Hardware wallet maker Trezor has issued an urgent security warning instructing customers who purchased devices from Southeast Asian reseller CryptoBilis on or after March 2026 to immediately migrate their funds to a newly created wallet with a fresh seed phrase. The alert comes after the company received a credible report detailing a physical supply chain attack on a Trezor Safe 5 unit.
Cellular Hardware Implant Detected
On October 28, 2026, Trezor's security team received a responsible disclosure from a customer in Indonesia who purchased a Trezor Safe 5 via Tokopedia in August 2026. An inspection revealed a rogue circuit board installed between the device's main board and its screen. The malicious module included a cellular transmitter and antenna capable of intercepting screen contents—including recovery seeds—and broadcasting the data over a mobile network whenever the wallet is powered on.
CryptoBilis served as an official Trezor reseller in Southeast Asia until October 2026. Trezor delisted the vendor on October 9, the same day Ledger began investigating customer asset losses linked to CryptoBilis purchases. Although Trezor has not yet physically received the compromised unit for laboratory examination, the company opted to issue immediate public guidance to protect exposed users. No stolen funds have been reported from Trezor devices so far, and the customer who discovered the implant transferred their assets prior to inspecting the hardware.
Remediation and Broader Market Risks
Trezor urged affected users not to reuse seed phrases on replacement hardware, as restoring a compromised seed will not secure the funds. Users without an immediate hardware alternative may temporarily move funds to a trusted exchange or software wallet after carefully checking full receiving addresses. Trezor is offering direct replacements or purchase vouchers for customers who bought from CryptoBilis during the affected window.
This supply chain breach highlights growing physical security threats for cold storage solutions. Recently, security authorities reported that Singapore lost $3.5 million to tampered Ledger hardware wallets across multiple retail incidents since September 10.
Key Takeaways
- Affected Window: Customers buying Trezor devices from CryptoBilis on or after March 2026 must move funds immediately.
- Hardware Threat: A rogue circuit board with a cellular module in a Trezor Safe 5 was configured to leak wallet screen data over mobile networks.
- No Losses Reported: Zero stolen funds have been confirmed for Trezor users to date, and CryptoBilis was delisted on October 9.
- Replacement Offer: Trezor is providing direct replacements or equivalent vouchers to eligible buyers.
Why It Matters
Physical supply chain attacks represent a critical escalation in crypto security threats because they bypass standard software and firmware protections. By embedding cellular modules directly between display controllers and mainboards, attackers can exfiltrate sensitive recovery phrases without leaving detectable software traces. As hardware storage adoption grows globally, hardware manufacturers will likely face mounting pressure to implement tamper-evident packaging, supply chain auditing, and cryptographic hardware verification directly at point-of-sale channels.
