Trezor Safe 5 hardware implant report prompts a warning for CryptoBilis buyers. Trezor says no buyers have reported fund losses.
Author: Kritika Gupta
30th October 2026- Trezor urged customers to move their funds. The warning followed a report of a hardware implant in a Safe 5 wallet. The device came from CryptoBilis, a Southeast Asia reseller that Trezor has since dropped.A customer in Indonesia reported the Trezor Safe 5 implant through responsible disclosure on October 28. Trezor reviewed photos and ran a video interview. Then, two days later, it posted a public advisory on X and its official blog.
High Signal Summary For A Quick Glance
High attention and emotional sentiment detected.
According to the report, the implant is an extra circuit board. It sits between the main board and the screen. The board carries a cellular module and an antenna.
The customer says the implant reads whatever appears on the screen. That includes the wallet backup, also known as the seed. It then transmits that data over a mobile network whenever someone plugs in the device.
The buyer purchased the device through Tokopedia in August 2026. Notably, that customer had already moved funds before spotting the implant. So far, no CryptoBilis Trezor buyer has reported a loss of funds to the company.
The Trezor Safe 5 uses a Secure Element. That chip guards private keys against many remote attacks and some physical ones. However, this implant does not try to break the chip.
Instead, it simply watches the screen while the seed is displayed during setup or recovery. As a result, an attacker could rebuild the wallet elsewhere. In short, the trick sidesteps the Secure Element rather than defeating it.
This differs from software or firmware attacks, which target code or the host computer. By contrast, a hardware implant is a physical tap on the display path. Therefore it counts as a supply-chain attack, planted before the box ever reached the buyer.
Key milestones related to this development
A customer in Indonesia buys a Trezor Safe 5 from CryptoBilis through Tokopedia.
A customer submits a responsible disclosure describing a suspected hardware implant. Trezor reviews photos and interviews the customer.
Trezor warns CryptoBilis buyers and urges affected users to move funds to new wallets with new recovery seeds. No buyers have reported fund losses to Trezor.
Further investigation could establish the scope. A reseller response and any broader recall decision remain unconfirmed.
Trezor has not yet received the device. The company has not examined it in a lab. Still, it is treating the report as credible based on the description and the video interview.
Trezor chief commercial officer Danny Sanders explained the choice to The Block and Cointelegraph. “We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” he said.
Meanwhile, Trezor has inspected four other CryptoBilis-sold devices. That batch included one Safe 7, two Safe 5 units, and one Safe 3. Importantly, none of those four showed any sign of tampering.
Genuine Trezor vs. tampered device
CryptoBilis was an authorized reseller for both Trezor and Ledger across Southeast Asia. Its markets included Indonesia, Malaysia, and the Philippines. It sold through platforms such as Tokopedia.
Trezor removed CryptoBilis as a reseller on October 9. On the same day, Ledger began investigating fund losses tied to tampered devices sold through the same partner. Within days, Ledger confirmed a screen-reading cellular implant in at least one of its own units.
The reported Trezor Safe 5 implant appears to work in a similar way, according to Trezor. The related Ledger case involved confirmed drains. On-chain analysts estimated losses of tens of millions, and some figures reached roughly $100 million across hundreds of wallets. That Ledger damage is a separate incident, not a Trezor loss.
Trezor’s guidance covers every model bought from CryptoBilis, or from stores it supplied, from March 2026 onward. The company described the affected sales volume as very small. Even so, it issued clear steps for worried buyers.
If the device is already in use, move your funds to a new wallet with a brand-new seed soon. Do not reuse the old seed on any wallet, hardware or software. If needed, use a familiar software wallet or exchange for now, and verify the full receiving address first.
If the device is unused, do not set it up and do not enter an existing backup on it. Either way, keep the device and contact Trezor Support for a free replacement or a voucher. Never share your recovery phrase with anyone.
Trezor also advises against opening the device yourself, since that risks damage and proves little. Checking packaging and running the Trezor Suite genuine-check still helps. The disclosing customer noticed a weight difference, yet Trezor cautions that weighing is unreliable.
Several questions stay open. Trezor cannot yet confirm that the implant is real and fully working, because the device is not in its lab. The exact number of affected units beyond this one is unknown.
It is also unclear whether CryptoBilis was complicit, compromised, or whether the tampering happened elsewhere in the supply chain. CryptoBilis has not issued a public statement so far. The security group SEAL 911 is assisting Trezor with the response and customer support.
For now, the safest path remains the familiar one. Buy hardware wallets directly from the manufacturer or verified sellers, and check every device on arrival. This article is security guidance, not financial advice, so treat your own setup with care.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
