Trezor says a Safe 5 wallet sold through a Southeast Asian reseller may hide a cellular chip that could send out a user's secret recovery phrase.
Trezor, a maker of physical crypto wallets, says it has credible reports that a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia may contain a hidden theft device. The company has not yet examined the device, so the tampering is not confirmed. It is still telling possibly affected buyers to move their money.
A user in Indonesia bought a Safe 5 from CryptoBilis through Tokopedia in August 2026. After opening it, the user found an extra circuit board between the main board and the screen. It carried a cellular module and an antenna.
Based on unconfirmed details from that customer, the part appears able to read what the screen shows, including the wallet's recovery phrase. It would then send that information over a mobile network when the wallet is plugged in. The recovery phrase is the set of secret words that restores a wallet. Anyone who has it can take the funds.
A hardware wallet is meant to keep your keys offline and safe. Here, the concern is that the device was altered before it reached the buyer, which a user may never notice.
CryptoBilis is the same retailer tied to a Ledger incident earlier this month. Trezor says the implants look similar in form and function. Ledger later confirmed the compromise and asked sellers in Southeast Asia and Hong Kong to halt sales. Reports of losses by Ledger users have emerged, and Singapore police recently added another $3,500,000 to the total.
Trezor advises against setting up or using any device bought through CryptoBilis from March 2026 onward. The warning names that reseller and that time period. Trezor stopped sales through CryptoBilis on October 9, 2026, before it had any sign it was affected. It says it knows of no funds stolen through a supply-chain attack so far.
Trezor also says weighing a device is not a reliable way to tell whether it was tampered with. A normal weight does not clear it.
The steps in the alert box above cover what to do, whether the device is still in its box or already in use. Buyers with proof of purchase can ask Trezor for a replacement or a voucher.
Trezor says the device is being shipped to it. It has promised updates once the device arrives and has been examined. Until then, the report remains unconfirmed. The company also says it will restructure and tighten its reseller network worldwide.
If you bought a Trezor through CryptoBilis from March 2026 onward, do not use it, and move your funds to a new wallet with a new recovery phrase.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
