Trezor Warns of Suspected Spy Implant That Could Steal Crypto Wallet Recovery Phrases

Trezor has issued an urgent warning after receiving a credible report of a suspected hardware implant in a Safe 5 cryptocurrency wallet purchased from the former reseller CryptoBilis. The company has not independently verified the device, and so far, no CryptoBilis customers have reported losing funds to Trezor.

According to Trezor’s security advisory, the wallet was purchased through Tokopedia in August 2026. An Indonesian customer reported the suspected modification on October 28, sharing photographs and participating in a video interview with Trezor’s security team.

Suspected Implant Intercepts Display Data

The reported implant consists of an additional circuit board placed between the wallet’s main board and display. It allegedly incorporates a cellular module and antenna that can capture screen contents and transmit the information over a mobile network whenever the device receives power.

This could expose recovery phrases displayed during wallet initialization. Unlike OkoBot malware, which targets Ledger and Trezor recovery phrases through fraudulent software prompts, the suspected implant would intercept sensitive information inside physically modified hardware. Its reported capabilities remain unconfirmed pending laboratory examination.

Trezor said the modification appears similar to implants previously reported in Ledger devices. The company removed CryptoBilis from its authorized reseller network on October 9 after reports involving tampered Ledger wallets.

The incident highlights a different attack surface from campaigns such as Operation ASTERIX, which used voice phishing and fake wallet applications to steal recovery words. Here, the concern centers on potentially compromised distribution channels rather than deceptive applications alone.

Trezor’s precautionary warning covers all Trezor models purchased from CryptoBilis from March 2026 onward. Customers using affected devices should transfer assets to a newly created wallet with a fresh seed, rather than restoring their existing recovery phrase on another device.

Buyers who have not initialized their wallets should leave them unused and avoid entering existing recovery phrases. Trezor is offering replacements and asks customers to retain potentially affected devices for investigation. Four other devices examined from CryptoBilis customers showed no modifications.

The warning follows other incidents affecting the cryptocurrency supply ecosystem, including a separate shipping-provider breach exposing Trezor customer information. That disclosure concerned personal data, not evidence of this suspected hardware modification.

Trezor is investigating with SEAL_911 and emphasizes that legitimate support personnel will never request a wallet recovery phrase. Customers should obtain replacement devices through official channels.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.