Trezor Warns of Compromised Hardware Wallets Following Ledger Security Breach
Malicious hardware implants discovered in devices sold through a former authorized reseller.
1Malicious Hardware Implant Discovery
Trezor identified a suspected malicious hardware implant within a Safe 5 wallet model. The device was purchased through CryptoBilis, a former authorized reseller based in Southeast Asia. The report, received on October 28, 2026, involves an unauthorized circuit board modification designed to capture sensitive user recovery phrases via cellular transmission.
2Sophisticated Supply Chain Attack
The compromised hardware features an additional circuit board installed between the main board and the screen. Equipped with a cellular module and antenna, the implant captures displayed data and transmits it over mobile networks when powered. This sophisticated physical modification mirrors recent supply chain attacks targeting the broader cryptocurrency hardware market.
3Connection to Ledger Scandal
This incident follows a massive security breach involving Ledger, where compromised devices distributed via CryptoBilis led to estimated losses of $93 million. Ledger confirmed that a highly organized criminal group orchestrated the attack. Trezor is currently investigating whether the same perpetrators are responsible for the suspected compromise of its own devices.
4Reseller Network Risk Mitigation
Trezor revoked CryptoBilis' authorization on October 9, 2026, following the initial Ledger reports. The company plans to significantly reduce its global authorized reseller network starting January 1, 2027. This strategic shift aims to regain control over the distribution chain and prevent further unauthorized physical tampering with consumer-facing hardware wallet products.
5Urgent User Security Protocols
Trezor advises all customers who purchased devices from CryptoBilis since March 2026 to immediately transfer funds to new wallets. Users must generate fresh recovery phrases, as restoring existing phrases on new devices will not mitigate the risk. Those who have not yet initialized their devices are strongly cautioned against doing so.
6Investigation and Verification Status
While Trezor has reviewed photographs and conducted customer interviews, it has not yet physically examined the compromised unit. The company treats the report as credible while awaiting laboratory verification. No funds have been reported stolen from Trezor customers thus far, and no similar reports have emerged from other authorized reseller channels.
7Replacement and Support Policy
Affected buyers are eligible for a replacement device shipped directly from the company or a voucher covering the cost of a new wallet. Trezor emphasized that this warning applies to all models purchased through CryptoBilis, despite the specific implant report being limited to a single Safe 5 device unit.
8Broader Industry Security Implications
The incident highlights critical vulnerabilities in hardware supply chains, where physical access to devices allows for sophisticated espionage. As manufacturers coordinate with security researchers, the focus remains on verifying the extent of the breach. This event underscores the necessity for rigorous distribution oversight to protect users from advanced, hardware-level criminal operations.