Trezor warns of suspected crypto-theft implant in a Safe 5 sold by reseller CryptoBilis

Hardware wallet maker Trezor says it has received credible reports of a suspected crypto-theft implant inside a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. The company has not yet received the device, so it has not confirmed that a malicious implant is present.

According to Trezor, the concern began with an Indonesian customer who bought a Safe 5 from CryptoBilis through Tokopedia in August 2026. The customer opened the device and found an extra circuit board between the main board and the screen, fitted with a cellular module and antenna. Based on unconfirmed information from that customer, the implant appears able to read what the screen displays, including the wallet recovery phrase, and to send it over a mobile network when the device is plugged in.

CryptoBilis also appears in a Ledger implant incident reported earlier in October. Trezor says the two implants look similar in form and function. Trezor stopped selling devices through CryptoBilis on October 9, 2026, before it had any indication it was affected, and later said it would restructure and tighten its reseller network globally.

Trezor says it is not aware of any funds stolen through this supply-chain attack and will update once it examines the device, which is being shipped to it. It advises against setting up or using any device bought via CryptoBilis from March 2026 onward. Anyone who already has should move funds to a newly created wallet with a new recovery phrase. Buyers with proof of purchase can ask Trezor for a replacement device or a voucher. Trezor also says weighing a device is not a reliable way to spot tampering.

The report is a reminder that the reseller chain, not just the firmware, is part of a hardware wallet's trust boundary. Buyers should source devices from the manufacturer or a verified seller, check packaging and seals, and treat any unexpected hardware inside a device as a compromise rather than a curiosity.