Tangem Wallet (2 Cards) vs Trezor Model One

On 28 October 2026 Trezor received a report from a buyer in Indonesia of an extra circuit board inside a Trezor Safe 5 bought in August 2026 from CryptoBilis, the same Southeast Asian reseller whose Ledger devices carried hardware implants. According to the report, the board sits between the main board and the screen, reads what the screen shows, including the recovery phrase, and sends it out over a mobile network. Trezor has not yet examined the device, calls the report credible and is having the unit sent to its lab.

Trezor says it has no reports involving any other reseller and no evidence that any customer has lost funds; the person who reported the implant had already moved their funds. Trezor removed CryptoBilis from its authorized resellers on 9 October 2026.

Trezor’s advice applies to every Trezor model bought from CryptoBilis from March 2026 onwards:

• If the device is not set up yet, do not set it up and never enter an existing recovery phrase on it.
• If you already use it, move your funds as soon as possible to a new wallet with a newly generated recovery phrase. Restoring the old phrase on another device does not help.
• Keep the device and contact Trezor Support: affected buyers can get a new device or a voucher. Do not open it; Trezor says weighing it is not a reliable test.

The report concerns how one device reached a buyer, not the device design, so it does not change our ratings. We will update this notice when Trezor publishes the result of its examination.

Ledger’s Donjon security team, which works for a competing manufacturer, published a laser fault-injection attack on Tangem cards on 9 July 2026. With a card physically in hand, the researchers opened it and used precisely timed laser pulses to skip a check, which let them set a new access code without knowing the old one and then sign transactions. The private key is not extracted. According to Donjon, the attack applies to all Tangem cards in circulation, and because the cards have no firmware update mechanism it cannot be patched on cards already sold.

The attack requires stealing the card, visibly damaging it, laboratory equipment costing roughly $250,000 and specialist skills. Tangem calls the risk to everyday users “virtually non-existent” and says no funds have been lost to this method; none has been reported in the wild.

What this means for owners: the practical exposure is a lost or stolen card. Keep track of your cards, and if one goes missing, move funds to a wallet the missing card cannot access.