Trezor has warned customers who bought its hardware wallets through former reseller CryptoBilis after receiving a report of a suspected physical implant inside one Safe 5. The company said the report is credible enough to justify immediate precautions, while stressing that it has not received or examined the device. No CryptoBilis buyer has reported a loss of funds to Trezor. The disclosure adds a new, still-unconfirmed Trezor case to a wider supply-chain investigation involving devices sold through the Southeast Asian reseller.

One device report, not a confirmed fleet-wide finding

Trezor said its security team received the responsible disclosure on October 28 from a customer in Indonesia. The Safe 5 was bought from CryptoBilis through Tokopedia in August 2026. Trezor reviewed photographs and interviewed the customer by video, but the unit is still being arranged for delivery to its laboratory. That evidence led the company to treat the account as credible, not to declare the reported implant independently verified. The distinction matters because the notice concerns one reported device and does not establish how many units, if any others, were altered.

Related reporting: Ledger CryptoBilis Wallet Implant: Findings and Safety Checks

What the suspected implant is alleged to do

According to the report summarized by Trezor, an extra circuit board sits between the wallet's main board and screen. The board allegedly includes a cellular module and antenna, reads information shown on the display, including the wallet backup generated during setup, and transmits it over a mobile network whenever the device is powered. A recovery phrase can be used to restore control of a wallet elsewhere, so exposure would bypass the protection provided by keeping the original device offline. Trezor cautioned that this description remains unverified until it can inspect the hardware directly.

CryptoBilis buyers face broader precautionary guidance

Trezor's warning applies to every Trezor model supplied by CryptoBilis from March 2026 onward, including devices bought through marketplaces that received stock from the reseller. Customers already using an affected-channel device were told to create a new wallet with a new recovery phrase and move funds to it; reusing the old phrase on another device would not remove the risk if that phrase had been exposed. Buyers who have not set up their device should not use it or enter an existing wallet backup. Trezor said eligible customers can contact support for a replacement device or voucher.

Earlier inspections found no tampering

Trezor removed CryptoBilis from its authorized network on October 9 after Ledger began investigating losses connected to physically modified devices sold through the same reseller. Since then, Trezor has examined four returned devices—a Safe 7, two Safe 5 units and a Safe 3—and said none showed signs of tampering. The company also said it has no reports involving other resellers or regions. Those negative inspections narrow the evidence available today, but they cannot confirm or disprove the separate device report that prompted Friday's notice.

Why the disclosure matters

Hardware wallets are designed to keep signing keys isolated, but their security still depends on the physical device reaching a customer without unauthorized modification. The alleged interposer attacks information displayed during setup rather than the wallet's normal software, illustrating why authentic firmware alone may not answer every supply-chain risk. Trezor advised customers not to open or weigh devices themselves because neither approach reliably confirms tampering. The next important evidence will come from laboratory examination of the reported unit and any additional devices submitted by CryptoBilis customers. Until then, the incident should be treated as a credible report under investigation, not a confirmed widespread compromise.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.