Suspected Hardware Implant in Trezor Safe 5 Wallets Sold via CryptoBilis Raises Supply‑Chain Security Concerns
What Happened — Trezor has received a credible report from an Indonesian user who purchased a Trezor Safe 5 hardware wallet through the Southeast Asian reseller CryptoBilis on Tokopedia in August 2026. The user opened the device and found an extra circuit board between the main board and the screen, fitted with a cellular module and antenna. According to the unverified information supplied, the implant can read the screen (including the recovery phrase) and transmit that data over a mobile network when the wallet is powered. Trezor has not yet examined a device to confirm the implant, but it has halted sales of Safe 5 units from CryptoBilis, warned users to move assets to a known‑good wallet, and announced a global restructuring of its reseller network. The incident follows a similar Ledger hardware‑wallet implant earlier this month that also involved CryptoBilis. No theft of funds has been confirmed for Trezor customers, and the company is awaiting the returned device for forensic analysis.
Why It Matters for Trust & Control Assurance — The case tests the control objective of third‑party risk management and supply‑chain assurance; continuous monitoring of reseller relationships provides defensible evidence for multiple frameworks.
Who Is Affected — Crypto‑asset holders, financial‑service firms that store digital assets, and hardware‑wallet manufacturers.
Recommended Actions — Review third‑party onboarding and monitoring policies; collect provenance and tamper‑evidence data for all hardware devices; update incident‑response playbooks to include hardware supply‑chain compromise scenarios. Source: BleepingComputer
Technical Notes — Attack vector: supply‑chain tampering via a malicious circuit board with a cellular modem; data at risk: recovery phrase and private keys displayed on the screen; no CVE because this is a hardware implant, not a software flaw. Source: same article