Hardware wallet manufacturer Trezor has issued an urgent advisory instructing customers who purchased its devices from former authorized reseller CryptoBilis since March to immediately move their funds to a secure location. The safety warning comes in the wake of a deeply concerning report detailing a suspected unauthorized hardware implant discovered inside a Trezor Safe 5 cryptocurrency hardware wallet.
The security issue came to light on Friday when Trezor publicly disclosed that a customer based in Indonesia had encountered an alarming anomaly. According to the customer’s report, an unauthorized auxiliary circuit board was found physically embedded inside a Trezor Safe 5 unit that had been purchased through the online marketplace Tokopedia in August. Preliminary details suggest that this suspected hardware implant possessed sophisticated capabilities, specifically designed to capture sensitive information displayed directly on the device’s screen. This included critical security credentials such as wallet recovery phrases, which the malicious internal component could allegedly capture and subsequently transmit outward over an external cellular network.
As of the initial disclosure, Trezor confirmed that it had not yet physically received or examined the compromised device in its corporate laboratory. Furthermore, the company stated that it had received no official reports of related financial losses tied directly to this specific Indonesian incident. Despite the absence of confirmed losses or a physical examination of the compromised hardware, executive leadership at the company chose to act with an abundance of caution to protect its user base.
“We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” said Danny Sanders, Trezor’s chief commercial officer, in statements provided to industry media.
Addressing the scope of the affected distribution channels, a Trezor spokesperson characterized the volume of sales conducted through the third-party reseller as “very small,” though the company declined to provide precise commercial figures or sales volumes. The spokesperson further acknowledged that Trezor has not yet established the exact point or jurisdiction where the suspected physical tampering took place. In light of the incident, the hardware wallet manufacturer is conducting a comprehensive review of its physical security and hardware protection mechanisms. The company openly acknowledged that existing defensive safeguards, including standard security seals and retail packaging materials, are no longer sufficient on their own to prevent sophisticated supply chain tampering.
Ledger Tampering and Earlier Warnings to Trezor
This latest security scare does not occur in a vacuum; it follows closely on the heels of parallel security breaches affecting competing hardware wallet brands. Similar reports involving cryptocurrency losses tied to Ledger wallets distributed through the exact same reseller, CryptoBilis, surfaced publicly on October 9. In those separate incidents, competitor Ledger officially confirmed the presence of an unauthorized hardware implant in at least one distributed device. Law enforcement authorities in regions such as Singapore have also been forced to intervene, noting that tampered Ledger wallets distributed through unauthorized channels had already cost local users millions of dollars in unexpected losses.
The broader threat of supply chain interference had previously been flagged to Trezor by independent security researchers. Noted hardware security expert Joe Grand previously revealed that he had directly alerted Trezor back in August regarding tampered Trezor One and Model T hardware wallets. Those specific compromised devices had been acquired by consumers through unauthorized sellers operating on mainstream social media platforms like TikTok and Facebook.
At the time of those earlier disclosures, Trezor maintained that its previous public claims—asserting there was no evidence of compromised devices—applied strictly to new wallets distributed through its official network of authorized resellers. The company explained during those earlier disclosures that its built-in software and firmware setup checks were specifically engineered to detect counterfeit hardware and modified firmware variants. However, the sophisticated hardware implants discovered later in devices distributed through CryptoBilis operated differently, functioning as passive screen-reading hardware that captured visual data without needing to alter or interfere with the device’s native firmware. Security experts note that once an attacker successfully steals a user’s recovery phrase through such physical monitoring, they can easily restore the target wallet on an entirely separate device and drain its funds at will.
The escalating risks associated with third-party supply chains have prompted swift structural changes within Trezor’s distribution model. In direct response to these accumulating security challenges and supply chain vulnerabilities, Trezor officially announced plans to significantly scale back and restrict its broader reseller network on October 13, moving toward a more tightly controlled direct-to-consumer sales model to better safeguard its physical products before they reach end users.
Comments (0)