Trezor warns CryptoBilis buyers after report of hidden implant in Safe 5 wallet

Hardware wallet maker Trezor said on Oct. 30 that it received a report on Oct. 28 of a covert circuit board planted inside a Trezor Safe 5 sold by CryptoBilis, its former official reseller in Southeast Asia. Trezor has not yet examined the device but said it is treating the report as credible, and urged anyone who bought a Trezor from CryptoBilis since March 2026 to move their funds as soon as possible to a wallet created with a new recovery phrase. The report follows Ledger's confirmation earlier this month that wallets sold through the same reseller had been tampered with, and marks a similar report involving another manufacturer's device.

A report three weeks after sales stopped

Trezor published the following timeline alongside its notice.

1. Oct. 9Ledger opened an investigation into user reports of losses linked to devices sold by CryptoBilis and asked it to stop selling Ledger devices. Trezor asked CryptoBilis the same day to stop selling all Trezor devices, and CryptoBilis complied.
2. Oct. 10Ledger confirmed an unauthorized hardware implant in at least one affected device.
3. Oct. 13Ledger's Donjon security team published details showing the implant reads what the screen shows and sends the recovery phrase out over LTE. Trezor the same day moved to limit its authorized resellers going forward.
4. Oct. 14Trezor asked customers who bought from CryptoBilis to send their devices in for inspection.
5. From Oct. 19Trezor inspected four returned devices and found no evidence of tampering.
6. Oct. 28A Trezor customer in Indonesia reported a suspected implant in a Safe 5 bought in August. Trezor's security, hardware and reseller teams reviewed the report, photos and receipt the same day.

The four devices inspected earlier were a Safe 7 ordered on April 6, two Safe 5s ordered on June 7 and a Safe 3 ordered on Aug. 4. Trezor said removing CryptoBilis on Oct. 9 was a preventive step, and that it has now found the first evidence that a single device may have been hit by a similar attack.

An extra board between the main board and the screen

According to the report, the Safe 5 had an extra circuit board fitted between the main board and the screen, carrying a cellular module and an antenna. The device reads what appears on the screen, including the wallet backup, or recovery phrase (the list of words used to restore a wallet), and sends it out over a mobile network whenever the device is plugged in. Trezor said it has not verified this itself.

The device was bought from CryptoBilis's store on Tokopedia, an Indonesian online marketplace. The customer noticed a difference in the device's weight, and had already moved his funds off it before finding the implant. Trezor said it interviewed the customer by video call and will examine the device as soon as it reaches its lab. No CryptoBilis buyer has reported losing funds, it said.

"What we've seen looks sophisticated enough that we decided to warn customers now. Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."

Trezor notice

Asked whether the same attackers were behind the Ledger case, Trezor said every hardware wallet maker builds its devices differently, so it will not draw comparisons while investigations are ongoing, and that it does not know who is responsible. It said it is sharing information with Ledger and other parties investigating the issue, and that SEAL 911, an emergency response service for crypto security incidents, helped with the response.

Restoring the old recovery phrase elsewhere won't help

Trezor said that although only one Safe 5 has been reported, its guidance applies to every Trezor model bought from CryptoBilis. That covers any store selling devices supplied by CryptoBilis, including its Tokopedia store, and buyers unsure where their device came from should check the seller name on their receipt.

Trezor said weighing a device or opening it is not a reliable way to check for tampering. Small weight differences can have other causes, so a scale can neither confirm nor rule out tampering, it said. Trezor also warned that scammers will likely use the incident for phishing through fake emails, letters and phone calls, stressing that Trezor Support will never ask for a recovery phrase. It said it has received no similar reports involving other resellers or regions.