A hardware wallet is supposed to protect your private keys. But what happens when the device itself becomes the attack surface?
Trezor has warned customers after receiving a credible report of a suspected hardware implant inside a Safe 5 device purchased from its former reseller, CryptoBilis.
According to the customer, the device contained an additional circuit board fitted with a cellular module and antenna. The suspected implant could read information displayed on the wallet screen, including the recovery phrase, and transmit it over a mobile network.
There is an important distinction: Trezor has not physically examined the reported device yet, so the implant's functionality remains unconfirmed. The company says four other devices returned by CryptoBilis customers showed no evidence of tampering. No related fund losses have been reported to Trezor.
Nevertheless, the warning covers all Trezor devices purchased through CryptoBilis from March 2026 onward.
Affected customers are being told to move their funds into a newly created wallet with a completely fresh recovery phrase. Simply restoring an old phrase on another device does not solve the problem if that phrase has already been exposed.
This incident is particularly concerning because CryptoBilis was also linked to the earlier Ledger hardware implant investigation.
The bigger issue here goes beyond Trezor or Ledger.
Hardware wallet security is often discussed in terms of encryption, secure elements and private-key isolation. But the supply chain is another attack surface that deserves just as much attention.
You can follow every security recommendation and still be exposed if the hardware was compromised before it reached you.
Self-custody is only as strong as the integrity of the device holding your keys.
$BTC #BTC Price Analysis# $ETH #Altcoin Season#
Trezor has warned customers after receiving a credible report of a suspected hardware implant inside a Safe 5 device purchased from its former reseller, CryptoBilis.
According to the customer, the device contained an additional circuit board fitted with a cellular module and antenna. The suspected implant could read information displayed on the wallet screen, including the recovery phrase, and transmit it over a mobile network.
There is an important distinction: Trezor has not physically examined the reported device yet, so the implant's functionality remains unconfirmed. The company says four other devices returned by CryptoBilis customers showed no evidence of tampering. No related fund losses have been reported to Trezor.
Nevertheless, the warning covers all Trezor devices purchased through CryptoBilis from March 2026 onward.
Affected customers are being told to move their funds into a newly created wallet with a completely fresh recovery phrase. Simply restoring an old phrase on another device does not solve the problem if that phrase has already been exposed.
This incident is particularly concerning because CryptoBilis was also linked to the earlier Ledger hardware implant investigation.
The bigger issue here goes beyond Trezor or Ledger.
Hardware wallet security is often discussed in terms of encryption, secure elements and private-key isolation. But the supply chain is another attack surface that deserves just as much attention.
You can follow every security recommendation and still be exposed if the hardware was compromised before it reached you.
Self-custody is only as strong as the integrity of the device holding your keys.
$BTC #BTC Price Analysis# $ETH #Altcoin Season#
