Trezor Safe 5 implant suspected: CryptoBilis buyers since March told to move funds

Trezor is warning that a suspected Trezor Safe 5 implant, reportedly able to beam a wallet’s recovery phrase over a mobile network, may be hiding in devices sold by the reseller CryptoBilis. The company has not yet examined the hardware, but it says it considers the report credible enough to tell customers to act now.

What the Indonesian customer reported

The alarm began with a user in Indonesia who bought a Safe 5 from CryptoBilis through the Tokopedia marketplace in August 2026. After opening the device, the buyer said, they found an extra circuit board sandwiched between the wallet’s main board and its screen. The board reportedly carried a cellular module and an antenna.

Based on that customer’s unconfirmed account, the add-on appears able to read whatever is shown on the display, including the recovery phrase, and send it out over a cellular connection once the wallet is plugged in. A recovery phrase is the master key to a wallet. Anyone who has it can restore the wallet on another device and move the funds out.

Why Trezor is acting before it has the device

The device is still being shipped to Trezor’s lab. Even so, the company chose not to wait for confirmation. “We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” chief commercial officer Danny Sanders told Cointelegraph.

Trezor says it knows of no stolen funds tied to a supply-chain attack. It also describes its sales through CryptoBilis as “very small,” though it declined to give numbers. A spokesperson said the company has not worked out where any tampering happened, and that it is reviewing its hardware protections. The spokesperson acknowledged that seals and packaging alone are not enough.

What buyers should do

Trezor’s guidance is direct:

• Do not set up or use any device bought through CryptoBilis from March 2026 onward.
• If you already have, create a new wallet with a fresh recovery phrase and move your assets into it.
• Buyers with proof of purchase can ask Trezor for a replacement device or a voucher toward a new one.
• Do not rely on weighing the device to detect tampering. Trezor says that is not a reliable test.

A pattern that began with Ledger

The report follows a similar episode involving Ledger earlier this month. Losses among Ledger users who bought through CryptoBilis surfaced on October 9, and Ledger confirmed an unauthorized hardware implant in at least one device. It then asked resellers and distributors in Southeast Asia and Hong Kong to pause sales until the devices could be vetted. The implant in that case reportedly resembles the one now described on the Trezor device in form and function. Coverage of Singapore police figures put the losses from tampered Ledger wallets at a few million dollars, though the outlets cited different totals, $2.7 million in one headline and $3.5 million in another account.

Trezor says it halted sales through CryptoBilis on October 9, before it had any sign its own products were affected. It later said it would shrink and tighten its reseller network globally.

Questions about earlier assurances

The episode also complicates Trezor’s earlier reassurances. Security researcher Joe Grand told Cointelegraph he warned Trezor in August about tampered Trezor One and Model T wallets bought from unauthorized sellers on TikTok and Facebook. Trezor responded that its earlier statement, that it had seen no evidence of compromised devices, covered only new wallets sold through authorized resellers.

The company also noted that its setup checks are designed to catch counterfeit devices and modified firmware. The Ledger implant read the screen without altering firmware, so a screen-reading add-on could slip past checks built for a different kind of attack. If the Trezor Safe 5 implant is confirmed, it would show a gap in how users are told to verify new hardware.

What to watch next

Trezor has promised updates once the device reaches its lab. Until then, the main open questions are whether the board is real, who installed it and at what point in the supply chain, and how many units might be affected. For anyone who bought through CryptoBilis since March, Trezor’s advice is to move funds now and sort out replacements afterward.

Explore more on this topic with Vexel Search.

File photo: $10,000 USD fiat and two Trezor One hardware wallets by Gage Skidmore.jpg by Gage Skidmore, CC BY-SA 3.0, via Wikimedia Commons.