Trezor Identifies Three Compromised Safe 5 Wallets Among 48 Users

Trezor’s examination of devices associated with 48 people who contacted the company found malicious boards in three Trezor Safe 5 wallets, which could capture recovery seeds and passphrases shown on their screens.

The company traced the three wallets to sales between Aug. 20 and Sept. 23, 2026, through reseller CryptoBilis and its Tokopedia and Shopee stores. Trezor described the boards as sitting between each wallet’s main circuit board and display. It said they could send captured information over a cellular network to a server controlled by attackers.

Recovery seeds and passphrases are credentials used to restore or access a wallet. Trezor said the three cases had not resulted in customer fund losses. It has advised affected users to move funds to a new wallet created with a fresh recovery seed, since a firmware update cannot erase information already exposed.

TokenPost previously covered Trezor’s confirmation of malicious implants in three CryptoBilis-sold wallets.