Trezor reports suspected hardware implant in Safe 5 sold by CryptoBilis

Trezor urged customers who purchased hardware wallets from reseller CryptoBilis since March 2026 to migrate their funds immediately, following a responsible disclosure alleging a physical hardware implant in a Safe 5 device.

The Czech hardware wallet maker removed CryptoBilis from its authorized reseller network earlier this month following reports of tampered Ledger devices sold through the same distributor. 

In a blog post published Friday, Trezor said it received the disclosure on Oct. 28 regarding a unit bought in August 2026 through Tokopedia. The company has not received the device for in-depth examination but it interviewed the customer by video call and is treating the report as credible, it added. 

"We'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime," Trezor CCO Danny Sanders said in a statement to The Block. "If you bought a Trezor from CryptoBilis since March, move your funds to a new wallet and contact our Support team, and we'll send you a new device."

According to the post, the reported implant consists of an additional circuit board fitted between the device's main board and screen. It contains a cellular module and antenna that can reportedly read information displayed on the screen, including a wallet's recovery phrase, and transmit it over a mobile network.

Trezor said it began inspecting devices purchased from the reseller after removing it from its network. The company has received four customer devices for examination so far and said it found no signs of tampering in those units.

Rising security incidents 

Rival wallet maker Ledger previously confirmed physical tampering in signers sold through CryptoBilis, while OneKey similarly severed ties with the reseller, froze new approvals, and offered free replacements.

For Trezor's part, no user funds loss has been reported. Onchain analysts estimated losses tied to the Ledger incident at more than $86 million across Bitcoin, Ethereum, and Tron, but the wallet maker has not confirmed those figures. 

Meanwhile, the CryptoBilis incident is not the first security headache for Trezor this year. In August, a breach at shipping provider ShipMonk exposed personal data belonging to about 13,700 customers. 

In September, Trezor disclosed that another approximately 67,000 U.S. customers were affected by the same breach. Also in the same month, the company said a breach at its third-party email provider had enabled phishing messages to be sent from Trezor's official domain.