After receiving a report on October 28, 2026 of a suspected hardware implant in a Trezor device, the company is now advising anyone who purchased wallets from CryptoBilis since March 2026 to transfer their funds elsewhere. The report concerns a Safe 5 purchased through Tokopedia in August 2026. Trezor considers the disclosure credible, but has not yet examined the device; no CryptoBilis buyer has reported losing funds to the company.
Key takeaways
The suspected implant reportedly captures wallet backups and transmits them over mobile networks.
Trezor’s precaution covers every model supplied by CryptoBilis since March 2026.
Eligible customers can receive replacement hardware or a voucher.
The reported device is awaiting laboratory examination.
Contents of the alleged Trezor hardware implant
According to the customer’s report, an extra circuit board was fitted between the Safe 5’s main board and screen, equipped with a cellular module and antenna; it allegedly captures information shown on the screen—including the wallet backup—and sends it over a mobile network each time the device is plugged in.
The report came from a customer in Indonesia who submitted it via Trezor‘s responsible disclosure program, and the security team examined photographs and spoke with the customer over video call prior to issuing the alert.
Before discovering the added hardware, the customer had already withdrawn his funds from the device; Trezor states there is no evidence linking customer fund losses to the alleged implant, though it notes that its self-custodial wallets prevent it from viewing customers’ balances.
CryptoBilis removed after Ledger tampering reports
CryptoBilis was an authorized reseller for both Trezor and Ledger in Southeast Asia until October 2026. Ledger began investigating customer fund losses on October 9, 2026, and subsequently confirmed physical tampering in some devices sold by the reseller as part of a supply chain attack.
Trezor removed CryptoBilis from its authorized reseller network on October 9 and began examining customer devices. It also restricted its authorized seller network as a precaution.
As of October 19, four wallets supplied by CryptoBilis—two Safe 5 units, one Safe 7, and one Safe 3—had been examined by Trezor, and None showed physical tampering. The Safe 5 flagged on October 28 was not part of that examined batch.
The Trezor warning covers devices supplied by CryptoBilis, including its Tokopedia store and other shops carrying its inventory. Trezor reports no cases involving other resellers or regions. Customers can check the seller on their receipt or contact Support to establish where their device came from.
Customers told to use new wallets and new recovery phrases
Anyone storing funds on a Trezor bought from CryptoBilis from March 2026 onward should transfer them as soon as possible to a newly created wallet with a new recovery phrase, Trezor says. Restoring the existing backup on another device does not resolve exposure of that backup.
Customers without another secure hardware wallet can temporarily use a familiar software wallet or exchange. Trezor advises checking the full receiving address before transferring funds.
Buyers who have not configured their devices should leave them unused and never enter an existing wallet backup on them.
Eligible customers can receive a replacement shipped directly by Trezor or a voucher covering a new device. They should retain their CryptoBilis hardware and contact Support to arrange the replacement.
Trezor also warns that scammers could exploit the incident through fake emails, physical letters and phone calls. Customers should never share their recovery phrase; Trezor Support will never request it.
Laboratory examination is the next step
Trezor’s security team is arranging to receive the device for laboratory analysis of the suspected hardware implant. The company says the customer’s description, photographs and video interview were credible enough to justify warning buyers before physical verification.
Trezor advises against opening or weighing devices to check for tampering. Although the reporting customer noticed a weight difference, the company says a scale cannot reliably confirm or rule out modification.
Ledger and other parties are coordinating with Trezor as part of the investigation, and SEAL 911, the Security Alliance’s emergency response service for crypto security incidents, is also collaborating with Trezor to advise on supporting affected customers. Trezor says its security team will examine the reported device as soon as it arrives.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.