Trezor urges CryptoBilis customers to generate new wallets as it probes alleged Safe 5 tampering

Trezor has told customers who bought a Safe 5 hardware wallet through reseller CryptoBilis since March 2026 to move their funds to new wallets and generate new recovery seeds, after a disclosure report alleged the device contained unauthorized hardware. No losses have been reported, and the company is investigating whether the case is isolated.

Why the CryptoBilis connection raises supply-chain concerns

The allegations involving CryptoBilis are particularly concerning because the reseller has already been linked to a separate hardware wallet security investigation involving rival manufacturer Ledger.

In October 2026, Ledger confirmed that unauthorized hardware implants had been discovered in devices sold through CryptoBilis. According to reporting by The Block, Ledger’s security researchers found components capable of capturing recovery phrases displayed during device setup and transmitting the information through an embedded cellular connection.

That incident demonstrated how physical manipulation can undermine the security assumptions behind hardware wallets. A device may appear genuine, operate normally and still contain unauthorized components designed to expose sensitive information.

The reported Trezor case therefore raises an important question about the security of third-party distribution channels. Even when manufacturers maintain strong security standards during production, they may have limited visibility into what happens to devices after they leave the factory.

For cryptocurrency investors, this means checking the source of a hardware wallet is just as important as understanding its technical security features.

However, the Ledger findings should not automatically be treated as proof that Trezor devices were compromised through the same method. The reported Trezor case remains a separate allegation, and its technical details have not been independently established.

How hardware implants could put cryptocurrency funds at risk

Hardware wallets are designed to keep private keys away from internet-connected devices, reducing exposure to malware, phishing attacks and remote hacking attempts. However, physical interference introduces a different category of risk that traditional software security measures may not fully address.

The suspected Safe 5 device compromise highlights the importance of protecting the entire hardware supply chain, rather than focusing exclusively on firmware and software authentication.

Trezor’s Safe 5 incorporates a Secure Element chip designed to strengthen wallet security and verify device authenticity. The manufacturer explains that each device receives a unique certificate during production, which is stored securely within the chip.

Nevertheless, the possibility of unauthorized physical modifications demonstrates why device authenticity checks and trusted distribution channels remain important.

Trezor previously addressed concerns about hardware tampering in comments reported by Cointelegraph. A company spokesperson explained: “Our setup checks are built to catch counterfeit devices and modified firmware.”

The spokesperson also noted that the implant discovered in a CryptoBilis-purchased device operated differently because it could read information displayed on the screen without modifying the firmware. The company said at the time that it had not observed this specific attack on its devices in the real world.

The newly reported disclosure makes the distinction between earlier assurances and the latest security concerns particularly important. It does not establish that Trezor’s wider product range or manufacturing systems have been compromised.

Trezor customers urged to generate new wallets

The immediate priority for affected customers is protecting their existing cryptocurrency holdings.

Trezor’s recommendation is for anyone who purchased a Safe 5 device through CryptoBilis from March 2026 onward to move their assets into newly created wallets backed by fresh recovery seeds.

Generating a completely new recovery seed is essential. Simply transferring cryptocurrency to another address controlled by the same potentially exposed recovery phrase would not adequately address the underlying risk.

Customers should also avoid entering their existing recovery phrases into websites, applications or devices claiming to provide security verification. Recovery phrases should remain private and should never be shared with customer support representatives or third parties.

For users who suspect their devices may have been tampered with, the safest approach is to follow Trezor’s official security instructions and contact the company’s support team through its verified website.

The reported incident also reinforces the importance of purchasing hardware wallets directly from manufacturers or carefully verified authorized distributors. Trezor’s existing device authentication system provides an additional security layer, but customers should not treat a genuine-looking product or functioning firmware as conclusive proof that its physical components have never been altered.

For now, the reported compromise remains under investigation, and no cryptocurrency losses have been confirmed among affected Trezor customers.

The situation nevertheless serves as a warning to the wider digital asset industry: securing cryptocurrency requires more than strong encryption and sophisticated software. The physical integrity of the devices protecting users’ private keys is equally important.

As investigations into CryptoBilis-linked hardware continue, cryptocurrency holders will be watching closely for further disclosures about the scope of the suspected tampering and the measures manufacturers introduce to prevent similar incidents.