A customer in Indonesia opened a Trezor Safe 5 he bought from reseller CryptoBilis and reported an extra circuit board between the main board and the screen. It has a cellular module and antenna, reads the recovery phrase off the screen and sends it out when the device is plugged in.
What Trezor says
Trezor hasn’t examined the device yet, but it found the report credible enough to warn people now. Anyone who bought any Trezor from CryptoBilis since March 2026 should move funds to a new wallet with a new recovery phrase. Restoring the old phrase on another device doesn’t help. If you haven’t set it up, don’t. Contact Trezor Support for a replacement.
Singapore police separately warned on October 28 about tampered Ledger wallets from some local stores.
My take
Hardware wallets only protect you if the supply chain does. Buy direct from the maker, check the seals, and never type an existing seed into a new device.
God Bless, and Needs Garlic!
