Trezor Safe 5 Implant Reported in Wallet Sold by CryptoBilis

A Trezor customer in Indonesia opened up a hardware wallet and reportedly found a second circuit board, a cellular module and an antenna that had no business being there. Trezor disclosed the suspected Trezor Safe 5 implant on October 30, and while the company has not yet examined the device itself, it is telling some buyers to move their funds now rather than wait.

The warning applies to anyone who bought a Trezor from the Southeast Asian reseller CryptoBilis from March 2026 onward. Here is what is known so far, and what is still unconfirmed. More wallet security coverage lives on our crypto page.

What did the Indonesian buyer find inside the Trezor Safe 5?

According to Trezor's own notice, its security team received a responsible disclosure on October 28 about a single Safe 5 bought from CryptoBilis in August 2026 through the Tokopedia marketplace. The customer described an extra board fitted between the main board and the screen, carrying a cellular module and an antenna.

Based on that description, Trezor says the add on appears to read whatever the screen displays, including the wallet backup words shown during setup, and send it out over a mobile network whenever the device is plugged in. Trezor stresses that it has not verified this itself. It treated the report as credible after reviewing the customer's account and a video interview, and it is arranging to have the device shipped to its lab.

The buyer had already moved their funds off the wallet before spotting the hardware, so no money was lost in this case.

Is this the same tampering Ledger reported through CryptoBilis?

It looks similar. Trezor says the implant "appears to operate similarly" to those found in Ledger devices sold through the same reseller. Ledger began investigating customer losses on October 9 and later confirmed tampering in units that passed through CryptoBilis, a story we covered when Ledger suspended wallet sales at the retailer.

Trezor cut CryptoBilis from its reseller network the same day, October 9. The Block reports that onchain analysts put losses tied to the tampered Ledger devices at more than $86 million, a figure Ledger has not confirmed.

Have any Trezor owners lost money?

Not so far. Trezor says no CryptoBilis buyer has reported a loss of funds and promises to update its notice if that changes. According to The Block, Trezor has checked four other customer devices and found no signs of tampering in any of them.

Chief commercial officer Danny Sanders explained the decision to go public before confirmation: "We'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime."

Which Trezor wallets are covered by the warning?

Every Trezor model bought from CryptoBilis from March 2026 onward, not only the Safe 5. That includes units bought from any store stocked by CryptoBilis, including its Tokopedia storefront. Trezor describes CryptoBilis as a former official reseller in Southeast Asia. Devices bought directly from Trezor or from other authorized sellers are not part of this notice.

What should you do if you bought from CryptoBilis?

Trezor's guidance is blunt:

1. If the wallet holds funds, move them to a brand new wallet with a new seed as soon as you can.
2. Do not restore your old backup words on a different device. If the screen was compromised, those words may already be exposed, so reusing them solves nothing.
3. If you have no trusted hardware wallet available, Trezor suggests moving funds temporarily to a software wallet or an exchange you already know.
4. If the device is still sealed or not set up, leave it that way and never type an existing backup into it.
5. Keep the CryptoBilis device and contact Trezor Support. Eligible buyers can get a replacement Trezor.

If seed phrases and backups are new territory, our explainer on how crypto wallets work covers why a fresh seed matters.

Can you check a hardware wallet for an implant yourself?

Trezor says no. The original reporter noticed the device weighed more than expected, but Trezor says a scale can neither confirm nor rule out tampering, and there is no dependable way for owners to inspect the inside of a device at home. Opening the case can also destroy evidence that its lab would need.

The practical defense is where you buy. Supply chain attacks like this one, and the fake Liquid alerts used in the Ngrave theft, target the gap between the manufacturer and the buyer. Buying straight from the maker closes most of that gap.

When will Trezor confirm what the device contains?

Trezor says its security team will examine the hardware as soon as it reaches the lab, and it will update the notice with the findings. Until then, the safest assumption for any CryptoBilis buyer is that the backup words shown on that screen are no longer private.