Trezor Warns of Suspected Crypto-Theft Implant in Safe 5 Wallet
Summary
Trezor is investigating a suspected crypto-theft implant found in a Safe 5 bought from reseller CryptoBilis. The device has not yet been examined, and no related fund theft is known. Trezor advises affected buyers to move assets to a new wallet.
Key points
- An Indonesian customer reported finding an extra circuit board with a cellular module and antenna inside a Trezor Safe 5 bought through CryptoBilis.
- Based on unconfirmed information from the customer, the implant may read the wallet display, including a recovery phrase, and transmit it over a mobile network.
- Trezor has not received the device for examination and says it is unaware of any resulting fund theft.
- Trezor stopped sales through CryptoBilis on October 9, 2026, and says it plans to tighten its reseller network.
- Trezor advises against setting up or using devices bought from CryptoBilis from March 2026 onward; users who already did so should move funds to a new wallet with a new recovery phrase.
- Eligible buyers with proof of purchase may contact Trezor about a replacement device or voucher; Trezor says weighing a device is not a reliable tampering check.
- CryptoBilis was also implicated in a similar Ledger implant incident; Ledger later confirmed compromise and halted sales through resellers and distributors in the region during its investigation.
Article Details
- Incident Type
- Suspected hardware supply-chain compromise involving a possible crypto-theft implant in a Trezor Safe 5.
- Disclosure Date
- 2026-10-30
- Data Types Exposed
- Potentially the wallet recovery phrase and other information displayed on the device screen; the implant's capability and any exposure are unconfirmed.
- Operational Impact
- Trezor advised users not to set up or use devices bought through CryptoBilis from March 2026 onward, and advised those who had used one to move funds to a newly created wallet with a new recovery phrase. Trezor said it was unaware of any funds stolen in a supply-chain attack.
- Ransom Or Extortion
- No ransom or extortion was reported.
- Claim Status
- alleged
Vendors
CryptoBilisHardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia.LedgerCryptoBilis is the same retailer implicated in a Ledger implant incident that unfolded earlier this month, and the implants on the two devices appear to be similar in form and function.TrezorTrezor warns of suspected crypto-theft implant in hardware wallet