Key Takeaways
Trezor is warning customers who purchased wallets through CryptoBilis since March 2026 after a suspected hardware implant was discovered in a Safe 5 device.
The suspected implant contains a cellular modem and antenna that could capture recovery phrases displayed on the wallet's screen.
Affected customers should move their assets to entirely new wallets with new recovery phrases, while eligible buyers can request replacements or vouchers.
What Happened to the Trezor Wallets Sold by CryptoBilis?
Hardware wallet maker Trezor has warned customers who bought its devices through former authorized reseller CryptoBilis since March 2026 to move their digital assets to new wallets.
The warning follows a report that a Trezor Safe 5 wallet sold by the reseller contained a suspected hardware implant that could steal users' recovery phrases.
The report came from a customer in Indonesia who bought a Trezor Safe 5 through the online marketplace Tokopedia in August 2026. On October 28, he informed Trezor's security team that he had found an extra circuit board inside the device.
According to his description, the board was installed between the wallet's main circuit board and its screen. It contained a cellular modem and an antenna, which could allow it to read information displayed on the screen and send it to an outside party through a mobile network.
This could include the wallet's recovery phrase, also known as a seed phrase. The suspected implant reportedly sends the information whenever the device is connected to power.
Trezor has not yet received the wallet for laboratory testing, so it cannot confirm that the implant is malicious or establish exactly how it works. However, the company has reviewed photographs and information from the customer and interviewed him through a video call.
Based on what it has seen so far, Trezor considers the report credible and decided to warn customers without waiting for laboratory confirmation.
"We haven't had the device in our lab yet, but we're treating the report as credible," Trezor's chief commercial officer, Danny Sanders, said. He explained that the company wanted to warn customers before anyone potentially lost their funds.
The Trezor warning is particularly concerning because CryptoBilis was previously linked to a similar incident involving hardware wallets made by Ledger.
On October 9, 2026, Ledger began investigating reports of stolen digital assets from customers who had purchased its wallets through CryptoBilis, an authorized reseller in Southeast Asia.
Ledger later confirmed that at least one affected device contained an unauthorized hardware component designed to capture users' recovery phrases.
The component reportedly read the 24-word recovery phrase directly from the wallet's screen during the initial setup process. It then sent the information through a built-in cellular connection.
The attack did not require hackers to break the wallet's main security chip or change its software. Instead, the malicious component reportedly captured the recovery phrase while it was displayed on the screen.
With the phrase, attackers could restore the wallet on another device and access its funds.
Following the Ledger incident, Trezor removed CryptoBilis from its list of authorized resellers on October 9. It also began reviewing its supply chain and announced plans to reduce the number of authorized resellers to improve security.
The suspected implant found in the Trezor Safe 5 appears to work in a similar way to the one reported in Ledger devices. However, Trezor says it does not know who is behind the incident and will not draw conclusions until its investigation is complete.
Trezor's warning covers all its hardware wallet models purchased through CryptoBilis from March 2026 onward, not just the Safe 5.
Customers who have already set up and used their devices are advised to move their bitcoin and other digital assets to a completely new wallet with a new recovery phrase as soon as possible.
Simply buying another hardware wallet and restoring the old recovery phrase on it is not enough. If the suspected implant has already captured the phrase, attackers may still be able to access the funds.
Anyone without another secure hardware wallet can temporarily move their funds to a software wallet or a trusted exchange.
Customers who have not yet set up their CryptoBilis devices should leave them unused. Trezor also warns them never to enter an existing recovery phrase into one of these devices.
The company says eligible customers who purchased through CryptoBilis from March 2026 onward can receive a replacement hardware wallet or a voucher covering the cost of a new device. They should keep their original wallets and contact Trezor Support for assistance.
Trezor says it has not received reports of stolen digital assets connected to the suspected implant. The customer who reported the issue had already moved his funds before discovering the extra circuit board.
The company also warns customers against trying to identify modified devices by weighing or opening them. Neither method provides a reliable way to detect an implant. The customer noticed that his wallet felt heavier than expected, but Trezor says small differences in weight can have other explanations.
Trezor has also warned that scammers may use the incident to target bitcoin holders through fake emails, letters and phone calls. These scams may attempt to trick users into revealing their recovery phrases.
