends recovery phrases over mobile networks. The wallet was bought through Tokopedia, a marketplace in Indonesia, in August 2026. Trezor has advised all customers who purchased any of their models from CryptoBilis since March 2026 to transfer their funds to new wallets and generate new recovery phrases. The suspicious board is situated between the main board and the screen. It uses a cellular module and antenna to exfiltrate recovery phrases whenever the wallet is connected to a power source.

Although Trezor has yet to physically examine the compromised device, the company is taking the report seriously enough to prompt immediate action to protect its users. They have collected evidence from the customer, including photos and a detailed description, and are arranging for the wallet to be sent to their lab for further analysis. Currently, there have been no reported incidents of funds being lost, but Trezor stresses that it cannot track wallet contents and advises caution.

Trezor has terminated its relationship with CryptoBilis, their former authorized reseller in Southeast Asia, following previous incidents linked to the reseller. The Singapore Police Force also released an advisory about malicious hardware components found in Ledger hardware wallets purchased from some retail stores in Singapore. These components have been reported to capture recovery phrases or private keys, similar to the suspected implant in Trezor’s device. Investigations by both Ledger and local authorities are ongoing, as they seek to understand the full extent of the issue and its origins. Trezor is on high alert for potential phishing attacks exploiting this situation, urging customers to remain cautious about communications that may be fraudulent.