Security Alert: Potential Compromise of Trezor Safe 5 Hardware Wallet
Incident Overview
A recent report has raised significant concerns about the security of the Trezor Safe 5 hardware wallet. A customer from Indonesia purchased the device through an online marketplace and discovered an unauthorized circuit board that transmits the wallet’s recovery phrase via cellular networks.
Response from Trezor
Trezor has not yet conducted a thorough examination of the compromised unit; however, the company has preemptively advised all customers who purchased wallets from the reseller CryptoBilis since March 2026 to transfer their funds to a secure wallet with a new recovery phrase. This warning comes after the company received the customer’s report just two days prior to their announcement.
Details of the Compromise
The unauthorized board is reportedly positioned between the wallet’s main board and its display, equipped with a cellular module and antenna. This setup allows it to read the screen content, including the recovery phrase, and transmit it whenever the device is powered on. Trezor stated that this technology mirrors past incidents where compromised devices had been identified.
Advice for Affected Users
For users of any Trezor model acquired through CryptoBilis, Trezor provides the following recommendations:
- Immediately transfer funds to a new wallet with a new recovery phrase. Simply restoring the old recovery phrase on a different device does not ensure safety, as the compromised device may have already relayed the phrase.
- If a secure hardware wallet is unavailable, temporarily move funds to a reliable software wallet or a reputable exchange.
- Do not set up the wallet if it hasn’t been configured, and avoid entering an existing recovery phrase into it.
- Keep the potentially compromised device and contact Trezor Support. Assistance will include providing a replacement device or a voucher for one.
- If unsure about the origin of the device, check the seller’s information on your receipt or reach out to Trezor Support for clarification.
Further Investigations and Warnings
Trezor has received no reports of fund losses pertaining to the wallets sold through CryptoBilis. It’s noteworthy that the customer in question had already transferred his assets before discovering the issue. Furthermore, Trezor has noted a potential rise in phishing attempts related to this incident, warning users to be cautious of fraudulent communications.
Following Developments
On October 9, Trezor ceased its partnership with CryptoBilis following concerns about compromised hardware sales. Ledger, another significant player in the hardware wallet market, is also scrutinizing their customer reports related to devices bought from CryptoBilis. Similar findings of unauthorized hardware components have emerged, further spotlighting the risks associated with certain resellers.
Advisory from Singapore Police
In a related note, the Singapore Police Force issued an advisory on October 28 regarding malicious hardware components found in Ledger wallets purchased from nominated retail outlets in Singapore. The police are currently investigating at least two reported incidents since September 10, emphasizing the potential for compromised recovery phrases or private keys within these devices.
Conclusion
As the cryptocurrency landscape evolves, so do the tactics of malicious actors. Hardware wallet users must remain vigilant and proactive in protecting their assets. For the latest updates and assistance, Trezor encourages users to stay connected with their support channels.
