(Headline article below) This was way to crafty, and you have to suspect a nation state actor with the purpose to dissuade people from self-custody, something governments have signaled a desire to outlaw or limit as they can’t steal your self-custody funds without a visit. Consequently, I would only buy direct from the manufacturer and carefully check the packaging. It used to be that securely installing firmware gave you some protection, but piggy back circuits to read the screen installed inside with cellular connectivity is pretty alarming. We’ll see a move to clear cases going forward as well as glued together cases where there is no way to repackage (BitBox02 Nova), though they could always manufacture new cases. But with AI taking over coding duties with so many operating systems, kernels, firmwares… you can’t trust other computer devices even if you keep them offline. And there have been several ways to transmit data from air-gapped computers to nearby compromised devices, so easily accomplished by nation state actors, who I believe were behind this attack on self-custody, too closely following the Coinkite Coldcard hardware wallet hacks.
A casing that does not simply snap back together
The casing halves of the BitBox02 and BitBox02 Nova are permanently bonded using glue at connecting pins. Separating the halves breaks those pins, making it harder to reattach the original casing cleanly. The force required can also leave marks on the outside of the enclosure.
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia.
Although the company has not yet received the device to examine it and confirm whether there is a malicious implant, it has warned potentially affected users to move their private keys and digital assets to known safe wallets.
Trezor wallets are physical devices that store cryptocurrency private keys and authorize transactions. Safe 5 is one of its latest models and is currently available for purchase from the official store.
According to Trezor, the concerns arose after it received a report from an Indonesian user who purchased a Safe 5 device from CryptoBilis through Tokopedia in August 2026.
The user opened it and found an extra circuit board between the wallet’s main board and screen, equipped with a cellular module and antenna.
Based on unconfirmed information supplied by that customer, the implant appears capable of reading information displayed on the screen, including the wallet recovery phrase, and transmitting it over a mobile network when plugged in.
CryptoBilis is the same retailer implicated in a Ledger implant incident that unfolded earlier this month, and the implants on the two devices appear to be similar in form and function.
Ledger later confirmed the compromise and asked resellers and distributors in Southeast Asia and Hong Kong to halt all sales until the investigation confirms their safety.
In response to the Ledger incident, and before it had any indication it was impacted, Trezor immediately stopped device sales through CryptoBilis on October 9, 2026. The company later announced it would restructure and tighten its reseller network globally to maintain higher levels of security.
Trezor says it is unaware of any funds being stolen as a result of a supply-chain attack, and promised to provide updates once it receives the device, which is currently being shipped to it.
Meanwhile, multiple reports of losses by Ledger users have emerged since earlier this month, and a recent Singapore police announcement added another $3,500,000 to the tally.
Source: Trezor
For now, Trezor recommends not setting up or using any device bought via CryptoBilis from March 2026 onward.
Users who have already done so are advised to move their funds to a newly created wallet with a new recovery phrase.
Buyers holding proof of purchase may contact Trezor for a replacement device or a voucher for a new device.
Trezor underlined that weighing devices is not a reliable way to determine if they have been tampered with.
.jpg)