Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5

Hardware wallet manufacturer Trezor has warned customers who bought its devices from reseller CryptoBilis to move their funds, after a buyer reported finding a hardware implant inside a Trezor Safe 5, the company said on Friday.

A customer in Indonesia reported the implant through Trezor's responsible disclosure program on October 28, according to a company blog post. The Safe 5 was bought from CryptoBilis through Indonesian e-commerce platform Tokopedia in August 2026.

The report describes an extra circuit board fitted between the device's main board and its screen, with a cellular module and an antenna. According to the report, which Trezor said it has not verified, the board reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.

Trezor has not yet received the device, but said it is treating the report as credible based on the customer's description and a video interview. "What we've seen looks sophisticated enough that we decided to warn customers now," it said. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."

No CryptoBilis buyer has reported a loss of funds to Trezor, the company said.

Trezor urged anyone who bought one of its wallets from CryptoBilis from March 2026 onwards to move their funds to a newly created wallet with a new recovery phrase as soon as possible, and not to reuse the old phrase on any device. Buyers who have not yet set up their device should not use it. Affected customers can keep their CryptoBilis device and contact Trezor Support for a replacement.

The CryptoBilis incident

Trezor removed CryptoBilis as a reseller on October 9, after rival hardware wallet manufacturer Ledger began investigating losses among customers who bought its devices from the Southeast Asian reseller. Trezor has since inspected four of its devices bought from CryptoBilis, a Safe 7, two Safe 5s and a Safe 3, and found no evidence of tampering.

Ledger's Donjon security team found an implant in Ledger devices sold through CryptoBilis that reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. Trezor's blog says the newly reported implant "appears to operate similarly," though the company added that it won't draw comparisons while investigations are ongoing and doesn't know who is behind it.