Today, Trezor issued a security advisory dated October 30 about a hardware wallet suspected of having been tampered with.
The case involves an Indonesian user who bought a Trezor Safe 5 from the reseller CryptoBilis on Tokopedia in August. On October 28, they reported to Trezor that there was an extra circuit board inside, fitted with a cellular module and antenna and wedged between the mainboard and the screen. According to the report, the board transmits what is displayed on the screen when the device is powered on, including the recovery seed phrase. To be clear, the device has not yet been sent to Trezor’s lab, the mechanism has not been officially confirmed, and no CryptoBilis customer has reported losing money to Trezor as a result. This is a precautionary alert, not a confirmed case of widespread theft.
The danger to retail users here isn’t that the technology is especially sophisticated; it’s that the chain of trust broke at the last place it should have. Many people buy a hardware wallet for peace of mind, assuming that if it comes through an official channel, it must be safe. But the problem occurred at the reseller stage. More concerning, there had already been a confirmed case of Ledger devices being tampered with by the same reseller, and Trezor removed it from its list of authorized resellers on October 9. This advisory covers all Trezor models bought from CryptoBilis after March 2026, not just this one Safe 5.
If you bought from this reseller, there are three things you can do right now. First, don’t rush to restore your old seed phrase onto another device. Trezor is clear that this would just be changing the packaging, not solving the problem. The right approach is to create a new wallet with a completely new seed phrase, then transfer your assets to it. Second, don’t use any affected device that hasn’t been activated, and don’t enter an existing seed phrase into it. Third, keep the original device and contact official customer support to ask about a replacement or voucher. Treat any email, letter, or phone call that uses this incident as a pretext to ask for your seed phrase as a scam—official support will never ask for it.
One other detail is worth remembering: Trezor says that weighing a device or taking it apart yourself isn’t a reliable way to tell, and inspections of the four devices submitted so far have found no signs of tampering. So don’t assume you’re in the clear just because your device looks normal, and don’t assume the advisory doesn’t apply to you just because it mentions only one device. What matters is where and when you bought it.
When buying a hardware wallet, do you first check whether the seller is officially authorized, or do you just look at the price and how quickly it ships?
#Trezor #硬件钱包 #钱包安全 #防骗
—— web3 leek Kai
Disclaimer: The above is a personal sharing and does not constitute investment advice. It is for learning and discussion purposes only. The crypto market involves risks; proceed with caution.
The case involves an Indonesian user who bought a Trezor Safe 5 from the reseller CryptoBilis on Tokopedia in August. On October 28, they reported to Trezor that there was an extra circuit board inside, fitted with a cellular module and antenna and wedged between the mainboard and the screen. According to the report, the board transmits what is displayed on the screen when the device is powered on, including the recovery seed phrase. To be clear, the device has not yet been sent to Trezor’s lab, the mechanism has not been officially confirmed, and no CryptoBilis customer has reported losing money to Trezor as a result. This is a precautionary alert, not a confirmed case of widespread theft.
The danger to retail users here isn’t that the technology is especially sophisticated; it’s that the chain of trust broke at the last place it should have. Many people buy a hardware wallet for peace of mind, assuming that if it comes through an official channel, it must be safe. But the problem occurred at the reseller stage. More concerning, there had already been a confirmed case of Ledger devices being tampered with by the same reseller, and Trezor removed it from its list of authorized resellers on October 9. This advisory covers all Trezor models bought from CryptoBilis after March 2026, not just this one Safe 5.
If you bought from this reseller, there are three things you can do right now. First, don’t rush to restore your old seed phrase onto another device. Trezor is clear that this would just be changing the packaging, not solving the problem. The right approach is to create a new wallet with a completely new seed phrase, then transfer your assets to it. Second, don’t use any affected device that hasn’t been activated, and don’t enter an existing seed phrase into it. Third, keep the original device and contact official customer support to ask about a replacement or voucher. Treat any email, letter, or phone call that uses this incident as a pretext to ask for your seed phrase as a scam—official support will never ask for it.
One other detail is worth remembering: Trezor says that weighing a device or taking it apart yourself isn’t a reliable way to tell, and inspections of the four devices submitted so far have found no signs of tampering. So don’t assume you’re in the clear just because your device looks normal, and don’t assume the advisory doesn’t apply to you just because it mentions only one device. What matters is where and when you bought it.
When buying a hardware wallet, do you first check whether the seller is officially authorized, or do you just look at the price and how quickly it ships?
#Trezor #硬件钱包 #钱包安全 #防骗
—— web3 leek Kai
Disclaimer: The above is a personal sharing and does not constitute investment advice. It is for learning and discussion purposes only. The crypto market involves risks; proceed with caution.
