A spy board was reported inside a Trezor Safe 5. Trezor says you can't reliably spot one yourself, so the real test is where your wallet came from.
A customer in Indonesia reported a hidden circuit board with a cellular modem inside a Trezor Safe 5 bought from the reseller CryptoBilis. It reportedly reads the recovery phrase off the screen and sends it out when the wallet is plugged in. Trezor hasn't examined the device yet but is treating the report as credible.
The catch: Trezor says you can't reliably check a wallet yourself, and you shouldn't open or weigh it. Its software checks look for fake firmware, which this kind of board doesn't change. The real check is your receipt.
Want to know how to check if your Trezor is tampered? The honest answer from Trezor itself is surprising: you can’t, at least not reliably. After a customer reported a hidden circuit board with its own mobile modem inside a Trezor Safe 5, the company told owners not to open or weigh their devices, and to check something simpler instead: who sold it to them.
That matters because the reported board was built to steal the one thing a hardware wallet exists to protect, the recovery phrase. With those words, a thief can rebuild your wallet on another device and empty it without ever touching yours. So far the problem is tied to a single reseller, CryptoBilis, but the steps below apply to anyone who owns a hardware wallet.
The most useful check takes a minute. Find your receipt or order confirmation and look at the seller’s name.
The customer who found the board did notice a weight difference. Trezor still says weighing isn’t reliable, because small differences can have ordinary causes, and opening a wallet can damage it without proving anything. There’s another catch. Trezor’s setup checks look for fake devices and modified firmware, the software inside the wallet. An implant that simply reads the screen doesn’t change the firmware, so those checks wouldn’t flag it. A spokesperson also admitted that seals and packaging aren’t enough protection on their own.
The extra board was wedged under the Safe 5’s display, above the main board, and carried its own antenna plus a cellular module. According to the report, it reads whatever the screen shows, including the recovery phrase Trezor calls the wallet backup, and sends it out over a mobile network whenever the wallet is plugged in.
The customer, based in Indonesia, bought the wallet from CryptoBilis in August through Tokopedia and reported it on October 28. He had already moved his money off it before he found the board. Trezor has seen his photos and interviewed him on a video call, but hasn’t examined the device in its lab yet.
Trezor’s chief commercial officer, Danny Sanders, explained why it warned people before confirming: the company would rather speak up now than learn later that someone lost funds while it waited. No CryptoBilis buyer has reported a loss to Trezor, though the company can’t see what’s in customers’ wallets.
This didn’t come out of nowhere. On October 9, Trezor cut ties with CryptoBilis, which had been its official seller across Southeast Asia, once rival maker Ledger began looking into losses among its own CryptoBilis customers. Ledger then confirmed a hardware implant in one device.
Ledger’s security team described a component that read the 24-word recovery phrase from the screen during setup and sent it over LTE using a built-in eSIM, without touching the wallet’s secure chip or its operating system. Onchain investigators estimate the related thefts at more than $86 million, and one analytics firm puts them at $93.2 million. Ledger hasn’t confirmed a total.
Trezor says the Safe 5 board appears to work the same way but won’t compare the two cases while both investigations run. Since cutting ties with CryptoBilis, it has inspected four of its devices bought from the reseller and found no tampering on any of them.
CryptoBilis sold in Southeast Asia, so most readers in North America and Britain aren’t directly affected. The lesson travels, though. The weak point here isn’t the wallet’s design. It’s the journey between the factory and you. A separate case showed that this isn’t only an Asian problem: Mark Karpeles, who once ran the Mt. Gox exchange, says a Ledger Nano X he picked up at a MediaMarkt store in Germany had a spying implant inside.
Practical rules that cut your risk:
Trezor’s instructions depend on whether you’ve started using the device:
Not this kind. Trezor’s setup checks target counterfeit devices and altered firmware, and a screen-reading board leaves the firmware unchanged.
Trezor has no reports involving any seller other than CryptoBilis so far. Keep following the basic phrase rules either way.
Yes. Keep the device and contact Trezor Support for a new wallet or a voucher.
You're reading the quick version.
Read next
Ondřej Surý: the unpaid volunteer who rushed PHP’s fix to the web
When two critical PHP flaws put most websites at risk, the fix reached millions of servers through one Czech engineer's spare-time project. Here's why that matters.
A poisoned update slipped an SSH key and hidden startup scripts onto up to 5,000 computers. Removing the extension won't clean it up. Here's what will.
A hijacked engineer laptop opened the door to the biggest crypto theft yet. Here is how it unfolded, who is blamed and what customers should do.
Work emails, phone numbers and internal access groups for a seventh of Homeland Security staff are now public. Here is what leaked and why experts worry.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
