Trezor’s security team received a report about a possible hardware implant in a Trezor Safe 5 bought from CryptoBilis in Indonesia through the Tokopedia marketplace in August 2026. Although Trezor has not examined the device in its laboratory, it considers the report credible and warned affected customers because the suspected implant may have exposed their wallet backups.

Trezor said it had no confirmation that funds had been stolen from CryptoBilis customers. The company urged anyone who bought any Trezor model through the seller since March 2026 to take precautions.

Suspected implant and Ledger investigation

According to the reporter, an additional board containing a cellular module and antenna was installed between the Safe 5’s main board and screen. The reporter said the implant reads information shown on the screen, including the wallet backup, and transmits it over a mobile network whenever the device is connected to power.

A user in Indonesia reported the device through Trezor’s responsible disclosure program. The company received photographs and a receipt and conducted a video interview with the user. Trezor said the information was serious enough to warrant a customer warning before laboratory verification.

“We haven’t received the device to confirm this report, but based on the customer’s description and a video interview, we’re treating it as credible,” Trezor said.

Trezor said the suspected implant may work on a principle similar to implants previously found in Ledger devices. The report emerged during an investigation into a supply-chain attack involving hardware wallets sold by CryptoBilis.

Ledger began reviewing reports on Oct. 9, 2026, that customers who bought devices through CryptoBilis had lost funds. The company later confirmed an unauthorized hardware implant in at least one wallet. On Oct. 13, the Ledger Donjon team published technical details showing that the detected component could read screen information and transmit the seed phrase through LTE.

After that investigation began, Trezor asked CryptoBilis to stop selling its devices, and the seller complied. Starting Oct. 19, Trezor received four returned devices for inspection: one Safe 7, two Safe 5 units and one Safe 3. The company found no evidence of tampering in those devices but said other devices could still have been compromised.

Trezor said it did not know who was behind the suspected attack and had not concluded that the implants in Ledger and Trezor devices were connected. It is working with Ledger and other participants in the investigation. SEAL 911, the Security Alliance’s emergency response service for crypto-security incidents, is also involved in the response.

Guidance and replacements for customers

Trezor advised customers already using devices bought from CryptoBilis since March 2026 to move their funds as soon as possible to a new wallet generated with a new seed phrase. Restoring the old backup on another device would not remove the risk if the phrase had already been intercepted.

Customers without another hardware wallet should temporarily move their assets to a software wallet or exchange they trust, Trezor said. Those who have not set up their CryptoBilis device should not activate it or enter an existing wallet backup on it.

The company also warned that scammers may exploit the incident through fraudulent emails, physical messages or phone calls while posing as Trezor representatives. Trezor said its support staff never ask customers to disclose their seed phrase.

Customers who bought devices through CryptoBilis since March 2026 can receive a replacement wallet delivered directly by Trezor or a voucher to buy one. They must retain the CryptoBilis device and contact Trezor support.

Although the notice concerns a specific Safe 5, Trezor said its recommendations apply to all models purchased through CryptoBilis. It advised users not to weigh or dismantle their devices because there is no reliable way for customers to check for an implant themselves.

As of publication, Trezor had received no reports of funds being stolen from CryptoBilis customers. The company said the user who found the suspicious component moved their assets off the device before discovering it.

Other hardware-wallet security incidents

The CryptoBilis case follows other security incidents affecting hardware-wallet users. A large-scale attack on Coldcard owners led to the theft of about 1,367 BTC, worth nearly $88.6 million. Trezor also reported that a breach of logistics partner ShipMonk exposed the personal data of 13,689 customers.

In September 2026, Trezor warned that attackers had compromised a third-party email provider and used its infrastructure to distribute phishing emails. Keystone separately reported that a breach of its official website exposed customer names, contact details, shipping addresses and order histories, though the company said private keys and seed phrases were not affected.

Source: Incrypted