There was an extra LTE-enabled board inside the cold wallet.
Trezor’s official warning: Someone opened a Safe 5 sold by former Southeast Asian reseller CryptoBilis (Tokopedia) and found an extra circuit board sandwiched between the mainboard and the screen, equipped with a cellular module and antenna. Once powered on, it could read the recovery phrase displayed on the screen and upload it over the mobile network.
A caveat on the evidence: Trezor hasn’t inspected the physical device yet, and is treating the report as credible based on photos and a video interview. It checked four other devices from the same channel and found no issues. So far, there are no reports of lost funds.
The same reseller had also been linked to a physical tampering incident involving Ledger earlier. Trezor revoked its authorization on October 9.
“Not your keys”—but what if your keys come out of a box from an “official reseller” with an antenna inside?
If you bought through this channel since March: migrate to a new seed. Restoring the old recovery phrase as-is on a new device isn’t enough.
Hot wallets drained this week, front-end supply chain poisoned, and now a board hidden inside a cold wallet. Even the physical layer of self-custody isn’t a get-out-of-jail-free card.
Trezor’s official warning: Someone opened a Safe 5 sold by former Southeast Asian reseller CryptoBilis (Tokopedia) and found an extra circuit board sandwiched between the mainboard and the screen, equipped with a cellular module and antenna. Once powered on, it could read the recovery phrase displayed on the screen and upload it over the mobile network.
A caveat on the evidence: Trezor hasn’t inspected the physical device yet, and is treating the report as credible based on photos and a video interview. It checked four other devices from the same channel and found no issues. So far, there are no reports of lost funds.
The same reseller had also been linked to a physical tampering incident involving Ledger earlier. Trezor revoked its authorization on October 9.
“Not your keys”—but what if your keys come out of a box from an “official reseller” with an antenna inside?
If you bought through this channel since March: migrate to a new seed. Restoring the old recovery phrase as-is on a new device isn’t enough.
Hot wallets drained this week, front-end supply chain poisoned, and now a board hidden inside a cold wallet. Even the physical layer of self-custody isn’t a get-out-of-jail-free card.