Trezor warns of suspected theft implant in a Safe 5 sold by CryptoBilis
A customer reports an extra board in a Trezor Safe 5 that allegedly sends the recovery phrase over a mobile network. Unconfirmed, but Trezor tells all CryptoBilis buyers since March 2026 to move funds.
Translated from the German original with an AI language model, approved by me. Read the original
Trezor is warning about a suspected hardware implant in a Trezor Safe 5 sold through CryptoBilis, a reseller in Southeast Asia. An implant here means an extra component secretly built into the device to tamper with it. One thing up front: Trezor has not examined the device itself yet. The warning is based on a customer's report, but the manufacturer considers it credible enough to act now.
What happened
According to Trezor's own notice, a report came in through its responsible disclosure program on October 28, 2026. Responsible disclosure means that whoever finds a vulnerability reports it to the vendor first instead of publishing it. A customer in Indonesia had bought the Safe 5 from CryptoBilis via the Tokopedia marketplace in August 2026. After opening it, the customer says they found an extra circuit board between the main board and the display, with a cellular module and an antenna.
The board allegedly reads what's on the screen, including the recovery phrase. That's the list of usually 12 to 24 words that can fully restore a crypto wallet. Whoever has it has the money. Whenever the device is plugged in, the board is said to send the phrase out over a mobile network. None of this is confirmed yet. Trezor has photos and a video interview with the customer, and the device is being shipped to its lab (BleepingComputer, The Hacker News).
What's new since my first post
A few things to add or clarify:
- Not just the Safe 5: The warning covers every Trezor model bought from CryptoBilis since March 2026. That includes stores that resold CryptoBilis-supplied devices, such as its Tokopedia store.
- No known losses: The customer who reported it had already moved their funds off the wallet before finding the board. Trezor has received no loss reports from CryptoBilis buyers so far.
- Other devices look clean: According to Decrypt, Trezor has since inspected four other devices bought from CryptoBilis (a Safe 7, two Safe 5s and a Safe 3) and found no evidence of tampering. So far, this is about a single reported device.
- Replacement: Buyers with proof of purchase can get a new device or a voucher from Trezor.
Why it matters
A hardware wallet is a small device that keeps the keys to your cryptocurrency offline. Its whole point is to protect against malware on your computer. An implant inside the device itself breaks that promise completely. This is a classic supply-chain attack: rather than attacking the manufacturer, someone tampers with the product somewhere on its way to the customer.
This case doesn't stand alone. CryptoBilis was also tied to an implant incident at Ledger, where Ledger confirmed tampering designed to capture the recovery phrase during setup. That's why Trezor already dropped CryptoBilis as a reseller on October 9, before it had any sign its own devices were affected. On October 28, the Singapore Police Force also warned about tampered Ledger devices from some retail stores. Trezor says the reported board appears to work like the Ledger implants, but it won't make a direct comparison while investigations continue. Who is behind it remains unknown.
Who is affected
Anyone who bought a Trezor device since March 2026 from CryptoBilis or from a store selling CryptoBilis stock. Trezor says it has no reports involving other resellers or regions. If you're not sure, check the seller's name on your receipt or ask Trezor Support.
What you should do
- Already set up: Move your funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old phrase on a different device doesn't help, because the phrase itself has to be treated as compromised.
- No other secure hardware wallet at hand: Temporarily use a software wallet or an exchange you trust, and verify the full receiving address.
- Not set up yet: Don't set it up, and never enter an existing recovery phrase on it.
- Don't investigate yourself: Don't open or weigh the device. Trezor says weight is not a reliable test. Keep the device and contact Support.
- Expect phishing: Scammers will exploit this with fake emails, letters and phone calls. No legitimate party will ask for your recovery phrase, Trezor Support included.
My general advice: buy hardware wallets only directly from the manufacturer or from officially listed resellers. Marketplace listings and gray-market stock are a bad idea for a device you trust with your money. Once Trezor publishes lab results, I'll follow up here.