Trezor Warns Customers of Possible Device Tampering in Safe 5 Hardware Wallets

On Friday, Trezor revealed that an Indonesian user discovered an unauthorized circuit board inside a Trezor Safe 5, purchased on Tokopedia in August. The implant allegedly could capture sensitive information displayed on the device's screen, such as wallet recovery phrases, and transmit this data via cellular networks.

At this time, Trezor stated that it has not yet analyzed the compromised device nor received any reports of fund losses linked to this issue.

Danny Sanders, Trezor's Chief Commercial Officer, told Cointelegraph, 'We have not yet had the device in our lab, but we consider this report credible and prefer to alert users now rather than wait for confirmation and risk them losing their funds.'

A company representative indicated that sales through CryptoBilis were "very limited" but declined to share exact numbers.

The representative also mentioned that the point of tampering has not been pinpointed yet, and Trezor is reviewing its hardware security measures, acknowledging that current protections like seals and packaging are inadequate as standalone defenses.

This alert comes soon after reports emerged on October 9 about cryptocurrency losses related to Ledger wallets sold through CryptoBilis, where unauthorized hardware implants were confirmed by Ledger in affected products.

Security expert Joe Grand informed Cointelegraph that he warned Trezor in August about tampered Trezor One and Model T wallets sold by unauthorized vendors on TikTok and Facebook. Trezor clarified that its earlier statement citing no evidence of compromised devices referred exclusively to new wallets sold via authorized resellers.

Trezor explained that their device setup checks are designed to detect counterfeit hardware and firmware modifications. However, the implant found in the CryptoBilis-sold Ledger was capable of reading the screen data without altering the firmware. The exposed recovery phrase could enable attackers to restore wallets on other devices and steal funds.

On October 13, Trezor announced intentions to reduce the size of its reseller network in response to these security concerns.

This situation highlights the critical importance of purchasing hardware wallets exclusively from authorized sources and performing timely fund transfers if tampering is suspected, to ensure the security of users' cryptocurrency assets.

Given the risk of unauthorized implants capable of capturing sensitive wallet data and the difficulty in detecting such tampering, Trezor’s proactive warnings and planned reseller network reduction illustrate the ongoing challenge of maintaining hardware wallet integrity in a complex resale ecosystem.