TLDR
- Trezor urged customers who bought wallets from reseller CryptoBilis since March 2026 to move their funds.
- A customer in Indonesia reported a suspected implant in a Safe 5 bought on Tokopedia in August.
- The implant could reportedly read recovery phrases off the screen and send them over a cellular network.
- Trezor has not examined the device and has received no reports of related losses.
- The warning follows a confirmed Ledger implant case tied to CryptoBilis, with analysts estimating losses above $86 million.
Trezor has urged customers who bought hardware wallets from reseller CryptoBilis since March 2026 to move their funds. The warning follows a report of a suspected hardware implant in a Trezor Safe 5.
CryptoBilis update
We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from… pic.twitter.com/TiaKfHBnX2
— Trezor (@Trezor) October 30, 2026
A customer in Indonesia reported the issue, according to Trezor. The device was bought on Tokopedia in August 2026.
Trezor said it received the responsible disclosure on Oct. 28. It interviewed the customer by video call and is treating the report as credible.
Trezor has not yet examined the device in its lab. The company said it has received no reports of related losses.
What the suspected implant does
The report describes an extra circuit board placed between the main board and the screen. It holds a cellular module and an antenna.
The board could reportedly read what appears on the screen, including a wallet recovery phrase. It could then send that data over a mobile network.
A stolen recovery phrase can let an attacker restore a wallet on another device. The attacker could then move the funds.
Trezor said its setup checks target counterfeit devices and altered firmware. The implant found in a Ledger device read the screen without changing the firmware.
Trezor chief commercial officer Danny Sanders said the company would rather warn people now than wait for confirmation. “If you bought a Trezor from CryptoBilis since March, move your funds to a new wallet,” he said.
Customers should also contact Trezor support, which will send a new device. Trezor described its sales through the reseller as “very small” but gave no figures.
Links to the Ledger case and earlier issues
The warning follows reports of crypto losses tied to Ledger wallets sold through CryptoBilis, which surfaced on Oct. 9. Ledger confirmed an unauthorized hardware implant in one device.
Onchain analysts estimated losses from the Ledger case at more than $86 million across Bitcoin, Ethereum and Tron. Ledger has not confirmed those figures.
OneKey also cut ties with the reseller, froze new approvals and offered free replacements. Trezor removed CryptoBilis from its authorized network earlier this month.
Security researcher Joe Grand told Cointelegraph he warned Trezor in August about tampered Trezor One and Model T wallets. Those were bought from unauthorized sellers on TikTok and Facebook.
Trezor said its earlier claim of no compromised devices applied only to new wallets from authorized resellers. The company announced plans to reduce its reseller network on Oct. 13.
Trezor has received four customer devices from the reseller for examination so far. It found no signs of tampering in those units.
Trezor said Friday that it has not established where the suspected tampering occurred. It is reviewing its hardware protections and said seals and packaging are not enough on their own.
