Trezor tells CryptoBilis buyers to move funds over a suspected hardware implant

Hardware wallet maker Trezor has told some customers to move their crypto to safety after a report that one of its devices may have been physically tampered with before sale.

What happened

Trezor received a report of a suspected hardware implant inside a Safe 5 wallet sold by CryptoBilis, a reseller. The company has not yet examined the device itself, but said it is treating the report as credible. It urged anyone who bought a Trezor from CryptoBilis since March to move their funds to a new wallet.

In a separate case, police in Singapore say tampered Ledger devices began showing up there on September 10, about a month before the issue became widely known.

Background

Hardware wallets keep the keys that control crypto on a small dedicated device, away from internet-connected computers. That protection depends on the device being genuine. An implant added after it leaves the factory could, in principle, leak secret keys or change transactions without the owner noticing.

This is why wallet makers advise buying directly from them or from authorised sellers, and checking that packaging and security seals are intact. Most devices also run a check at setup to confirm the firmware is genuine, but a physical implant may be designed to avoid that.

Why it matters

Supply-chain attacks are hard to spot because the victim does everything right after unboxing the device. Two reports involving the two best-known hardware wallet brands within weeks suggest attackers see resellers as an opening.

For owners, the safest step is simple: if a device came from an unofficial seller, set up a new wallet from a trusted source and move the funds.