In brief
- Trezor said it received a credible report of a hardware implant in a Safe 5 bought from reseller CryptoBilis in August, though it hasn't examined the device yet.
- The implant reportedly reads the wallet backup from the screen and sends it over a mobile network, which Trezor says appears similar to Ledger's case.
- Trezor urged anyone who bought one of its wallets from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.
Hardware wallet manufacturer Trezor has warned customers who bought its devices from reseller CryptoBilis to move their funds, after a buyer reported finding a hardware implant inside a Trezor Safe 5, the company said on Friday.
A customer in Indonesia reported the implant through Trezor's responsible disclosure program on October 28, according to a company blog post. The Safe 5 was bought from CryptoBilis through Indonesian e-commerce platform Tokopedia in August 2026.
We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from… pic.twitter.com/TiaKfHBnX2
The report describes an extra circuit board fitted between the device's main board and its screen, with a cellular module and an antenna. According to the report, which Trezor said it has not verified, the board reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.
Trezor has not yet received the device, but said it is treating the report as credible based on the customer's description and a video interview. "What we've seen looks sophisticated enough that we decided to warn customers now," it said. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."
No CryptoBilis buyer has reported a loss of funds to Trezor, the company said.
Trezor urged anyone who bought one of its wallets from CryptoBilis from March 2026 onwards to move their funds to a newly created wallet with a new recovery phrase as soon as possible, and not to reuse the old phrase on any device. Buyers who have not yet set up their device should not use it. Affected customers can keep their CryptoBilis device and contact Trezor Support for a replacement.
The CryptoBilis incident
Trezor removed CryptoBilis as a reseller on October 9, after rival hardware wallet manufacturer Ledger began investigating losses among customers who bought its devices from the Southeast Asian reseller. Trezor has since inspected four of its devices bought from CryptoBilis, a Safe 7, two Safe 5s and a Safe 3, and found no evidence of tampering.
Ledger's Donjon security team found an implant in Ledger devices sold through CryptoBilis that reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. Trezor's blog says the newly reported implant "appears to operate similarly," though the company added that it won't draw comparisons while investigations are ongoing and doesn't know who is behind it.
Ledger has said that all confirmed losses involve devices bought from CryptoBilis, and asked resellers in seven Asian markets to pull its devices. One of the largest victims was a scammer who lost more than 60 BTC, worth about $4.8 million, according to blockchain analytics firm Chainalysis.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.