Trezor Warns CryptoBilis Buyers After Implant Report

Anyone who bought a Trezor hardware wallet from the reseller CryptoBilis from March 2026 onwards should move their funds to a newly created wallet with a new seed as soon as possible, Trezor said on 30 October. The warning, in a Trezor blog post and an update on X, follows a report of a hidden implant in one Trezor Safe 5 bought from CryptoBilis. Trezor says it is treating that report as credible but has not yet examined the device.

Via @Trezor on X.

Trezor says no CryptoBilis buyer has reported a loss of funds to it.

What CryptoBilis buyers should do

Trezor’s advice applies to every Trezor model bought from CryptoBilis since March 2026, including through its store on the Indonesian marketplace Tokopedia, not only the Safe 5:

Already using it? Move funds to a new wallet with a new seed now. Trezor says on X that the old seed should never be reused “in any wallet, hardware or software”, and its blog explains why: “Using the wallet backup generated by the tampered wallet on another device does not solve the issue.”
No other secure hardware wallet? Trezor recommends moving funds temporarily to a software wallet or an exchange you know, and checking the full receiving address before sending.
Not set up yet? “Don’t set it up, and never enter your existing wallet backup on it.”
Replacement: buyers from CryptoBilis since March 2026 can get a new Trezor shipped directly or a voucher for one. Trezor asks them to keep the CryptoBilis device and contact Trezor Support.
Opening or weighing it: Trezor advises against both. “Weighing isn’t a reliable test, and there’s no dependable way to inspect a device yourself,” it says.
Phishing: “NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.” Trezor expects scammers to exploit the incident with fake emails, letters and phone calls.

If you are unsure where a device came from, Trezor suggests checking the seller name on the receipt or asking Support. It recommends buying direct from trezor.io.

What has been reported, and what has not been checked

Trezor says its security team received a responsible disclosure on 28 October of “a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026”. The customer, in Indonesia, bought it via Tokopedia. Trezor says the implant “appears to operate similarly to those seen in Ledger devices”.

According to the report, which Trezor stresses it has not verified, an extra circuit board with a cellular module and antenna sits between the main board and the screen. It reads what the screen shows, including the wallet backup, and sends it out over a mobile network when the device is plugged in.

“We haven’t received the device to confirm this report, but based on the customer’s description and a video interview, we’re treating it as credible,” Trezor says. It decided to warn customers now because waiting for lab confirmation “would leave CryptoBilis buyers exposed in the meantime”. The customer who reported it had already moved his funds off the device.

The report concerns one device. Trezor says it has found no signs of tampering on any of the four CryptoBilis devices it has received so far, and that it has no reports involving any other reseller. In a reply on X, it said: “We don’t have any confirmed cases outside CryptoBilis nor any confirmed loss of funds at the moment.”

How this fits the CryptoBilis case

CryptoBilis was an authorised Ledger and Trezor reseller in Southeast Asia. Ledger began investigating lost funds among its buyers on 9 October and later confirmed a hardware implant in one affected device. Trezor removed CryptoBilis as a reseller the same day and later cut the number of shops allowed to sell its devices, calling that a preventive step. CryptoBilis’s former co-founders have said the business changed hands in March, and another maker, OneKey, has said that is why it chose 1 March as its own cut-off. Trezor has not explained its date.

Trezor says it is working with Ledger and others investigating, and thanked the reporting customer and SEAL 911, the Security Alliance’s emergency response service. It says it does not know who is behind the implant and “won’t draw comparisons while investigations are ongoing”.

Why the risk sits in the route, not the brand

The pattern now reaching a second brand is about where devices were bought, not who made them. Both reported implants came through the same reseller, and Trezor says it has no evidence of the problem affecting Trezor devices outside CryptoBilis. Hardware wallets protect keys from online attackers; this attack, if confirmed, works by putting extra hardware inside the case before the device reaches its owner, so that it can read the recovery phrase off the screen.

That is why Trezor’s advice centres on the seed rather than the device. Moving funds to a seed generated on a trusted device closes the gap, whatever the old device contains. Reusing the old seed elsewhere does not, because the risk is that the phrase itself has already been copied.

Trezor admits that packaging alone has limits. “It’s very hard for any device case to fully stop someone who has the device in their hands for long enough before it reaches the customer,” it said in a reply on X, adding that it is reviewing how it protects its devices. Retailers have already reacted to the Ledger reports, with MediaMarktSaturn removing Ledger products. The lab examination of this Safe 5 will decide whether Trezor’s precaution becomes a confirmed second case. Earlier incidents are collected in TSN’s crypto hacks hub.