Trezor finds hardware implants in Safe 5s sold by CryptoBilis, cuts reseller network by 80%

Hardware wallets such as Trezor’s Safe 5 are built to keep private keys off an internet-connected device, so a supply-chain intrusion changes the point of trust from software to the manufacturing and reseller chain. CryptoBilis is named here as the vendor linked to the devices, which makes the reseller relationship part of the security story rather than a simple retail channel. This sits inside a broader pattern in which wallet makers have to police who can handle sealed devices before they reach end users.

For users and resellers, an 80% cut in Trezor’s reseller network changes where devices can be sourced and forces closer scrutiny of distribution partners. Builders and merchants working with hardware wallets may need to verify provenance more carefully and adapt to tighter vendor rules from the manufacturer. The practical effect is less room for informal distribution and more control by the wallet maker over who can sell its products.

The case puts a hard trade-off on display: hardware wallets promise self-custody, yet they still depend on physical supply chains that can be tampered with before a device is ever used. Trezor’s response shows how a manufacturer can respond by narrowing its channel, but that also concentrates trust in a smaller set of approved sellers. For the industry, the tension is between wider distribution and tighter control over device integrity.

Still open is how many devices were affected, which specific implant methods were found, and how much exposure users faced before Trezor’s changes. The record here names the vendor and the reseller reduction, but not the full scope of the incident or whether other channels were involved. Those details would be needed to understand whether this was a limited compromise or a broader supply-chain problem.

Safe rose 1.5% in the 4 hours after the first headline, after falling 0.2% in the 2 hours before.

29 prices, one every 30 minutes