Trezor Warns Customers of Possible Spying Implant in Hardware Wallets Sold by Reseller

Hardware wallet manufacturer Trezor has told customers who purchased a Trezor Safe 5 from the reseller CryptoBilis since March 2026 to transfer their crypto assets to a newly created wallet, after receiving a report that one such device had been fitted with a hardware implant capable of spying on sensitive data.

The company said it received the tip on 28 October 2026 and published a warning via a blog post two days later, on Friday, 30 October. According to the report, a customer found an extra circuit board wedged between the device's main board and its display. That board reportedly included a cellular module and antenna, which allegedly could read information shown on the screen and transmit it to attackers over the cellular network.

Trezor said it has not yet been able to examine the device itself but considers the report credible after holding a video call with the affected customer. The company has not been able to verify whether the alleged implant actually functions as described.

In a post on social media, Trezor wrote: "CryptoBilis update. We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from…"

Trezor said it examined four additional devices bought from CryptoBilis and found no evidence of manipulation in those units. The company also said it is not currently aware of any customer having lost funds in connection with the case.

CryptoBilis was removed from Trezor's authorised reseller network in early October 2026. The reseller had previously been implicated in a similar incident involving competitor Ledger, in which Ledger confirmed that hardware wallets it had sold through CryptoBilis had been manipulated. Blockchain analysts estimated losses from that earlier episode at more than 86 million US dollars.

Advice for affected buyers

Trezor is advising anyone who bought a Trezor Safe 5 from CryptoBilis since March 2026 to set up a new wallet with a freshly generated recovery phrase and move their funds there, rather than reusing the recovery phrase tied to a potentially compromised device.

The warning comes months after Trezor disclosed other security incidents affecting its customer base. In August, a data breach at shipping service provider ShipMonk exposed personal information belonging to around 13,700 Trezor customers. In September, the company reported that roughly 67,000 additional US customers had also been affected by data exposure.