From Decrypt · By Decrypt Agent
In brief
Trezor said it received a credible report of a hardware implant in a Safe 5 bought from reseller CryptoBilis in August, though it hasn't examined the device yet.
The implant reportedly reads the wallet backup from the screen and sends it over a mobile network, which Trezor says appears similar to Ledger's case.
Trezor urged anyone who bought one of its wallets from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.
Hardware wallet manufacturer Trezor has warned customers who bought its devices from reseller CryptoBilis to move their funds, after a buyer reported finding a hardware implant inside a Trezor Safe 5, the company said on Friday.
A customer in Indonesia reported the implant through Trezor's responsible disclosure program on October 28, according to a company blog post. The Safe 5 was bought from CryptoBilis through Indonesian e-commerce platform Tokopedia in August 2026.
CryptoBilis update
We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from… pic.twitter.com/TiaKfHBnX2
— Trezor (@Trezor) October 30, 2026
The report describes an extra circuit board fitted between the device's main board and its screen, with a cellular module and an antenna. According to the report, which Trezor said it has not verified, the board reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.
Trezor has not yet received the device, but said it is treating the report as credible based on the customer's description and a video interview. "What we've seen looks sophisticated enough that we decided to warn customers now," it said. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."
No CryptoBilis buyer has reported a loss of funds to Trezor, the company said.
Trezor urged anyone who bought one of its wallets from CryptoBilis from March 2026 onwards to move their funds to a newly created wallet with a new recovery phrase as soon as possible, and not to reuse the old phrase on any device. Buyers who have not yet set up their device should not use it. Affected customers can keep their CryptoBilis device and contact Trezor Support for a replacement.
Myriad: Where does ETH go next? Click to make your prediction.
The CryptoBilis incident
Trezor removed CryptoBilis as a reseller on October 9, after rival hardware wallet manufacturer Ledger began investigating losses among customers who bought its devices from the Southeast Asian reseller. Trezor has since inspected four of its devices bought from CryptoBilis, a Safe 7, two Safe 5s and a Safe 3, and found no evidence of tampering.