Trezor Warns CryptoBilis Buyers After Reported Hardware Implant in Safe 5

Trezor has urged customers who bought its hardware wallets from reseller CryptoBilis since March 2026 to move their funds immediately, after a buyer reported finding a hardware implant inside a Trezor Safe 5. The company disclosed the report on Friday, October 30, and said it treats the report as credible even though it has not yet examined the device.

The customer, based in Indonesia, filed the report through Trezor's responsible disclosure program on October 28, according to a company blog post. The Safe 5 was purchased from CryptoBilis via Indonesian e-commerce platform Tokopedia in August 2026. Trezor has not yet received the device.

What does the implant do?

The report describes an extra circuit board fitted between the Safe 5's main board and its screen, equipped with a cellular module and an antenna. The board allegedly reads everything the screen displays — including the wallet backup — and transmits it over a mobile network whenever the device is plugged in.

Trezor said it has not verified the report. It decided to warn customers anyway based on the customer's description and a video interview. "What we've seen looks sophisticated enough that we decided to warn customers now," the company said. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."

No CryptoBilis buyer has reported a loss of funds to Trezor so far, the company said.

What should affected customers do?

Trezor issued specific instructions for anyone who bought one of its wallets from CryptoBilis from March 2026 onwards:

• Move funds to a newly created wallet with a new recovery phrase as soon as possible.
• Do not reuse the old recovery phrase on any device.
• Buyers who have not yet set up their device should not use it.
• Affected customers can keep their CryptoBilis device and contact Trezor Support for a replacement.

How does this connect to the Ledger investigation?

Trezor removed CryptoBilis as an official reseller on October 9, after rival hardware wallet manufacturer Ledger began investigating losses among customers who bought its devices from the Southeast Asian reseller. Trezor has since inspected four of its own devices bought from CryptoBilis — a Safe 7, two Safe 5s and a Safe 3 — and found no evidence of tampering.

Ledger's Donjon security team previously found an implant in Ledger devices sold through CryptoBilis that reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. Trezor's blog states that the newly reported Safe 5 implant "appears to operate similarly." The company added that it will not draw further comparisons while investigations are ongoing, and said it does not know who is behind the implant.

Ledger has said that all confirmed losses in its case involve devices bought from CryptoBilis, and it asked resellers in seven Asian markets to pull its devices from sale. One of the largest victims, according to blockchain analytics firm Chainalysis, was a scammer who lost more than 60 BTC — worth roughly $4.8 million at the time of the incident.

What happens next?

The operational lesson is straightforward for the industry: supply-chain provenance now determines hardware wallet safety as much as firmware. Both manufacturers have converged on the same failure mode — an intermediary modifying sealed devices between factory and consumer — and both have responded by cutting distribution through resellers they cannot audit.

Trezor is still waiting to receive the implanted Safe 5 for laboratory analysis. Until that examination concludes, the March 2026 cutoff marks the exposure window for CryptoBilis buyers, and anyone holding funds on an affected device faces a narrow but concrete risk: a backup read off the screen and transmitted over a mobile network can drain a wallet without the attacker ever touching the seed phrase holder's computer.