Trezor Security Warning: Karpeles Reports Tampered Wallets

A New Supply Chain Warning for Hardware Wallet Users

Hardware wallets are usually considered the safest way to store cryptocurrency. However, a recent security alert reminds us that physical supply chains can also be targeted by sophisticated attacks.

On October 30, 2026, former Mt. Gox CEO Mark Karpeles issued a serious warning on social media. He revealed that the recent hardware tampering seen on Ledger devices might not be an isolated event. According to Karpeles, certain Trezor hardware wallets may have also been physically compromised.

Mark Karpeles Flags Crypto Bilis Reseller

The issue specifically involves Trezor devices sold by Crypto Bilis, a reseller operating in Southeast Asia. Karpeles shared his findings directly on X to warn the crypto community.

Ledger n'est pas la seule. @Trezor devices sold by Crypto Bilis were also implanted.

Karpeles strongly urged anyone who bought a Trezor device from Crypto Bilis starting from March 2026 onwards to take immediate safety measures. He advised users to move their crypto funds right away to a completely new wallet generated with a fresh recovery phrase.

To help affected users, Karpeles even offered to manually review potentially compromised hardware wallets himself. He stated that he would personally cover the shipping costs for anyone who wants their device inspected for physical tampering.

How the Hidden Hardware Implant Works

How exactly does a tampered hardware wallet steal secret keys? The technical details reveal a surprisingly sophisticated physical attack on the hardware itself.

Security reports show that the modified device contains a hidden extra circuit board sandwiched right between the main motherboard and the display screen.

This rogue extra board includes both a cellular module and an antenna. Here is how the attack unfolds step-by-step:

• The rogue board intercepts secret data passing to the screen, such as your recovery phrase during setup.
• When you plug the hardware wallet into a computer or power source, the device activates.
• The embedded cellular module silently transmits your sensitive recovery phrase over a mobile network directly to the attacker.

This sneaky technique mirrors the hardware implants discovered in Ledger devices that were also sold by Crypto Bilis.

Trezor Responds to the Safety Report

Trezor officially confirmed on October 30, 2026, that its security team received a credible report regarding a suspected hardware implant in a Trezor Safe 5 model.

According to Trezor, the customer acquired the device in question through Tokopedia, an online marketplace in Indonesia, back in August 2026.

The timeline of Trezor's initial investigation includes key events:

• October 28, 2026: Trezor officially received the report regarding the suspected hardware implant.
• Customer Video Interview: Trezor conducted a video interview with the customer to review details of the device.
• Physical Verification Pending: Trezor noted that it has not yet inspected the device in person to confirm the report firsthand.

Lessons from Ledger and Actions Taken So Far

This incident connects directly to earlier security issues involving Ledger devices. Ledger's investigation into suspicious fund losses involving Crypto Bilis started on October 9, 2026, which later confirmed physical tampering on some Ledger devices.

On that same day, Trezor took immediate action by cutting ties with Crypto Bilis as an authorized reseller.

Since then, Trezor has physically inspected four devices bought by Crypto Bilis customers. Fortunately, no signs of physical tampering have been found on those four units so far.

Furthermore, Trezor reported that no Crypto Bilis customers have reported lost funds related to the suspected Trezor implant.

How to Keep Your Crypto Assets Safe

Even though no funds have been reported lost on Trezor devices yet, security precautions are essential when dealing with third-party supply chains.

Trezor recommends that affected customers create a completely new wallet with a brand-new seed phrase rather than simply restoring existing recovery phrases on another device.

Here are key practices to maintain self-custody security:

• Purchase hardware wallets directly from the official manufacturer whenever possible.
• Inspect the physical packaging and device casing carefully for any signs of tampering or damage.
• Never use a hardware wallet that comes with a pre-printed recovery phrase.
• If you suspect your device came from a compromised reseller, generate a new wallet on a trusted device and transfer your assets immediately.