Trezor warns of suspected hardware implant in Safe 5 wallets sold by reseller CryptoBilis

Trezor warns buyers after implant report

Trezor, a Czech maker of hardware wallets — small physical devices that store the private keys to crypto funds offline — is warning customers about a suspected hardware implant in one of its Safe 5 devices. The report came through a responsible disclosure, meaning a security researcher privately reported the problem to the company first.

The device was bought from CryptoBilis, a reseller in Southeast Asia. Trezor says it has not received the device for testing, but after interviewing the buyer by video call it is treating the report as credible. The company is urging anyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet and contact support, which will send them a new device.

Key points

• Trezor received the disclosure on Oct. 28 about a Safe 5 bought in August 2026 through Tokopedia, an online marketplace.
• The suspected implant is an extra circuit board placed between the device's main board and its screen. It reportedly contains a cellular module and antenna that can read what is shown on the screen — including a wallet's recovery phrase, the list of words that restores access to a wallet — and send it over a mobile network.
• Trezor removed CryptoBilis from its authorized reseller network earlier this month, after reports of tampered Ledger devices sold through the same distributor.
• Trezor has examined four customer devices from the reseller so far and found no signs of tampering in those units.
• No loss of user funds has been reported in connection with the Trezor report.

What Trezor and its security chief said

In a blog post published Friday, Trezor said it chose to warn customers before completing its examination. "We'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime," Trezor chief commercial officer Danny Sanders said in a statement to The Block. "If you bought a Trezor from CryptoBilis since March, move your funds to a new wallet and contact our Support team, and we'll send you a new device."

Same distributor, other wallet makers hit

CryptoBilis has been linked to similar problems before. Rival wallet maker Ledger previously confirmed physical tampering in signers — hardware devices used to approve transactions — sold through the reseller. On-chain analysts estimated losses tied to the Ledger incident at more than $86 million across Bitcoin, Ethereum, and Tron, though Ledger has not confirmed those figures. Wallet maker OneKey also cut ties with the reseller, froze new approvals, and offered free replacements.

A difficult year for Trezor

The implant report adds to a run of security problems for Trezor this year. In August, a breach at its shipping provider ShipMonk exposed personal data of about 13,700 customers, and in September the company said the same breach affected roughly 67,000 more U.S. customers. Also in September, Trezor disclosed that a breach at its third-party email provider had allowed phishing messages to be sent from Trezor's own domain.

What is confirmed and what is not

Confirmed: Trezor received the disclosure on Oct. 28, removed CryptoBilis from its reseller network, examined four devices without finding tampering, and is warning customers and replacing affected devices. Ledger's confirmation of tampering and OneKey's response are also on record.

Not confirmed: the implant itself has not been verified by Trezor, since the company does not yet have the device. The reported $86 million in losses from the Ledger incident is an analyst estimate, not a confirmed figure.

Why this matters for wallet buyers

The case shows a supply chain risk: even a genuine wallet can be compromised after it leaves the factory if a distributor tampers with it. Trezor's decision to warn before confirming reflects how serious the company considers the risk, and it gives buyers who used CryptoBilis a clear action to take.

Sources

• The Block — Trezor reports suspected hardware implant in Safe 5 sold by CryptoBilis
• Trezor blog — Implant reported in a Trezor sold by CryptoBilis

Read also: Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5