Trezor Finds Spy Chips in Three Safe 5 Wallets Sold Through a Malaysian Reseller

Hardware wallet maker Trezor confirmed that three of its Safe 5 devices contained hidden spy chips. The wallets were sold in August and September 2026 through CryptoBilis, a reseller in Malaysia. The chips could read a wallet's seed phrase from its screen and send it to scammers over a mobile network.

Why it matters

A hardware wallet is supposed to be the safest place to keep crypto. The seed phrase is the list of words that can restore the wallet anywhere. Whoever has it controls the funds.

These implants show that a wallet can be tampered with before it reaches you. If you own a Trezor Safe 5, install the latest firmware now: Trezor says the new version blocks implants like these. If you bought any hardware wallet from a third-party seller, consider moving your funds to a new wallet bought directly from the manufacturer, with a new seed phrase.

What Trezor found

Trezor checked the devices of 48 users who contacted the company. Three of them had an extra circuit board fitted on top of the genuine one, plus an extra antenna and wires. Trezor has not reported any thefts linked to these devices.

The company says the chips work like the implants found earlier in Ledger wallets, only adapted to the Safe 5's display. It has cut its reseller network by 80% and tightened control over how wallets are shipped and stored.

The Ledger case

In early October, Ledger wallets sold through the same reseller, CryptoBilis, were found with soldered-in modules that steal seed phrases. Outside estimates put losses from those devices at more than $90 million. Ledger says an organised group bought devices, planted the implants and put them back on sale through official resellers. Ledger's own systems were not hacked.