Trezor has issued a security warning after a customer reported that a Trezor Safe 5 hardware wallet purchased from reseller CryptoBilis appeared to contain an additional circuit board. According to Trezor, the reported modification could transmit the wallet recovery phrase over a mobile network. The company said it has not yet physically examined the device, but it is advising customers who bought a Trezor from CryptoBilis since March 2026 to move funds to a new wallet and create a new recovery phrase.

What happened

The reported issue concerns a hardware wallet sold through a third-party reseller rather than directly from the manufacturer. Trezor said the customer’s device allegedly included an extra component not expected to be present in the product. If confirmed, this would represent a serious hardware tampering case because the recovery phrase is the critical secret used to restore access to crypto assets.

At the time of the warning, Trezor said it had not yet examined the wallet itself. That means the presence and full behaviour of the suspected implant had not been independently verified by the company at the time of its public notice. Even so, Trezor issued precautionary guidance to affected buyers due to the potential severity of the risk.

Why it matters for European businesses

For businesses that hold digital assets, this is a reminder that cybersecurity risks can extend beyond software and cloud systems into the physical supply chain. A compromised device can undermine otherwise strong security controls if it is altered before reaching the end customer.

The incident is also relevant beyond cryptocurrency. European companies increasingly rely on specialist hardware for authentication, secure signing, encrypted storage and financial operations. If a reseller or distribution channel is compromised, businesses may face theft, fraud, operational disruption or compliance problems, especially where regulated assets or customer funds are involved.

For SMEs, the practical lesson is that procurement security matters. Buying security-sensitive devices from third parties may introduce risks that are harder to detect than phishing emails or malware, particularly when tampering occurs at hardware level.

Who may be affected

• Businesses holding crypto assets for treasury, payments or investment purposes.
• E-commerce and digital businesses that accept cryptocurrency and use hardware wallets for custody.
• IT and security teams responsible for device procurement, secure storage and access controls.
• Founders and finance teams at smaller companies where wallet setup and custody may be handled informally.
• Companies using third-party resellers for security-sensitive hardware, including authentication or signing devices.

What companies should consider

• Check purchase history: Identify whether any Trezor devices were bought from CryptoBilis since March 2026.
• Rotate affected wallets: If your business is affected, follow Trezor’s precautionary guidance to move assets to a new wallet and generate a new recovery phrase.
• Treat the old recovery phrase as compromised: If a phrase may have been exposed, simply keeping the same wallet structure is unlikely to be sufficient.
• Review reseller policies: For security-critical devices, assess whether procurement should be limited to direct manufacturer channels or vetted distributors with stronger chain-of-custody controls.
• Strengthen internal handling procedures: Require device inspection, documented setup, dual control for wallet creation and secure storage of backup phrases.
• Reduce concentration risk: Avoid relying on a single device, person or recovery method for business-held assets.

While the report concerns a specific crypto hardware wallet, the broader business issue is supply chain trust. For European companies using physical security devices, the incident reinforces the need to evaluate not only the product itself, but also how it was sourced, delivered and initialized before use.