Trezor flags possible seed-stealing implants in some CryptoBilis-sold Safe wallets

Key points

• Trezor parent SatoshiLabs issued a warning on 2026-11-02 about compromised wallets sold via CryptoBilis.
• The notice names Safe 3, Safe 5 and Safe 7 models and ties exposure to purchases from March 2026 onward.
• A hidden implant is intended to capture recovery phrases or seeds, which can lead to unauthorized wallet transfers.
• No CVE was assigned because the issue is hardware supply-chain tampering, not a software vulnerability.

On 2026-11-02, Trezor's parent company SatoshiLabs alerted customers that certain hardware wallets obtained through the reseller CryptoBilis may have been altered before reaching buyers. The vendor described a hidden implant in some units, designed to capture the recovery phrase that controls a wallet. The affected product names include the Trezor Safe 3, Safe 5 and Safe 7. Exposure is linked to purchases made from March 2026 onward, though the company indicated that only some wallets are involved rather than every unit sold through that channel.

The people most at risk are customers who bought one of those models through CryptoBilis instead of a direct or verified sales path. Because a recovery phrase is the master key to a crypto wallet, anyone who enters a seed into a tampered device should assume the secret may be exposed. That exposure can enable unauthorized transfers that empty the wallet. The vendor's warning also references a reseller link connected to the affected sales route, underscoring how distribution channels can become part of the attack surface.

This matters because hardware wallets are purchased specifically to keep keys offline and away from malware. A supply-chain implant defeats that expectation without relying on a software bug, which is why no CVE appears in the advisory. For government and education staff who use personal crypto devices, the case is a reminder that provenance and purchase history matter as much as device firmware. Organizations should not treat personal wallet incidents as enterprise breaches, but they can use the event to reinforce supply-chain awareness.

What to watch: official guidance from Trezor and SatoshiLabs, any serial-number or authenticity-check process, and updates on which CryptoBilis orders are in scope. Buyers should preserve packaging and order records, avoid entering a recovery phrase into a suspect device, and watch for unexpected wallet activity. The absence of a CVE does not mean low personal risk for an exposed seed; it means the remedy is device replacement and key rotation rather than a patch.

What to do now

1. Stop using any Trezor Safe 3, Safe 5 or Safe 7 purchased through CryptoBilis since March 2026, and do not enter a recovery phrase into it.
2. Check order records against the vendor's 2026-11-02 advisory and verify device authenticity only through official Trezor channels.
3. If a device may be affected, treat the seed as compromised and move assets to a newly generated wallet on a trusted device.
4. Purchase hardware wallets directly from the manufacturer or a verified authorized reseller, and avoid following reseller links from untrusted messages.
5. Report suspect devices to Trezor or SatoshiLabs and retain packaging, receipts and serial information for investigation.
6. Brief staff who use personal crypto wallets about hardware supply-chain tampering; keep organizational accounts and data separate.

Original source

Help Net Security