Hardware wallet manufacturer Trezor has warned customers who purchased its devices from reseller CryptoBilis to transfer their funds, following a report of a hardware implant discovered inside a Trezor Safe 5.
A customer in Indonesia reported the implant through Trezor's responsible disclosure program on October 28. The Safe 5 was purchased from CryptoBilis through Indonesian e-commerce platform Tokopedia in August 2026.
Implant Details
According to the report, which Trezor has not yet verified, an extra circuit board was fitted between the device's main board and screen. The board includes a cellular module and antenna designed to read information displayed on the screen—including wallet backup data—and transmit it over a mobile network when the device is connected to power.
Trezor stated it has not received the device for laboratory examination but treats the report as credible based on the customer's description and a video interview. The company decided to issue a warning immediately rather than wait for lab confirmation, saying that doing so would leave CryptoBilis buyers exposed in the interim.
Customer Action Recommended
Trezor urges anyone who purchased one of its wallets from CryptoBilis from March 2026 onwards to move funds to a newly created wallet with a new recovery phrase as soon as possible. The company advises against reusing the old recovery phrase on any device. Buyers who have not yet set up their devices should not use them. Affected customers can request a replacement device from Trezor Support.
No CryptoBilis buyer has reported a loss of funds to Trezor.
CryptoBilis Reseller Status
Trezor removed CryptoBilis as an authorized reseller on October 9 after rival hardware wallet manufacturer Ledger began investigating losses among customers who purchased devices from the Southeast Asian reseller. Trezor subsequently inspected four of its devices bought from CryptoBilis—one Safe 7, two Safe 5s, and one Safe 3—and found no evidence of tampering.
Ledger's Donjon security team identified an implant in Ledger devices sold through CryptoBilis that reads the 24-word recovery phrase from the screen during setup and transmits it over LTE. Trezor noted that the newly reported implant appears to operate similarly, though the company stated it will not draw detailed comparisons while investigations are ongoing and the source of the implant remains unknown.
