Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5

What it is

Trezor said on Friday 30 October 2026 that it received a credible report of a hardware implant in a Trezor Safe 5 bought from reseller CryptoBilis. A customer in Indonesia reported it through Trezor's responsible disclosure program on 28 October. The device was bought through the Indonesian e-commerce platform Tokopedia in August 2026. Trezor has not yet received or examined the device.

How it works

The report describes an extra circuit board fitted between the main board and the screen, with a cellular module and an antenna. According to the report, which Trezor has not verified, the board reads what the screen shows, including the wallet backup. It sends that data out over a mobile network whenever the device is plugged in.

Trezor says this appears to operate similarly to the implant Ledger's Donjon team found in Ledger devices sold through CryptoBilis. That implant reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. Trezor added that it will not draw comparisons while investigations continue and does not know who is behind the implant.

Preconditions / Affected

• Anyone who bought a Trezor wallet from CryptoBilis from March 2026 onwards. The reported unit is a Safe 5, but Trezor's advice covers all models bought from the reseller.
• Trezor removed CryptoBilis as a reseller on 9 October 2026, after Ledger began investigating customer losses.
• Trezor has inspected four CryptoBilis units (a Safe 7, two Safe 5s and a Safe 3) and found no evidence of tampering.
• No CryptoBilis buyer has reported a loss of funds to Trezor.

What to do

Trezor's guidance for affected buyers:

1. Create a new wallet with a new recovery phrase and move funds to it as soon as possible.
2. Do not reuse the old recovery phrase on any device.
3. If the device has not been set up yet, do not use it.
4. Keep the device if you wish, and contact Trezor Support for a replacement.

Caveats

• This is a single report. Trezor treats it as credible based on the customer's description and a video interview, not lab confirmation. It chose to warn now because waiting would leave buyers exposed.
• The page gives no way to check a device yourself, so the advice rests on where it was bought, not on a test.
• On the Ledger side, Ledger says all confirmed losses involve CryptoBilis devices and has asked resellers in seven Asian markets to pull its devices. Chainalysis reports one victim lost more than 60 BTC, about $4.8 million.