Trezor said it received a credible report of a suspected malicious implant in one Safe 5 wallet bought from former authorized reseller CryptoBilis. The company said the added hardware could capture a recovery phrase shown on the screen and transmit it over a mobile network when the wallet is powered. Trezor has reviewed photos and interviewed the customer but has not examined the device; laboratory verification is pending, and it said no related theft from its customers has been reported.
Trezor urged anyone who bought any of its wallet models from CryptoBilis since March 2026 to move their funds to a new wallet with a newly generated recovery phrase. Restoring the old phrase on another device would not remove the risk, it said, and buyers who have not initialized their devices should not use them. Trezor has not established whether the suspected implant is linked to compromised Ledger devices distributed through CryptoBilis; it plans to reduce its authorized reseller network starting Jan. 1, 2027.
