Trezor Safe 5 Wallet Sold by CryptoBilis Found with Suspected Data‑Exfiltration Implant
What Happened — A customer who purchased a Trezor Safe 5 hardware wallet from the reseller CryptoBilis reported that the device contained an unexpected extra circuit board. According to the user, the board was capable of transmitting the wallet’s recovery phrase over a mobile network, effectively leaking the secret that protects the crypto assets. Trezor has not yet performed a forensic analysis of the unit but has issued an urgent advisory urging anyone who bought a Trezor from CryptoBilis (sales beginning March 2026) to generate a new recovery phrase and move funds to a fresh wallet.
Why It Matters for Trust & Control Assurance — The incident highlights a supply‑chain control gap: without continuous vendor oversight and hardware integrity verification, a malicious component can bypass all logical safeguards and expose critical secrets.
Who Is Affected — Cryptocurrency users, fintech platforms that integrate hardware wallets, and any organization that relies on third‑party hardware for key management.
Recommended Actions –
- Immediately generate new recovery phrases and migrate assets to trusted wallets.
- Conduct a forensic inspection of any hardware purchased from CryptoBilis.
- Strengthen third‑party hardware procurement policies: require tamper‑evidence checks, maintain a vetted supplier list, and collect continuous assurance evidence for audit readiness.
Technical Notes — The implant appears to be an additional PCB that interfaces with a cellular modem, sending the 12‑word recovery phrase in clear text. No CVE is associated; the issue is a supply‑chain hardware compromise rather than a software flaw. Source: The Hacker News