Can your recovery phrase stay safe if you buy a hardware wallet from a third-party reseller?
On October 28, the Trezor security team received a responsible disclosure: a user’s Trezor Safe 5, purchased in August 2026 through Southeast Asian reseller CryptoBilis (Tokopedia store), may have had a hardware implant board installed inside. The device has not yet been sent to a lab for teardown and inspection, but based on the description and video interview, Trezor has issued a warning, treating it as a “credible report.”
A few points that directly affect everyday users 👇
🔹 According to the report, the board was sandwiched between the motherboard and the screen, and had a cellular module and antenna. The claim is that once powered on, it could read the screen (including the recovery phrase) and transmit the information over a mobile network. Trezor stresses that it has not yet completed its own verification, but couldn’t wait for lab results before issuing a warning.
🔹 This may affect more than just that one Safe 5—all Trezor models purchased from CryptoBilis since March 2026 are covered by the official recommendation: move your coins to a “new wallet + new recovery phrase” as soon as possible, and don’t reuse the old recovery phrase on any device. If you haven’t unboxed yours, don’t initialize it or import an existing backup.
🔹 So far, no CryptoBilis customers have reported losing funds to Trezor. On October 9, after a similar incident involving a Ledger sales channel, Trezor removed CryptoBilis from its list of official resellers. Four other devices that were spot-checked showed no signs of tampering.
🔹 Affected users can keep their original device and contact official customer support to request a replacement or voucher. Also watch out for phishing—fake emails and fake support agents asking for your recovery phrase tend to follow news like this.
Put simply: the words “official channel” matter more than the brand logo when it comes to cold wallets. Did yours come directly from the official website, or was it shipped by an e-commerce reseller?
#Trezor警告CryptoBilis渠道Safe5疑遭硬件植入 #BTC #ETH
On October 28, the Trezor security team received a responsible disclosure: a user’s Trezor Safe 5, purchased in August 2026 through Southeast Asian reseller CryptoBilis (Tokopedia store), may have had a hardware implant board installed inside. The device has not yet been sent to a lab for teardown and inspection, but based on the description and video interview, Trezor has issued a warning, treating it as a “credible report.”
A few points that directly affect everyday users 👇
🔹 According to the report, the board was sandwiched between the motherboard and the screen, and had a cellular module and antenna. The claim is that once powered on, it could read the screen (including the recovery phrase) and transmit the information over a mobile network. Trezor stresses that it has not yet completed its own verification, but couldn’t wait for lab results before issuing a warning.
🔹 This may affect more than just that one Safe 5—all Trezor models purchased from CryptoBilis since March 2026 are covered by the official recommendation: move your coins to a “new wallet + new recovery phrase” as soon as possible, and don’t reuse the old recovery phrase on any device. If you haven’t unboxed yours, don’t initialize it or import an existing backup.
🔹 So far, no CryptoBilis customers have reported losing funds to Trezor. On October 9, after a similar incident involving a Ledger sales channel, Trezor removed CryptoBilis from its list of official resellers. Four other devices that were spot-checked showed no signs of tampering.
🔹 Affected users can keep their original device and contact official customer support to request a replacement or voucher. Also watch out for phishing—fake emails and fake support agents asking for your recovery phrase tend to follow news like this.
Put simply: the words “official channel” matter more than the brand logo when it comes to cold wallets. Did yours come directly from the official website, or was it shipped by an e-commerce reseller?
#Trezor警告CryptoBilis渠道Safe5疑遭硬件植入 #BTC #ETH
