Suspected Implant in Trezor Safe 5 Sold by Authorized Reseller CryptoBilis
A customer reported that a Trezor Safe 5 bought from authorized reseller CryptoBilis contains an extra board that sends the recovery phrase over a mobile network; Trezor has not yet examined the device. According to journalist Kim Zetter, Trezor announced the wallet was compromised, after earlier disputing reports that involved only unauthorized sellers. Anyone who bought a Trezor from CryptoBilis since March 2026 should move funds to a new wallet with a new recovery phrase.
What happened
A customer reported that a Trezor Safe 5 bought from authorized reseller CryptoBilis contains an extra board that sends the recovery phrase over a mobile network. Trezor has not yet examined the device. Journalist Kim Zetter reported that Trezor announced the wallet was compromised, after earlier disputing reports that involved only unauthorized sellers.
Why it matters
The recovery phrase grants full access to the funds: whoever captures it can drain the wallet. The warning covers any Trezor bought from CryptoBilis since March 2026, even through an authorized reseller. Buying from an authorized seller did not remove the tampering risk.
What to do
Move all funds from any Trezor bought from CryptoBilis since March 2026 to a new wallet generated with a new recovery phrase. Do not reuse the old phrase. Send the suspect device to Trezor for examination.
For the technical team
- Affected
- Trezor Safe 5 vendida pela revenda CryptoBilis · Trezor Safe 5 sold by CryptoBilis, an authorized reseller. Trezor's warning covers any Trezor bought from CryptoBilis since March 2026.
- Exploitation
- Tampered device reported by a customer. Trezor stated that a Safe 5 sold by CryptoBilis was compromised, per Kim Zetter, but has not yet examined the device. The sources do not cite any stolen funds.
- Fix
- No fix cited in the sources. Mitigation advised by Trezor: move funds to a new wallet with a new recovery phrase.
- Vector
- Physical supply chain tampering. An extra circuit board installed in the wallet sends the recovery phrase over a mobile network, according to a customer report. Condition: device bought from reseller CryptoBilis from March 2026 onward.
- More details
- Trezor published the warning in a blog post (The Hacker News). According to Kim Zetter, two weeks earlier Trezor disputed her story because the wallets involved came from unauthorized sellers; the current case involves an authorized reseller.
Timeline
Trezor announced that a Safe 5 wallet sold by CryptoBilis, an authorized reseller, was also compromised, after earlier dismissing reports because they involved unauthorized sellers.
Customer reports extra board in wallet bought from CryptoBilis; Trezor recommends moving funds.
Sources 2 sources
- Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis The Hacker News
- @KimZetter @KimZetter
