Trezor urges CryptoBilis buyers to move funds after suspected implant report

Trezor has urged customers who purchased Safe 5 devices from CryptoBilis since March to move their funds to a new wallet with a new recovery phrase. This warning follows a report of a suspected hardware implant in a device sold through the reseller. The company stated it is treating the report as credible to warn people before confirmation, even though it has not yet examined the device. Trezor noted that it has received no reports of related losses from CryptoBilis buyers.

The report describes an unauthorized circuit board fitted between the device's main board and its screen. This extra board reportedly includes a cellular module and an antenna. The suspected implant could capture information displayed on the device's screen, including wallet recovery phrases, and transmit it over a cellular network. A customer in Indonesia reported finding this unauthorized circuit board inside a Trezor Safe 5 bought on Tokopedia in August. The device was purchased through the Indonesian e-commerce platform in August 2026.

Trezor chief commercial officer Danny Sanders stated the company is treating the report as credible based on the customer's description and a video interview. Trezor acknowledged that existing safeguards, including seals and packaging, are not sufficient on their own against tampering. The company described sales through CryptoBilis as very small but declined to provide specific figures. Ledger confirmed an unauthorized hardware implant in one device sold through CryptoBilis following reports of crypto losses on Oct. 9.

Security researcher Joe Grand previously alerted Trezor in August about tampered Trezor One and Model T wallets bought through unauthorized sellers on TikTok and Facebook. Trezor announced plans to reduce its reseller network on Oct. 13. The company continues to advise affected users to secure their assets by moving funds to a new wallet with a new recovery phrase.