Crypto Wallet: Trezor warns of a possible implant in a device sold by CryptoBilis

A report taken seriously. Trezor announced on October 30 that it had received a report regarding a possible hardware implant in a Safe 5 purchased from CryptoBilis, a former authorized reseller in Southeast Asia. The manufacturer considers the report credible, but is waiting for the device to examine it. No buyer of Trezor from CryptoBilis has reported a loss of funds to it, its press release specifies.

Key Points

The report concerns a Safe 5 purchased in August 2026 from CryptoBilis, on Tokopedia in Indonesia.

The suspected implant could capture the recovery phrase from the screen and transmit it via mobile network.

The recommendations apply to all Trezor models purchased from CryptoBilis since March 2026.

Trezor offers a replacement or voucher to cover the purchase of a new device.

After Ledger, a report concerning a Trezor Safe 5

The security team received the report on October 28, through its responsible disclosure program. The owner describes an additional electronic board between the main board and the screen, equipped with a cellular module and an antenna.

According to this testimony, the device would read the information displayed, including the recovery phrase, then transmit it when the device is plugged in. Trezor has photos and interviewed the client by videoconference. However, laboratory analysis remains necessary to confirm these elements.

The client had already moved his funds before discovering the alleged implant. Furthermore, Trezor indicates that it has examined four other devices from CryptoBilis, without detecting manipulation.

The case follows the discovery, confirmed by Ledger, of implants in devices distributed by CryptoBilis. Trezor removed this reseller from its authorized network on October 9. The manufacturer exchanges with Ledger and SEAL 911, without attributing the incidents to the same authors.

Mark Karpelès, former manager of Mt. Gox, also relayed the alert and offered to cover the costs of shipping suspicious devices for analysis. This initiative does not replace the review expected by Trezor.

Affected buyers urged to move their funds

As a precaution, the instructions apply to all models purchased from CryptoBilis since March 2026, including via stores supplied by this distributor.

For an already used device, Trezor recommends quickly transferring funds to a newly created wallet with a new recovery phrase. Restoring the old phrase on another device is not enough if it has been intercepted.

Without a reliable hardware wallet available, the manufacturer temporarily recommends a software wallet or exchange platform known to the user. It requires you to fully verify the receiving address before transferring.

An unused device must not be configured or receive an existing sentence. Trezor also advises against attempting a diagnosis by weighing or opening the case: these checks cannot rule out tampering.

Affected customers should keep their device and contact official support to obtain a replacement or voucher. Support never asks for the recovery phrase. The manufacturer also warns of the risk of false messages exploiting the incident.