Trezor warns of suspected crypto-theft implant in hardware wallet

What it is

Trezor reported on the page that it has credible but unconfirmed reports of a hardware implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. An Indonesian buyer bought the device through Tokopedia in August 2026. Trezor has not yet received it. The device is being shipped to the company.

How it works

The buyer opened the device and found an extra board between the main board and the screen, carrying a cellular module and antenna. Based on the customer's unconfirmed information, the implant appears able to read what the screen displays, including the recovery phrase, and send it over a mobile network when the device is plugged in. The page says it resembles the implant in the Ledger case in form and function. Both cases involve CryptoBilis.

Preconditions / Affected

• Any device bought through CryptoBilis from March 2026 onward.
• Trezor sold the Safe 5 through the official store as well, and the warning concerns only the CryptoBilis channel.
• Ledger confirmed its compromise and asked resellers and distributors in Southeast Asia and Hong Kong to halt sales. Ledger users have reported multiple losses this month, and a Singapore police announcement added $3,500,000 to the tally.

What to do

• Do not set up or use a CryptoBilis device bought from March 2026 onward.
• If you already did, create a new wallet with a new recovery phrase and move the funds there.
• Buyers with proof of purchase can contact Trezor for a replacement device or a voucher for a new one.
• Do not rely on weighing the device to detect tampering. Trezor says it is not a reliable check.

Caveats

• The implant is unconfirmed. Trezor has not examined the hardware, and the description rests on one customer's report.
• Trezor says it knows of no funds stolen through a supply-chain attack.
• Trezor stopped sales through CryptoBilis on October 9, 2026, before it had any sign it was affected. It also said it will tighten its global reseller network.
• Trezor promised an update once it receives the device.