Trezor Warns CryptoBilis Buyers After Reported Hardware Implant in Safe 5 Wallet
Trezor says a customer in Indonesia reported a cellular implant in a Trezor Safe 5 bought from reseller CryptoBilis. Buyers since March 2026 are told to move funds to a new seed.
Hardware wallet maker Trezor has warned customers who bought devices from the reseller CryptoBilis to move their funds, after a report of a hardware implant in a Trezor Safe 5. The company is treating the claim as credible, even though the device has not yet reached its lab.
What Trezor Says Was Found
According to Trezor's own notice, its security team received a responsible disclosure on October 28, 2026, describing a single implant in a Safe 5 bought from CryptoBilis in August 2026. A Trezor customer in Indonesia made the report.
BleepingComputer reported that the user found an extra circuit board between the main board and the screen, fitted with a cellular module and antenna. Based on the customer's unconfirmed description, the implant appears able to read information shown on the screen, including the recovery phrase, and send it over a mobile network when the device is plugged in.
Trezor has said it has not received the device to confirm the report. It is sharing the details now so that buyers can secure their funds as a precaution. The Block noted that Trezor has not received the device but is treating the risk as credible.
No CryptoBilis buyer has reported a loss of funds to Trezor. The customer who filed the report had already moved his funds off the device before he found the implant, Trezor said.
Guidance for Buyers and Link to the Ledger Case
Trezor's advice applies to every model bought from CryptoBilis, not only the Safe 5. Anyone who bought from the reseller since March 2026 should move funds to a newly created wallet with a new recovery seed and contact Trezor Support. Customers who have not yet set up a CryptoBilis device should not do so. Trezor has said affected buyers can receive a replacement or a voucher.
CryptoBilis was an official Trezor reseller in Southeast Asia until October 2026. Trezor stopped sales through the reseller on October 9, after the Ledger incident earlier in the month. BleepingComputer said the implants on the two brands of device appear similar in form and function.
Trezor has also inspected devices from other CryptoBilis customers. By its account, it found no signs of tampering on four devices received so far. The new report therefore remains a single, unverified case until Trezor can examine the unit.
The episode adds to concern about supply chain attacks on hardware wallets, where devices can be altered before they reach the buyer. Buying directly from the manufacturer or from a listed authorized reseller reduces that risk.
Sources:
