Trezor warns of tampered Safe 5 wallets sold via CryptoBilis in Southeast Asia

Key points

• Trezor issued a warning about Safe 5 devices sold through CryptoBilis in Southeast Asia.
• Reports suggest some units may have been altered, possibly with an implanted component.
• The concern is theft of crypto assets, not a software CVE.
• Users should avoid suspect devices and verify authenticity through official channels.

Trezor has warned customers that its Safe 5 hardware wallets distributed through CryptoBilis, a reseller operating in Southeast Asia, may not be genuine. According to the company, credible reports point to tampered units, including a suspected implant, and the apparent result has been theft of cryptocurrency from affected users. The attackers behind the modification are not identified.

The issue affects people who obtained a Safe 5 through that specific reseller path rather than directly from Trezor or an authorized source. Because hardware wallets are designed around the assumption that the device itself is trustworthy, any alteration before it reaches the buyer undermines the core security model. A compromised unit can expose recovery information or manipulate the setup process without the owner realizing it.

This is not a case tied to a CVE or a firmware vulnerability. It is a supply-chain and distribution problem: a device that appears normal on the outside may have been changed somewhere between the manufacturer and the customer. That distinction matters because patching software will not fix a physically altered wallet, and standard endpoint controls may not detect it.

For schools and government offices, the practical risk is limited to staff who use personal crypto wallets, but the lesson is broader. Third-party resellers can introduce risk into any hardware procurement pipeline, especially in regions where official distribution is less direct. Buyers should treat unverified packaging, unusual setup prompts, and devices from unexpected sources as red flags.

What to watch: further guidance from Trezor, any serial-number or authenticity-checking mechanism, and reports from other resellers in the region. Anyone holding a Safe 5 bought through CryptoBilis should stop using it for high-value accounts until its provenance is confirmed. Preserve the device and packaging if tampering is suspected, and report the purchase to the vendor.

What to do now

1. Inventory any Trezor Safe 5 devices purchased through CryptoBilis or other third-party resellers and flag them for review.
2. Stop using suspect devices immediately; do not enter a recovery seed or generate a new wallet on them.
3. Verify authenticity using Trezor's official verification guidance and contact the vendor directly for confirmation.
4. Advise affected staff to move remaining crypto assets using a known-good device and a newly generated recovery phrase.
5. Preserve suspect devices and packaging for investigation; avoid resetting or discarding them until instructed.
6. Update procurement policy to require hardware security purchases from the manufacturer or an authorized distributor.
7. Monitor official Trezor advisories and regional reseller notices for updated indicators or serial-number checks.

Original source

BleepingComputer