For: anyone who owns a Trezor hardware wallet bought from a former Southeast Asian reseller since March 2026, or who plans to buy a hardware wallet from a non-manufacturer seller. This article follows Trezor's own notice and does not describe how such a device would be built.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- Whether the implant exists (Trezor has not examined the device)
- How the device was altered and at which point in the supply chain
- How many devices are affected
- Whether any funds were stolen
- Whether other resellers or regions are involved
Trezor says it will update customers if it learns of reports involving other resellers or regions. It has not published a date for results of its examination.
What owners should do today
Work out where your device was bought
Trezor's guidance covers every Trezor model, not only the Safe 5, bought from the former reseller since March 2026. That includes devices sold through the reseller's store on an online marketplace. Check your order record. If you bought from Trezor's own store or another authorized seller, the notice does not say you are affected.
Not set up yet: do not set it up
Trezor says not to set up such a device, and never to enter an existing recovery phrase on it. Keep it as it is and contact Trezor Support.
Already in use: new device, new recovery phrase, then move funds
Trezor says to create a new wallet with a new recovery phrase on a new device and move your funds there as soon as possible. Reusing the old recovery phrase on another device does not solve the problem, because the phrase itself is what may have been exposed. If you have no other secure hardware wallet yet, Trezor says you may temporarily use a software wallet or an exchange you trust.
Check the full receiving address before you send, not only the first and last characters.
Do not weigh, open or test the device yourself
The reporter noticed a weight difference. Trezor says weight is not a reliable test, and that there is no dependable way to inspect a device at home. Keep the device and contact Trezor Support with proof of purchase.
Ask for a replacement or voucher through Trezor Support
Trezor says customers who bought from the reseller since March 2026 can get a replacement device shipped by Trezor, or a voucher toward a new device. Start from Trezor's official site and keep the original device.
Treat any message about this incident as a possible scam
Trezor warns that scammers may use the incident for fake emails, letters and calls, and says Support will never ask for your recovery phrase. See what phishing is and, for protecting the accounts around your wallet, multi-factor authentication.
What happened (from Trezor's notice)
All statements below come from Trezor's notice of October 30, 2026 and are attributed to it.
March 2026
The start of the period Trezor says is in scope: devices bought from the former reseller from this point on.August 2026
The reported Safe 5 was bought from the reseller through an online marketplace, according to the report.October 9, 2026
Trezor ended its relationship with the reseller and began investigating customer devices. It says it is also reducing the number of authorized sellers.October 28, 2026
Trezor's security team received the responsible-disclosure report, with photos. It interviewed the reporter by video call.October 30, 2026
Trezor published its notice. It has not received the device.
What is known and what is not
State as of October 31, 2026. This table will be rewritten as Trezor publishes more.
| Item | What Trezor says | Status |
|---|---|---|
| A report was received | Received October 28 with photos; reporter interviewed by video call. Trezor treats it as credible | Confirmed (Trezor) |
| An extra board with a cellular module and antenna | Described by the report: between the main board and the screen | Reported, unverified |
| What the board does | Per the report, reads what the screen shows, including the wallet backup (recovery phrase), and sends it over a mobile network when the device is plugged in | Reported, unverified |
| The device itself | Not yet received by Trezor | Under investigation |
| Funds stolen | No reports; no evidence of customer losses. The reporter moved funds before finding the board | None known (Trezor) |
| Which devices are in scope | Any Trezor model bought from the former reseller since March 2026, including its marketplace store | Guidance scope (Trezor) |
| Other resellers or regions | No reports | Not reported (Trezor) |
| Weight as a test | Not a valid tamper check | Confirmed (Trezor) |
| Where in the supply chain the device was altered | Not stated | Not stated |
| Number of devices | Not stated beyond the one report | Not stated |
How to read this: unconfirmed does not mean safe
Trezor has not examined the device, so nobody outside the reporter's description can say how it works. Trezor ended the reseller relationship on October 9 and says it treats the report as credible. The guidance is a precaution for devices from one supply channel, not a statement about Trezor devices in general or about any party's conduct.
Bought from the former reseller since March 2026, not set up
↓→
Do not set it up
→ Contact Trezor Support
Same, already in use
↓→
New device + new recovery phrase
→ Move funds; do not reuse the old phrase
Why a hardware wallet bought through a reseller is a special case
A hardware wallet's value is that the recovery phrase is created and kept on the device. If the device itself was altered before it reached you, the phrase can be exposed at the moment you generate it, however careful you are afterwards. That is why Trezor's advice is to replace the device and the phrase, not just to move funds with the same phrase.
General practices, not specific to this report:
- Buy hardware wallets from the manufacturer's own store or an authorized seller it lists on its official site
- The device should generate the recovery phrase itself; never use a phrase that came printed or pre-filled in the box
- Keep the recovery phrase offline and never type it into a computer or phone (for backup habits see backup and recovery essentials)
Sources
- Trezor Team, notice "Implant reported in a Trezor sold by [former reseller]" (October 30, 2026) — trezor.io
- BleepingComputer coverage (October 30, 2026), consulted for context
Update history
2026-10-31: First version, based on Trezor's October 30 notice. Trezor has not received the device; this article will be updated when it publishes results or new guidance.
Read next
- Crypto thefts and exchange incidents: Bitget crypto theft / Bithumb security incident
- Accounts around your wallet: multi-factor authentication / password managers
- All 2026 incidents: security incidents of 2026