Trezor has issued an urgent security warning after receiving a credible report of a suspected malicious hardware implant in one of its cryptocurrency wallets. The affected product is a Trezor Safe 5, reportedly purchased from reseller CryptoBilis in August 2026.

The warning comes amid growing concerns that physically modified cryptocurrency storage devices may be entering retail distribution channels. However, Trezor has not yet received the suspected device for examination, and the company has not confirmed whether the wallet actually contains a malicious implant. Until the device can be physically inspected, the claim can be neither verified nor ruled out.

Importantly, no CryptoBilis customer has reported losing cryptocurrency funds in connection with the suspected incident. The manufacturer is continuing its investigation while taking precautionary steps to protect customers, urging anyone who bought a Trezor device from CryptoBilis since March 2026 to transfer their funds to newly created wallets.

Hardware wallets are designed to store cryptocurrency private keys securely, making the physical integrity of each device essential. A compromised device could potentially expose sensitive wallet information, depending on how it has been modified.

Trezor Urges CryptoBilis Customers to Move Funds

Following the warning, Trezor advised customers who purchased Trezor devices from CryptoBilis since March 2026 to move their cryptocurrency to newly created wallets. The company specifically recommends generating new recovery seeds rather than continuing to rely on existing ones.

A recovery seed is a set of words used to restore access to a cryptocurrency wallet. If an attacker obtains that information, they may be able to access the associated funds. Trezor said customers should create replacement wallets using a trusted, verified device and ensure the new recovery seed is generated independently. Simply resetting a potentially compromised device or reusing an existing recovery phrase may not adequately address the risk.

Users should also avoid entering recovery phrases into websites or sharing them with anyone claiming to provide support. Trezor stressed that the warning is precautionary and does not establish that every Trezor wallet sold through CryptoBilis has been compromised.

World’s Second-Largest Hardware Wallet Maker Trezor Warns of Suspected Hardware Implant in Device Sold by Reseller Trezor said it received a credible report of a suspected hardware implant in a Trezor Safe 5 device purchased from reseller CryptoBilis in August 2026. The… pic.twitter.com/Ho7T37aDhn

— Wu Blockchain (@WuBlockchain) October 30, 2026

https://x.com/WuBlockchain/status/2116071063134330909?ref_src=twsrc%5Etfw

In the post, Wu Blockchain described Trezor as the world's second-largest hardware wallet maker.

Trezor Investigation Continues After Ledger Reports

The latest Trezor hardware wallet warning follows earlier concerns involving tampered Ledger devices. Trezor removed CryptoBilis from its reseller network on October 9, following reports about modified Ledger hardware wallets. The same reseller thus sits at the center of modification concerns spanning two hardware wallet brands, placing the third-party retail channel at the focal point of the inquiry.

As part of its investigation, the company has also inspected four Trezor devices. None of those four devices showed signs of tampering. However, the suspected Safe 5 device has not yet been examined, leaving the central allegation unresolved.

The incident highlights the importance of securing cryptocurrency hardware throughout the distribution process. Even well-designed hardware wallets can face risks if devices are physically modified before reaching customers.

For now, Trezor is urging potentially affected CryptoBilis customers to prioritize moving their assets to wallets protected by fresh recovery seeds. The company has not confirmed a successful attack involving the suspected Safe 5 device, and its investigation remains ongoing. The decisive open item is the physical examination of the suspected Safe 5, along with whether any CryptoBilis customer reports a confirmed loss; so far, neither has occurred.

Source: CoinoMedia