Summary : The discovery of unauthorized circuit boards in Trezor Safe 5 and Ledger devices was not caused by vulnerabilities in the secure chips or manufacturing processes, but by unauthorized tampering with devices within the specific distribution channel of CryptoBilis in overseas locations to secretly read recovery codes from the screen. Currently, there have been no reports of any Trezor customers losing assets, and those who purchased devices directly from the manufacturer or through official distributors in Thailand that import directly from the factory are not at risk from this incident.
- Tracing Back from the Ledger Incident to the Latest Trezor Warning: The Common Link is CryptoBilis
- Lessons from the Ledger Incident in Early October and Device Tampering in the Supply Chain
- What Happened with the Latest Trezor Safe 5 Incident, and Why There Have Been No Reports of Financial Loss
- The Core of What Happened: Secure Chips Were Not Breached, but Screens Were Secretly Read During Setup
- The Mechanism of a Hidden Circuit Board (Hardware Implant) Between the Screen and Motherboard
- Why Tampered Devices Still Passed the Genuine Check
- Guidance for Users: What to Do and What Not to Do in This Situation
- What Not to Do and Precautions to Avoid Making Mistakes
- What to Do: Proper Risk Management and Security Enhancement Steps
- Risk Comparison Table and Response Guidelines by Source and Storage Method
- Summary
- Frequently Asked Questions (FAQ)
Seeing consecutive headlines about security issues with world-leading crypto wallet brands in a single month has surely made many Bitcoin and digital asset holders feel uneasy.
Especially today, when Trezor has just issued a warning to users who previously purchased devices through an overseas reseller named CryptoBilis after reports of unauthorized electronic components found inside Trezor Safe 5 devices.
When this news broke, images from the Ledger incident in early October immediately came back to mind for many, raising numerous lingering questions.
So, are the hardware wallets we hold really safe? Do we need to open the covers to check or weigh the devices as people on social media have suggested? Or where should we move our coins to be safest in this situation?
Today, I will help you set aside your panic for a moment and slowly lay out the facts from start to finish to explain what really happened, what technical essentials we need to understand, and what we should and should not do as users in this situation.
Tracing Back from the Ledger Incident to the Latest Trezor Warning: The Common Link is CryptoBilis
If we only read the short headlines, we might mistakenly think that serious vulnerabilities occurred in both companies' systems at the same time. But if we step back and look at the big picture from early 2026, we will see a key puzzle piece that connects both incidents: the name of a Southeast Asian reseller named CryptoBilis.
Lessons from the Ledger Incident in Early October and Device Tampering in the Supply Chain
The whole story began on October 9, 2026, when several Ledger wallet users in Southeast Asia discovered that their wallet assets had been transferred without their knowledge.
An in-depth investigation by the Ledger Donjon security research team, together with an analysis report from Halborn, found that criminals had purchased genuine Ledger devices, opened them up to install small electronic components inside, and then reintroduced them into the distribution system through CryptoBilis (attempts were also detected to return tampered devices to retail stores in Singapore and Germany, forcing Ledger to strictly prohibit resellers from reselling returned products).
The latest blockchain transaction tracing data from October 29, 2026, by Arkham Intelligence, reported via Crypto.news, indicated that the confirmed damage from the Ledger incident linked to devices from CryptoBilis was approximately 95.35 million USD, or around 3,218.8 million Thai baht (calculated at an exchange rate of 33.76 baht per USD, based on data from Xe), spread across 1,486 affected addresses. Tether was able to freeze some of the related USDT, approximately 10 million USD, or around 337.6 million baht.
As soon as it was discovered that the source of the damage was linked to devices sold through CryptoBilis, Trezor, which also had the store on its list of resellers, decided to remove CryptoBilis from its official reseller network immediately on October 9, 2026, and announced a stricter restructuring and screening of resellers worldwide to prevent future risks.
What Happened with the Latest Trezor Safe 5 Incident, and Why There Have Been No Reports of Financial Loss
After Trezor revoked CryptoBilis's rights, the company accepted devices from customers who had purchased them through the store for laboratory inspection. As of October 19, 2026, Trezor had inspected 4 devices sent in (consisting of 2 Trezor Safe 5 devices, 1 Safe 7, and 1 Safe 3), none of which showed any signs of tampering.
However, on October 28, 2026, Trezor received a new tip from a user in Indonesia who had purchased a Trezor Safe 5 from CryptoBilis on the Tokopedia e-commerce platform in August 2026. The user noticed an unusual weight to the device and opened it up, discovering that an unauthorized circuit board had been installed inside.
The most important thing I want you to underline is that, according to the statement in the official r/TREZOR community on Reddit and reports from Binance News up to this moment, not a single Trezor customer has reported losing even a single baht. The Indonesian user who discovered the anomaly had safely transferred their coins out of the wallet before opening the device and discovering the component.
Although Trezor's laboratory is currently waiting to receive the actual device from Indonesia for forensic inspection, after the team reviewed the photos and interviewed the user via video call with the SEAL 911 emergency response team and determined the information was highly credible, Trezor chose to issue a warning to customers who had purchased devices from CryptoBilis since March 2026 to move their coins out as a precaution.
The Core of What Happened: Secure Chips Were Not Breached, but Screens Were Secretly Read During Setup
The key question I believe immediately came to your mind is: since both Trezor Safe 5 and Ledger have high-level security systems and secure chips inside, why were the attackers still able to steal the recovery codes?
To understand the core of this incident without getting sidetracked, we must first distinguish between "secure chip system security (Cryptography & Secure Element)" and "physical tampering during distribution."
The Mechanism of a Hidden Circuit Board (Hardware Implant) Between the Screen and Motherboard
Based on technical investigations into both the Aviatrix Threat Research case and the report by Crypto.news, the foreign component found was a miniature circuit board placed between the main motherboard and the device's display screen. This additional circuit board also featured an installed cellular network communication module (Cellular / LTE eSIM) and a small antenna.
The sole purpose of this hidden circuit board was to intercept the video signal sent to the screen when a user turns on the device to create a new wallet and record a 12 or 24-word Seed Phrase. Once it reads the words on the screen, the communication module immediately transmits that Seed Phrase via cellular signal to the attacker's server as soon as the device is plugged into a USB port.
Once the attacker has the Seed Phrase, they no longer need to touch anyone else's device, as they can use those words to recover the wallet on another device and transfer the coins from anywhere in the world.
Why do devices modified in transit still pass the Genuine Check?
Another point of confusion for many is why devices fitted with such foreign circuit boards still pass the Genuine Check normally when connected to the Trezor Suite or Ledger Live applications.
The answer is found in the report by The Record and the statement from Ledger. This is because the Genuine Check process is a mathematical conversation between the software and the Secure Element chip on the main motherboard.
In this case, the attacker did not modify, tamper with, or touch the Secure Element chip, operating system, or transaction signing system of the device at all. The device's main chip is still a 100% genuine factory-made chip. It therefore responds to the software normally, confirming that it is genuine, without the main chip ever knowing that the ribbon cable sending the video output to the screen is being secretly eavesdropped on by the additional circuit board in transit.
What does this truth tell us? It tells us that the security architecture of the Hardware Wallet has not collapsed, but the real weakness in this incident was the interference in the "distribution channel" that the device passes through before reaching the user.
Guidelines for Users: Summary of What to Do and What Not to Do in This Situation
Now that we understand the full mechanism—that the problem did not arise from an internet virus or a chip vulnerability, but from the modification of the device in the supply chain of the CryptoBilis store—the most important thing now is to clearly distinguish who needs to take action and what we should not do out of panic.
What Not to Do and Precautions to Avoid Making Mistakes
- Do not rush to transfer coins in a panic if you did not buy from a risky channel: According to the official investigations by both Trezor and Halborn, Trezor's damage and warnings in this instance are limited only to devices distributed through the CryptoBilis store abroad. Therefore, if you ordered the device directly from the manufacturer's website or through an authorized reseller in Thailand such as Bitcast, which imports directly from the manufacturer, and there was no resale of opened or returned products, your device is safe from this incident. Rushing to transfer coins back and forth in a panic while not being in the risk group may make it easier to make mistakes such as transferring to the wrong address or accidentally entering a fake website.
- Do not use only weight or appearance as a criterion for safety (and do not pry open the device yourself if you bought it from a safe source): Although the case in Indonesia was able to detect an abnormality because the user noticed the change in weight and decided to pry it open, Trezor has warned that weighing should not be used as a primary indicator, because the modified chip is very small and the weight of each device batch may naturally vary. If someone who bought from a risky store like CryptoBilis weighed the device and saw that the weight looked normal, they might become complacent and not transfer the coins out (even though the inside may have already been modified). Furthermore, Trezor wants those who bought from such a store to keep the device in its original condition as evidence to claim a new device directly. For those who already bought from a safe channel, there is no need to pry open your device cover and break it or void the warranty.
- Do not mistakenly believe that setting a Passphrase on a modified device will protect you: This is an important technical point that I want to warn you about especially. Normally, the Passphrase feature is an excellent defense if our Seed Phrase paper is stolen. But in the case of a device fitted with a screen-reading implant, when we type the Passphrase on the touch screen, or even type it on the computer and the device pops up a Passphrase message for us to confirm on the device screen, the hidden circuit board can read both the Seed Phrase and the Passphrase on the screen at the same time. Therefore, if the device came from a compromised source, entering a Passphrase on the same device does not help solve this problem.
- Do not believe emails, messages, or phone calls claiming to be from the team asking to check your wallet: Trezor has issued a warning that scammers will take advantage of this news to send emails, make phone calls, or send letters impersonating support to trick users into providing information. Please always stick to the ironclad rule I previously emphasized in the article Trezor Explains Customer Data Leak and Security Ironclad Rules: the manufacturing team and authorized resellers will never ask users for their Seed Phrase under any circumstances.
What to Do: Proper Risk Management and Security Enhancement Steps
- For those who previously bought a device from CryptoBilis (or online stores abroad that received items from this supply chain since March 2026):
- In the case where you have not yet opened the box or set up the device: Do not plug the device in to set it up and absolutely do not enter the original Seed Phrase into that device. Keep the device and contact Trezor Support to request a new replacement device directly from the manufacturer or receive a full compensation coupon.
- In the case where you have already set it up and stored coins on it: Immediately transfer the assets to a "new wallet created with an entirely new set of Seed Phrases," and absolutely do not import the original set of Seed Phrases from the suspicious device into the new device. Because if the original set of codes has already been screen-read, simply changing the device while using the same codes will still carry the same risk.
- Precaution regarding transferring coins temporarily to a Software Wallet or Exchange: In the official announcement, Trezor recommended a guideline for those who bought a device from CryptoBilis but do not yet have another secure Hardware Wallet: you can temporarily transfer the coins to a Software Wallet or Exchange you are familiar with. However, I want to add a neutral observation that at the same time, major news recently broke that the global exchange Binance was attacked by cybercriminals, resulting in losses of over $6.36 billion, forcing it to temporarily suspend withdrawals on several networks. Therefore, if anyone needs to evacuate coins from a risk group device to an exchange following Trezor's recommendation, they should carefully check the network's withdrawal status and the exchange's news before transferring, or consider creating a new wallet on a Software Wallet where you hold the keys yourself to temporarily store the coins while waiting for a new device. And for those who are not in the risk group, you should not panic and transfer coins from a perfectly safe Hardware Wallet back to be stored permanently on an exchange.
- Upgrade to a Multisig system to truly close supply chain risks: If you are someone who holds high-value assets and asks, "If we do not want to pin our hopes on a single device or a single store, how can we design a defense system with no single point of failure?" The most direct architectural answer is not to put a Passphrase on a single device, but to use Multisig (Multi-Signature Wallet), such as a 2-of-3 system that requires at least 2 out of 3 keys to approve a transaction. We can choose to use devices from different brands or buy them from different channels and link them together. Even if one device has a problem from the supply chain or is screen-read, the attacker cannot steal the coins from the wallet without the keys from the remaining devices to co-sign the transaction. Those who are interested can learn the basics and additional setup methods from the article What Beginners Need to Know Before Using a Multisig Wallet and the in-depth article Beyond Supply Chain Attacks: What Else Does Bitcoin Multisig Protect Against.
Risk Comparison Table and Guidelines Based on Source and Storage Method
To make it clearer, I have summarized the risks and guidelines separately by the device source and storage architecture for you to see side by side.
| Wallet Type and Acquisition | Security Against Screen Implants | Intermediary Risk and Withdrawal Suspension | Recommended Guidelines for Users |
|---|---|---|---|
| Bought from CryptoBilis abroad (since March 2026), regardless of Passphrase status | High risk, because the hidden chip can read both the Seed Phrase and Passphrase displayed on the screen | Risk of physical tampering during the store's distribution process | Stop using it and do not wait to weigh it. Immediately transfer coins to a new wallet using a new set of Seed Phrases, and contact the manufacturer to claim a new device. |
| Bought directly from the manufacturer or through an Authorized Reseller in Thailand that imports directly from the factory (e.g., Bitcast) | 100% safe. The codes are created and stored in the Secure Element chip without passing through the compromised supply chain | Very low. The shipping route directly from the manufacturer is clear, and returned products are not resold | Use normally. There is no need to pry open the device or panic and transfer coins. |
| Stored using a Multisig structure (e.g., 2-of-3 from devices of different sources) | Highest security. Even if one device is screen-read, the attacker cannot transfer coins out with a single key | No intermediary controls access, and it eliminates the Single Point of Failure risk | Suitable for those holding long-term or high-value assets who want to close supply chain risks |
| Temporarily transferred to a Software Wallet or Exchange (following Trezor's emergency recommendation) | Safe from the hidden chip in the original device (if a new Seed is created and the original Seed is not imported) | Software Wallets are at risk from online malware, while Exchanges are at risk from hacks and temporary withdrawal suspensions (e.g., the recent Binance incident) | Only for those who need to urgently evacuate coins from a CryptoBilis store device. You must carefully check the exchange's status before transferring. |
Summary
This incident involving an overseas retailer is not the end of the Hardware Wallet, nor does it mean that self-custody is a failure.
On the contrary, it shows us that because the mathematical security and chips of these devices are so robust that hackers cannot break through online or directly hack the chip, malicious actors have had to invest time and effort in physical methods, secretly opening the devices in retail stores to spy on the screen instead.
The core of the "Don't Trust, Verify" philosophy does not stop when we transfer coins into our wallet, but begins from the very first moment we choose the source of the device, choose a transparent and verifiable retailer, understand the technical limitations of each type of tool, and remain mindful and discerning of the facts when news breaks in the market.
As long as we understand what happened, know that our device came from a secure source, and choose a storage structure that is right for us, financial sovereignty and asset security remain fully in our hands.
What do you think about this incident after reading this? Were you shocked when you first saw the news, or what is your perspective on switching to a Multisig system to mitigate this risk? Feel free to join the conversation in the comments.
And for those who have additional questions, are unsure about checking devices, or want to consult about setting up a security system and choosing genuine devices shipped directly from the manufacturer, you can contact our team via LINE OA: @bitcast or view details of various device models at Bitcast Collections.
Frequently Asked Questions (FAQ)
A1: Although users in Indonesia noticed an abnormality in the device's weight and opened it to check, Trezor clarified that the weight of electronic components can naturally vary slightly from batch to batch, and modified circuit boards are extremely small. If someone who purchased a device from a high-risk retailer like CryptoBilis weighed it and found the weight appeared normal, it could lead to the misconception that their device was safe and prevent them from moving their coins out. Therefore, the safest criterion is to primarily look at the retailer's source. If purchased from CryptoBilis, move the coins out immediately without waiting to weigh and verify.
No, it will not help. Because the mechanism of the hidden circuit board in this case is to intercept the Seed Phrase from the screen when you first turn on the device for setup. If those words have already been transmitted via a mobile signal, even if you switch to a new, secure device but still use the same Seed Phrase, the attacker can still access your coins. Therefore, you must create a completely new wallet with a completely new Seed Phrase and only transfer the coins from the old wallet to the new one.
It cannot protect you if the device itself has been fitted with a screen-reading chip. Whether you type the Passphrase on the device's touchscreen or type it on a computer and confirm it on the device screen, the circuit board sandwiched between the motherboard and the screen will still see that Passphrase along with the Seed Phrase. If you want to protect against the risk of any device being modified from the start, setting up a Multisig Wallet using multiple devices to jointly sign transactions is a more direct solution.
No, they are not affected and are 100% safe. This is because the incident involved the modification of devices through CryptoBilis's distribution channel overseas, while all Bitcast devices, as an Authorized Reseller in Thailand, are imported directly from the manufacturer, and we have no policy of re-selling opened or returned products.
According to Trezor's announcement, those who purchased a device from CryptoBilis and do not yet have a backup Hardware Wallet can temporarily transfer their coins to a Software Wallet or Exchange they are familiar with. However, since a major exchange like Binance was recently hacked at the same time, leading to suspended withdrawals on some networks, users should check the status of the exchange and the network they plan to use before transferring, or create a new wallet with a new Seed Phrase on a trusted Software Wallet to temporarily hold the keys while waiting for a new device.
แชร์:
How to Prevent Supply Chain Attacks on Hardware Wallets | What Should You Check?