If you bought a Trezor from CryptoBilis in March 2026 or later, move your funds to a completely new wallet, with a newly generated recovery seed, as soon as possible. Use a device and wallet you trust to create the new wallet. If your wallet supports an additional passphrase, use it (and remember to write it down in your offline backups). NEVER reuse a recovery seed from a wallet that might have been compromised. Simply resetting the device or importing the same seed into another wallet does NOT make your funds safe. An ELI5: I know this is obvious to many of you, but in my experience some people don't realize that hardware wallets don't actually "contain" their coins. Your coins "live" on the blockchain. Your wallet only holds the keys that allow you to access and spend them. If someone else has a copy of those keys, they can access your funds from anywhere in the world, from any device where those keys are imported. They don't need your physical little device or your phone to access it.
— Mishaboar (@mishaboar) October 30, 2026
Users are warned never to reuse a recovery seed from a wallet that might have been compromised. Simply resetting the device or importing the same seed into another wallet does not make funds safe either.
Mishaboar highlighted a critical security principle that may not seem obvious to all users: hardware wallets do not actually "contain" coins—the coins "live" on the blockchain. The wallet only holds the keys that allow access to and spending of the coins. If someone obtains these keys, they can access the funds from anywhere in the world on any device where the keys are imported, without needing the physical device or the user's phone.
Trezor shares security update
Mishaboar's warning follows a recent update from Trezor regarding CryptoBilis, in which the company disclosed that it had been alerted through responsible disclosure to a suspected hardware implant in a Trezor Safe 5 device purchased from CryptoBilis in August 2026.
According to Trezor, the reported device has not yet been received for physical examination. However, the company said it considers the report credible enough to notify customers while its security team investigates. No CryptoBilis buyer has reported losing funds to the company so far.
In light of this, affected users are urged to move their funds to a newly created wallet with a new seed as soon as possible. Those who have not yet set up their device should never do so using an existing wallet backup (recovery phrase), nor share this information with anyone.
u.today
