Trezor is warning customers who bought devices from CryptoBilis from March 2026 onward after receiving a report of a suspected hardware implant in a Safe 5 wallet. The company said it received a responsible disclosure on October 28 from an Indonesian customer who bought the device through Tokopedia in August. Trezor has not examined the device and cannot confirm the implant, but says the customer’s description and a video interview were credible enough to issue a precautionary warning in its security notice.
The report describes an extra circuit board fitted between the wallet’s main board and screen, with a cellular module and antenna. According to the customer’s account, the board can read what appears on the screen, including the wallet recovery phrase, and transmit that information over a mobile network when the device is plugged in. Trezor says it has not verified how the component works and will examine the device when it reaches the company’s lab.
Trezor’s timeline says it has inspected four other devices returned by CryptoBilis customers since October 19: one Safe 7, two Safe 5 units and one Safe 3. The company said those inspections found no evidence of tampering. The reported Safe 5 has not yet reached its lab, so the four inspections do not confirm or rule out the customer’s separate report.
Although the report concerns one Trezor Safe 5, the company’s warning applies to every Trezor model purchased from CryptoBilis since March 2026. Trezor said it removed the reseller from its authorized network on October 9, after Ledger began investigating fund losses among customers who had bought hardware wallets from the same seller. Trezor said it does not know who is behind the reported implant and has no reports involving other resellers.
Trezor says no customer has reported losing funds in the incident. The person who disclosed the suspected implant had already moved funds off the device before finding it. Customers who are already using a Trezor bought from CryptoBilis should move their assets to a newly created wallet with a new recovery phrase. Restoring the old wallet backup on another device does not remove the risk. Buyers who have not set up their device should not do so or enter an existing wallet backup.
Trezor says customers who purchased from CryptoBilis from March 2026 onward are eligible for a replacement device or a voucher covering the cost of a new one. The company asks buyers to keep the device and contact its support team rather than opening or weighing it, which it says cannot reliably confirm tampering. The company also warned that scammers may exploit the incident with fake emails, letters and phone calls. The report adds to recent hardware-wallet supply-chain concerns, including Keystone’s decision to destroy 18,835 devices after an authentication-key breach.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
