A customer reported a suspected hardware implant in a Trezor Safe 5 wallet sold by the reseller CryptoBilis, leading Trezor to advise affected customers to move their funds to new wallets.
The vulnerability or weakness
The suspected implant includes a circuit board that reads the recovery phrase and sends it over a mobile network.
Earlier attacks and coverage
- Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key (2026-10-27)
Business impact
The incident could result in financial loss for users who did not move their funds, potentially damaging Trezor's reputation and operational trust.
Industries affected
Cryptocurrency users and hardware wallet buyers are primarily affected.
Users affected
All Trezor Safe 5 wallets bought from CryptoBilis since March 2026 are advised to move their funds to new wallets with new recovery phrases.
