Key Points

• Trezor is investigating suspected cellular communication implant devices within Safe within 5.
• The company urges customers of CryptoBilis to transfer their cryptocurrencies.
• The report states that the claim of device tampering has not yet been confirmed through laboratory tests.

Hardware wallet manufacturer Trezor issued an emergency security warning after a customer from Indonesia reported that suspected monitoring devices were found within their Trezor Safe 5 devices. These devices may be capable of stealing cryptocurrency recovery phrases over mobile networks.

In its security announcement on October 30th, Trezor stated that this device was purchased by the customer in August 2026 through the Indonesian e-commerce platform Tokopedia from the previous authorized distributor CryptoBilis.

It is claimed that Safe 5 contains hidden cellular hardware.

This discovery was reported to the company's security team on October 28th through the responsible disclosure program of Trezor.

According to this customer, an additional circuit board was installed between the motherboard and the display screen of Safe 5. This circuit board is said to contain a cellular communication module and an antenna.

This suspected implantable device appears to be capable of capturing information displayed on the wallet screen, including recovery phrases, and transmitting this information via a mobile connection when the device is powered on.

If this claim is confirmed, such attacks could potentially bypass an important security assumption behind hardware wallets without the need to compromise their underlying encryption mechanisms.

The recovery phrase can be used to recreate a cryptocurrency wallet on another device, allowing the person who possesses this phrase to authorize transactions even without the original hardware.

However, Trezor emphasizes that the devices involved have not yet been tested by independent laboratories.

Before issuing the warning, the company reviewed the photos and conducted a video interview with this customer.

Trezor indicates that currently, there are no CryptoBilis customers reporting to the company about losses of funds due to suspected implanted devices.

The same distributor was previously involved in another Ledger wallet attack.

Prior to the issuance of this warning, a confirmed case of hardware tampering occurred with Ledger devices distributed by CryptoBilis.

At the beginning of October, Ledger discovered that unauthorized hardware was capable of capturing the recovery phrases displayed during the wallet setup process.

Ledger subsequently suspended the sale of hardware wallets in multiple Southeast Asian markets and began investigating the affected distribution chains.

Independent investigators also traced large amounts of cryptocurrency losses related to previous incidents.

The theft investigation of Coinpaper estimates the loss at nearly $93 million, however, the total amount that can be attributed to the tampered hardware remains uncertain.

Trezor removed CryptoBilis from its authorized dealer network on October 9th, before receiving the report from Safe on the 5th.

Thereafter, the company inspected another four wallets obtained through that distributor, including two Safe 5 models, but no evidence of tampering was found.

However, these findings do not prove where the Safe modifications mentioned in the report occurred, nor do they confirm whether these incidents involve the same group of perpetrators.

Trezor What should wallet users do?

The warning for Trezor is specifically applicable to customers who purchased any of its hardware wallet models through CryptoBilis since March 2026.

Affected users who have already initialized their devices should create a new wallet using a fresh recovery phrase and transfer their cryptocurrencies to that new wallet.

Simply importing the original recovery phrase into another device does not eliminate potential risks, as attackers may already have access to the leaked credentials.

Customers whose devices have not been initialized should avoid setting up their devices, nor should they enter any existing wallet backups.

Trezor is providing replacement devices or vouchers to eligible CryptoBilis customers through its official support channels.

The company also reminds users not to attempt to identify if a wallet has been tampered with by weighing it, and points out that weight differences cannot reliably prove the presence of unauthorized hardware.

This warning appears amidst broader concerns about the security of hardware wallets from the public.

Coinpaper Previously, there were reports of phishing alerts regarding SecuX, while its hardware wallet security guide discussed how various attacks can pose threats to cryptocurrency holdings.