Trezor Warns Customers After Discovered Hardware Implant Secretly Broadcasts Recovery Phrases

Hardware cryptocurrency wallet manufacturer Trezor has issued an urgent security warning to customers following the discovery of a malicious hardware modification found inside a Trezor Safe 5 device. The compromised hardware wallet, which was purchased through an authorized regional reseller, contained an unauthorized secondary circuit board designed to covertly capture and transmit the user’s recovery phrase over a mobile cellular network.

The security alert was made public on October 30, 2026, after Trezor received a detailed report from a customer in Indonesia just two days prior. According to the affected user, the Trezor Safe 5 device had been purchased in August through the reseller CryptoBilis via the e-commerce marketplace Tokopedia. Although Trezor has not yet had the opportunity to physically examine the compromised device in its own laboratory, the company has taken the unusual and proactive step of warning the public immediately, stating that waiting for full lab confirmation would leave other buyers exposed to potential theft in the interim.

According to the preliminary findings and descriptions provided by the Indonesian customer, the malicious modification consists of an extra circuit board cleverly positioned between the hardware wallet’s main circuit board and its visual display screen. This hidden modification reportedly incorporates a cellular module and a miniature antenna. Whenever the device is plugged in to be powered on or used, the rogue circuit board captures the visual output of the screen—specifically targeting the sensitive recovery phrase, known by Trezor as the wallet backup—and transmits that critical security information across a mobile network to an external, unauthorized recipient.

Trezor representatives have conducted thorough interviews with the customer via video call and have gathered comprehensive photographic evidence and technical descriptions of the foreign component. Arrangements are currently underway to ship the physical device directly to Trezor’s secure research laboratories for an exhaustive forensic examination. Despite the sophisticated nature of the hardware implant, no victims have yet reported actual financial losses connected to this specific Trezor incident. Furthermore, Trezor operates on a zero-knowledge architecture and cannot see the contents, balances, or transaction histories of the wallets managed by its customers. Notably, the Indonesian customer discovered the physical anomaly and successfully moved his digital assets to a completely new, uncompromised wallet before his funds could be intercepted.

In response to the alarming discovery, Trezor has issued broad precautionary guidance covering every Trezor hardware wallet model purchased from CryptoBilis since March 2026. This warning extends to any retail storefront or online channel supplied by CryptoBilis, including its dedicated storefront on Tokopedia. As of October 30, the hardware manufacturer confirmed it has received no reports of similar tampering or malicious implants originating from any other authorized resellers or distribution channels worldwide.

Trezor has strongly advised its user base against attempting to physically inspect, weigh, or open their hardware wallets to check for potential tampering. While the customer in Indonesia initially suspected something was amiss due to a subtle discrepancy in the device’s weight, the company cautions that minor manufacturing weight variations can occur naturally and that amateur disassembly attempts risk damaging the device or creating false assumptions. Instead, users who purchased devices through the implicated reseller are advised to proactively migrate their cryptocurrency funds to an entirely new wallet generated with a fresh recovery phrase.

Furthermore, Trezor warned that malicious threat actors and opportunistic scammers are almost certain to exploit the ongoing security incident to conduct sophisticated phishing campaigns. The company cautioned customers to remain highly vigilant against fraudulent emails, direct messages, phone calls, or postal letters purporting to offer assistance or instructions related to the compromised hardware wallets.

The severance of ties between Trezor and CryptoBilis occurred weeks prior to the public disclosure of this latest hardware implant. Trezor officially terminated its relationship with CryptoBilis, which had served as an authorized reseller in Southeast Asia, on October 9. The decision followed an independent security investigation launched by rival hardware wallet maker Ledger, which had begun examining mysterious cryptocurrency losses reported by several of its own customers who had likewise purchased their devices through CryptoBilis.

Ledger subsequently confirmed that at least one customer’s affected hardware wallet contained an unauthorized hardware implant engineered to capture recovery phrases during the initial device setup process. Trezor noted that the rogue circuit board discovered inside its Safe 5 device appears to function in a manner strikingly similar to the hardware implants previously identified in Ledger devices. However, company representatives emphasized that Trezor will not formally compare the two malicious designs while ongoing independent investigations continue, pointing out that each hardware manufacturer builds its products using distinct internal architectures. At this stage, Trezor has not attributed the supply chain attack to any specific threat actor or entity.

Separate Police Advisory Issued in Singapore

The unfolding hardware supply chain security crisis has also drawn the attention of law enforcement authorities in the region. The Singapore Police Force issued an official public advisory on October 28 addressing reports of tampered cryptocurrency hardware wallets circulating within local retail markets.

According to the Singapore police advisory, investigators identified at least two separate cases reported since September 10 involving Ledger hardware wallets purchased from local retail stores that contained malicious, unauthorized hardware components. These physical tampering devices were similarly found to possess the technical capability to capture user recovery phrases and private cryptographic keys during operation.

Law enforcement agencies and cybersecurity investigators continue to examine the full scope of the supply chain compromise. Meanwhile, affected hardware wallet manufacturers are reviewing the reported cases to protect consumers from ongoing physical tampering risks within authorized retail networks.