Trezor Warns of Suspected Spy Implant in Crypto Wallet That Could Steal Recovery Phrases

Trezor has warned that a suspected hardware implant inside a Trezor Safe 5 could steal recovery phrases and send them over a mobile network. The warning covers every Trezor model bought from CryptoBilis from March 2026 onward, although only one suspected device has been reported.

In its October 30 security notice, Trezor urged affected users to move funds to a newly created wallet with a new seed. The company has not examined the device and has received no reports of stolen funds from CryptoBilis buyers.

The March cutoff is a precautionary scope for customer action, not proof that every device sold since then was altered. The confirmed extent and operation of the suspected Trezor implant remain subject to laboratory examination.

Suspected Implant Targets the Wallet Screen

The report came from a customer in Indonesia who bought the Safe 5 through CryptoBilis on Tokopedia in August 2026. Trezor received the disclosure on October 28, reviewed photos, and interviewed the customer by video. The device is being sent to its security lab.[trezor]

According to the report, an extra circuit board sits between the wallet’s main board and screen. It contains a cellular module and antenna. The added hardware allegedly reads information shown on the display, including the wallet backup, and sends it over a mobile network while the device is plugged in.

That would make the screen connection a possible theft point. Rather than needing to break the wallet’s core security, an attacker could capture the recovery words when they appear during setup. This remains a reported method, not a finding confirmed through Trezor’s own testing.

A stolen recovery phrase can let someone restore a wallet elsewhere and control its funds. Cybersecurity News has also covered fake crypto wallet screens that seek the same secret through false recovery prompts. The suspected implant would target displayed information instead of relying on a user entering words into fake software.

The warning follows a separate investigation involving Ledger wallets supplied by CryptoBilis. According to Trezor, Ledger began investigating customer fund losses on October 9 and later confirmed physical tampering in some devices.

Cybersecurity News previously reported Ledger’s confirmation of an unauthorized hardware implant in a CryptoBilis device. Trezor removed CryptoBilis from its authorized reseller network on October 9 and began checking customer devices.

Despite the shared reseller, Trezor has not identified the attackers or confirmed that the same group targeted both brands. It is working with Ledger and other parties investigating the incident. Trezor also credited SEAL 911, the Security Alliance’s emergency response service, for helping with the report and customer support planning.

The customer who reported the suspected Trezor implant had already moved his funds before finding it. Trezor says it has received no reports involving other resellers. Its warning also covers stores selling devices supplied by CryptoBilis, not just purchases made directly from the reseller.

What Affected Trezor Owners Should Do

Trezor says moving the existing wallet backup onto another device does not fix the risk. Users need a fresh wallet with a newly generated seed, then must transfer their funds to it. Anyone who has not set up an affected device should leave it unused and never enter an existing recovery phrase.

If another secure hardware wallet is unavailable, Trezor recommends temporarily using a software wallet or familiar exchange. Its sending guide explains the transfer process. Users should carefully check the full receiving address before sending funds.

Customers should not rely on weighing or opening their devices to rule out tampering. Trezor says weight differences can have other causes and there is no dependable home inspection method.

Eligible CryptoBilis buyers can contact official Trezor Support for a replacement shipped directly or a voucher covering a new device. They should keep the original wallet. Trezor also warns that scammers may exploit the incident through fake emails, letters, or calls. Support will never ask for a recovery phrase.

The post Trezor Warns of Suspected Spy Implant in Crypto Wallet That Could Steal Recovery Phrases appeared first on Cyber Security News.