Key Notes
- Trezor is investigating a credible Safe 5 implant report but has not yet examined the device.
- Buyers of any Trezor model from CryptoBilis since March 2026 are urged to move funds to a newly generated seed.
- No related theft has been reported to Trezor, which is offering eligible buyers a replacement or voucher.
Trezor is urging customers who bought a hardware wallet from CryptoBilis, its former reseller in Southeast Asia, from March 2026 onward to move their cryptocurrency to a newly created wallet after receiving a responsible-disclosure report of a possible hardware implant in one Trezor Safe 5. Trezor considers the report credible. The company has not yet received the reported device for laboratory examination. No related loss of funds has been reported to Trezor.
The warning covers every Trezor model supplied by CryptoBilis during that period, including purchases through its Tokopedia store. Trezor’s October 30 security notice says affected users need a fresh recovery seed: restoring the old backup on another hardware or software wallet would not protect the funds if that backup had been exposed.
Danny Sanders, CCO at Trezor, said:
“This week we received a report from a customer showing what looks like a hardware implant inside a Trezor Safe 5 they bought from CryptoBilis. We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime. If you bought a Trezor from CryptoBilis since March, move your funds to a new wallet and contact our Support team, and we’ll send you a new device.”
One Safe 5 Report Is Awaiting Examination
The disclosure reached Trezor’s security team on October 28. A customer in Indonesia reported finding additional electronics inside a Safe 5 bought through CryptoBilis on Tokopedia in August 2026. Trezor reviewed photographs and interviewed the customer by video, then decided to alert buyers before the device reached its lab.
According to the customer’s report, an extra circuit board sits between the main board and the screen, with a cellular module and an antenna. It allegedly captures information displayed on the screen, including the recovery backup, and transmits it over a mobile network while the device is connected to power. Trezor has not independently verified that mechanism.
The customer had moved funds away before discovering the suspected implant. In a separate company update, Trezor said four other CryptoBilis-supplied devices it had received for inspection showed no signs of tampering. That small inspection sample does not determine whether another buyer’s device is safe.
CryptoBilis Buyers Need a New Seed
Trezor’s precaution applies to purchases from March 2026 onward, rather than to all Trezor owners. It includes devices sold by stores supplied by CryptoBilis. Buyers who are unsure should check the seller on their receipt or contact official support.
- If the device is already in use, move funds to a new wallet generated with a new seed on trusted hardware. Do not import the potentially exposed backup into the replacement wallet.
- If no secure hardware wallet is available, Trezor recommends a temporary move to a software wallet or a familiar exchange. Carefully verify the complete receiving address before sending funds.
- If the device has not been initialized, leave it unused and never enter an existing recovery backup into it.
Trezor says weighing or opening a device yourself is not a dependable safety test. Small weight differences can have innocent explanations, so a normal reading cannot rule out tampering. Its instructions prioritize moving potentially exposed funds and contacting support.
Replacement Devices and a Phishing Warning
Customers who bought through CryptoBilis from March onward are eligible for a replacement shipped directly by Trezor or a voucher covering a new device. The company asks buyers to retain their CryptoBilis unit and arrange assistance through official support.
Trezor also warns that criminals may exploit the incident through fake emails, letters and phone calls. Its support team will never request a recovery phrase. A replacement request does not require sharing the words that control the wallet.
The Ledger Investigation Provides the Background
Trezor says it removed CryptoBilis as an authorized reseller on October 9, after reports of tampered Ledger devices. CoinScreamer previously covered the broader Trezor and OneKey reseller changes, when Trezor said it had no evidence of compromised devices. The newly disclosed Safe 5 report changes that investigative picture without establishing a confirmed Trezor theft.
Our earlier Ledger implant report covered a manufacturer-confirmed hardware finding. The Safe 5 case remains a customer report Trezor considers credible pending examination. Trezor says it has no reports involving other resellers and has not identified the attackers or established that they are the same people behind the Ledger incidents.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
