Trezor hardware implant report: CryptoBilis buyers urged to move funds

What it is

On 28 October 2026, Trezor received a responsible-disclosure report of a suspected hardware implant in a Safe 5 bought through the Tokopedia store of reseller CryptoBilis in August 2026. The customer is in Indonesia. Trezor's security team reviewed photographs and held a video call with them, then judged the report credible enough to warn buyers before examining the device. Trezor has not yet received it.

How it works

According to the customer's report, an extra circuit board sits between the Safe 5's main board and its screen. It carries a cellular module and antenna. It allegedly captures what the screen shows, including the wallet backup, and sends it over a mobile network each time the device is plugged in. This is the customer's description, not a lab finding.

Preconditions / Affected

• Any Trezor model supplied by CryptoBilis since March 2026, including its Tokopedia store and other shops carrying its inventory.
• Trezor reports no cases involving other resellers or regions.
• The receipt shows the seller. Otherwise Trezor Support can establish where a device came from.

What to do

• Move funds as soon as possible to a newly created wallet with a new recovery phrase. Restoring the old backup on another device does not remove the exposure, because the backup itself may be compromised.
• Without another secure hardware wallet, Trezor says a familiar software wallet or an exchange can serve temporarily. Check the full receiving address before sending.
• Leave unconfigured devices unused, and never enter an existing wallet backup on them.
• Keep the CryptoBilis hardware and contact Support. Eligible customers get a replacement shipped by Trezor or a voucher for a new device.
• Do not open the device or weigh it. The reporting customer noticed a weight difference, but Trezor says a scale cannot confirm or rule out modification.
• Expect scams by fake email, physical letter and phone call. Trezor Support never asks for a recovery phrase.

Caveats

• No CryptoBilis buyer has reported losing funds to the company. The reporting customer had already withdrawn their funds before finding the board. Trezor says it cannot see customer balances, so it cannot rule out losses.
• Trezor removed CryptoBilis from its authorized network on 9 October 2026. As of 19 October it had examined four CryptoBilis wallets (two Safe 5, one Safe 7, one Safe 3) and found no physical tampering. The reported Safe 5 was not among them.
• Ledger began investigating customer fund losses on 9 October 2026 and confirmed tampering in some devices from the same reseller, described as a supply chain attack. Ledger and SEAL 911 are coordinating with Trezor.
• The article was produced with AI assistance and reviewed by editors.