Trezor reports an implant in a CryptoBilis-sold Safe 5 and tells buyers since March to move funds to a new seed

What Trezor said

Trezor has warned customers who bought its hardware wallets from the reseller CryptoBilis to move their funds to a new wallet with a new recovery phrase. In a post on its official X account on 30 October 2026, and in a longer notice on its blog, Trezor said its security team had received a responsible disclosure report of a single hardware implant inside a Trezor Safe 5 that was bought from CryptoBilis in August 2026.

According to the blog, the report reached Trezor on 28 October 2026 and came from a customer in Indonesia. The device was bought through CryptoBilis's store on Tokopedia. Trezor said it has not yet received the device to confirm the finding, but that based on the customer's description and a video interview it is treating the report as credible and is warning customers now as a precaution. Its security team will examine the device once it arrives.

Trezor said no CryptoBilis buyer has reported a loss of funds, and that the customer who found the implant had already moved his funds off the device before he found it.

What the report describes

Trezor's blog describes what the report claims was found: an extra circuit board fitted inside the Trezor Safe 5, between the main board and the screen, carrying a cellular module and an antenna. According to the report, which Trezor stresses it has not verified itself, the board reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.

Trezor said the implant appears to operate similarly to those seen in Ledger devices sold through the same reseller, but declined to draw comparisons or name anyone behind it while investigations continue. It said it is working with Ledger and others investigating the issue, and thanked SEAL 911, the Security Alliance's emergency response service, for helping with the response.

This follows Trezor's decision on 9 October 2026 to remove CryptoBilis as an authorised reseller after reports of tampered Ledger devices. Trezor said it has since inspected the four CryptoBilis-bought Trezor devices it has received and found no signs of tampering on any of them. It said it has no reports involving any other reseller.

What CryptoBilis buyers should do

Trezor's guidance applies to every Trezor model bought from CryptoBilis from March 2026 onwards, including through any store selling devices supplied by CryptoBilis, such as its Tokopedia store.

If the device is already in use, Trezor says to move funds to a newly created wallet with a new seed as soon as possible, and not to reuse the old seed in any wallet, hardware or software. Restoring the old backup on another device does not solve the problem. If no other secure hardware wallet is available, Trezor suggests temporarily moving funds to a software wallet or an exchange you are familiar with, and checking the full receiving address before sending.

If the device has not been set up yet, Trezor says not to set it up and never to enter an existing wallet backup on it. Trezor also says weighing or opening the device is not a reliable check.

Affected buyers should keep their CryptoBilis device and contact Trezor Support. Trezor says anyone who bought from CryptoBilis from March 2026 onwards is eligible for a new Trezor device shipped directly, or a voucher to cover the cost of one.

Our take

The practical point is simple: if your Trezor came from CryptoBilis, treat its recovery phrase as exposed, even though only one device has been reported so far. Set up a brand new wallet, move funds to it, and only then deal with the replacement. Trezor also warns that scammers are likely to use this incident for phishing by email, letter and phone. Trezor Support will never ask for your recovery phrase, so anyone who does is not Trezor.