Treasure contacted 48 buyers... Confirmed tampering in 3 Safe 5 devices

Treasure has confirmed that three Safe 5 hardware wallets sold through Malaysian reseller Cryptovillis contained a component capable of collecting recovery phrases, with the affected devices purchased between August 20 and September 23 this year. The company said it has been contacted by 48 Cryptovillis buyers, though that figure is counted separately from the number of devices with the identified part; one unit was inspected directly in Treasure's lab while the other two were assessed from internal photos supplied by their owners. Treasure has tightened its supply-chain standards and cut its reseller network by roughly 80% in response. The finding matters because the recovery phrase is the master key to a wallet's funds, so any component able to capture it undermines the core security promise of self-custody. What to watch next is whether the remaining 48 buyers' devices are cleared, and whether Treasure discloses further supply-chain audits or expands the reseller purge.