The team of hardware wallet manufacturer Trezor has issued an official warning about a potential threat related to a Safe 5 device purchased through a third-party reseller, CryptoBilis. According to an internal investigation, the gadget's casing may contain a malicious module capable of intercepting data or interfering with the device's operation.
Of particular concern is the fact that modified versions of Ledger hardware wallets had previously been distributed through the same seller. This points to a systemic nature of the problem and forms a persistent supply channel for compromised devices into the secondary market.
Key facts and scale of the threat
The incident affects users who purchased the Safe 5 not through official Trezor channels but from third-party resellers. This practice creates a critical gap in the chain of trust: even with firmware protection mechanisms in place, physical access to the device allows attackers to implant hardware implants that are undetectable by standard software checks.
The CryptoBilis case is not isolated — it continues a series of incidents demonstrating the vulnerability of the "buying from a reseller" model. For crypto asset holders, this is a direct signal of the need to reconsider their practices for acquiring hardware wallets.
What Safe 5 owners should do
Users who bought the device from third-party sellers are advised to conduct a thorough check of the casing's integrity and contact official Trezor support to verify authenticity. At the slightest doubt about the gadget's origin, it is safer to initiate the transfer of funds to a new wallet purchased directly from the manufacturer and to generate a new seed phrase.
Ignoring the risk of a hardware implant means a potential loss of control over private keys — a scenario in which no software protection tools will be able to restore the security of funds.
Cryptalist analysis: The incident highlights the fundamental vulnerability of the secondary distribution model in the hardware wallet segment: physical compromise bypasses most software protections, while reputational risks are concentrated on the manufacturer rather than the reseller. For institutional holders, this is an argument in favor of strict supply chain control and mandatory device verification upon receipt. The self-custody market will continue to shift toward direct sales and enhanced authentication at the "hardware" level.