Cases › security breach › LR-2026-0291
Trezor Safe 5 from reseller CryptoBilis found with implant board exfiltrating recovery phrase over cellular network
Confirmed Why: 2 independent outlets · 2 independent reports
Severity moderate: the recovery phrase of a tampered device was exposed and Trezor advised every CryptoBilis buyer since March 2026 to move funds, a bounded scope, but no buyer has reported losing funds.
Earliest source we hold 2026-10-30 · Captured by AI Risk Wire 2026-10-31 03:27 UTC
A customer in Indonesia who bought a Trezor Safe 5 hardware wallet from reseller CryptoBilis in August, through the marketplace Tokopedia, reported that the device contained an extra circuit board. The board sits between the wallet's main board and its screen, with a cellular module and an antenna, and reads the screen, including the recovery phrase, sending it out whenever the device is plugged in. The customer noticed a weight difference and had moved his funds off the wallet before he found the board. Trezor has not examined the device but found the report believable enough to warn all CryptoBilis buyers since March 2026 to move funds to a new wallet with a new recovery phrase. Trezor dropped CryptoBilis on October 9 after Ledger began investigating losses among its own customers who had bought from CryptoBilis.
Risks this incident falls under
| Risk | Role | NIST AI 600-1 | Incidents | Last 6 quarters |
|---|---|---|---|---|
| AI used to run a cyber attack | Primary | Information Security | 33 | |
| AI system attacked or breached | Also | Information Security | 1 |
Sorted by rule from the case's fields; not yet read from the sources.
Control failure chain
L1 · ModelProvider not namedModel provider
Sources not yet read for controls.
Model version not linked to a model card.
9 more for this risk at this layer
L2 · HarnessHarness not namedAgent framework vendor
Sources not yet read for controls.
L3 · ApplicationDeployer not namedDeployer
Sources not yet read for controls.
L4 · Infrastructure / targetOrganisation hitOrganisation hit
Sources not yet read for controls.
6 more for this risk at this layer
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
The same controls in other incidents of this risk
| Control | Layer | Here | Held elsewhere | Did not hold elsewhere |
|---|---|---|---|---|
| Content safety classifiers | L1 Model | Not read yet | – | – |
| Safety training and refusal | L1 Model | Not read yet | – | 1 |
| Cyber and weapons safeguards | L1 Model | Not read yet | – | – |
| Dangerous-capability testing before release | L1 Model | Not read yet | – | – |
| Outside red-teaming | L1 Model | Not read yet | – | – |
| Staged or restricted release | L1 Model | Not read yet | – | – |
| Abuse monitoring and account enforcement | L1 Model | Not read yet | – | – |
| Reasoning monitoring | L1 Model | Not read yet | – | 1 |
| Safeguards kept on in testing | L1 Model | Not read yet | – | – |
| Known flaws patched | L4 Infrastructure / target | Not read yet | – | – |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not read yet | – | – |
| Network segmentation | L4 Infrastructure / target | Not read yet | – | – |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not read yet | – | – |
| Backups and recovery | L4 Infrastructure / target | Not read yet | – | – |
| Phishing and fraud filters | L4 Infrastructure / target | Not read yet | – | – |
Remediation
Fix reported
“Trezor will ship you a new device or give you a voucher that covers the cost of one.”
No later incident for Trezor under this risk on record.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
What the sources state
- What was done Trezor will ship you a new device or give you a voucher that covers the cost of one.
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
The document does not state when the implant was installed, when the customer first noticed the weight difference, or how many devices were affected. The document also describes a separate Singapore Police Force advisory about Ledger wallets; that is a distinct incident and is reported as its own record. Extractor proposed values without quotes; dropped: . The $3,500,000 figure in the article refers to Ledger user losses from a separate incident, not to this Trezor event, so it is not recorded here. Extractor proposed values without quotes; dropped: .
LR-2026-0291 · version 1 · published 2026-10-31 after automatic checks; not yet checked field by field by a person · JSON