Trezor Confirms Three Tampered Safe 5 Wallets in Supply-Chain Review

Trezor has confirmed that three of 48 Safe 5 hardware wallets submitted for inspection contained malicious boards capable of capturing recovery seeds and passphrases displayed on the device screen. The company traced all three compromised units to sales conducted between Aug. 20 and Sept. 23, 2026, through the reseller CryptoBilis and its storefronts on the Indonesian marketplaces Tokopedia and Shopee.

The findings close the diagnostic loop on a supply-chain compromise that Trezor had previously acknowledged. Of the 48 customers who contacted the company and sent devices in for examination, only three carried the implant — roughly one in sixteen, a low hit rate that still carries severe consequences for the affected minority, because the stolen credential is the wallet itself.

How the implant works

Trezor described the malicious hardware as an additional board sandwiched between each wallet's main circuit board and its display. Positioning matters here. Because the implant sits directly on the display path, it can read everything the screen renders, including the recovery seed words and passphrase the user enters or reviews.

The board then exfiltrates that data over a cellular network to a server controlled by the attackers. That detail deserves attention from practitioners: the implant does not depend on the wallet's USB connection or on the host computer. A user who follows standard operational hygiene — an air-gapped machine, a clean OS — gains no protection, because the exfiltration channel is entirely independent of the computer.

What does this change for affected users?

Trezor stated that the three confirmed cases have not produced customer fund losses. The company's guidance to affected users is direct: move all funds to a new wallet created with a fresh recovery seed. A firmware update cannot remediate the situation, because it cannot erase credentials already exposed to the implant. Once a seed has been displayed on a tampered screen, it must be treated as burned.

For customers who bought a Safe 5 through CryptoBilis or its Tokopedia and Shopee stores during the Aug. 20 to Sept. 23, 2026 window, the practical question is whether their device is one of the three. Trezor's inspection program answered that question for the 48 users who came forward. Buyers outside that group who purchased from the same channels in the same period should treat their device as unverified until inspected, and any seed generated or displayed on it should be considered potentially compromised.

The wider lesson for the industry is operational rather than technical. The compromise did not involve a flaw in Trezor's firmware, chip design or manufacturing. It was an interdiction attack at the reseller layer, where devices passed through a third party before reaching customers. That vector puts the burden on buyers to verify the integrity of the retail chain, not just the vendor.

TokenPost previously reported Trezor's confirmation of malicious implants in three CryptoBilis-sold wallets.

Trezor has not disclosed whether additional devices from the same sales window remain in circulation, so customers who purchased through those storefronts in that period face a verification window that remains open until every unit is inspected or its seed retired.