Trezor Confirms Supply-Chain Implants in Three Safe 5 Hardware Wallets Sold by Reseller CryptoBilis

What Happened

Trezor has confirmed that three Safe 5 hardware wallet units sold through Southeast Asian reseller CryptoBilis contained malicious hardware implants. According to the report, the implants were designed to capture wallet recovery (seed) phrases and exfiltrate them to attackers over cellular networks. Trezor has released a fix in response.

Why It Matters

This is a hardware supply-chain compromise, not a software vulnerability in Trezor's own firmware or design. A device with a planted implant can defeat the core security promise of a hardware wallet: that recovery phrases never leave the device. Anyone who purchased a Safe 5 unit through this specific third-party reseller is at elevated risk, and the cellular exfiltration channel is notable because it can operate independently of the host computer's network, making it harder to catch with typical endpoint or network monitoring.

What Defenders and Users Should Do

• Only purchase hardware wallets directly from the manufacturer or explicitly authorized retailers; treat unofficial or regional resellers as an elevated-risk supply chain.
• Apply Trezor's released fix/guidance for affected devices as soon as possible.
• If a device was purchased through CryptoBilis or an unverified reseller, treat any recovery phrase ever entered on or generated by that device as potentially compromised and migrate funds to a new wallet with a freshly generated seed from a trusted device.
• Physically inspect devices for tampering (seals, casing, unexpected components) before first use, and verify firmware/device authenticity through the vendor's official attestation process if available.
• Security teams tracking hardware supply-chain risk should flag unusual cellular radio activity near air-gapped or offline-signing devices as an anomaly worth investigating, where feasible.

Developing Story

Details on the implant's exact mechanism, scope of affected units, and attacker infrastructure are still emerging from reporting. This is net-new intelligence and not tied to a specific CVE at this time. For the full report, see BleepingComputer's coverage.