Trezor warns of suspected cellular implant in Safe 5 wallet sold by CryptoBilis

Hardware wallet maker Trezor warned customers on October 30, 2026, after receiving a credible report about a suspected crypto-theft hardware implant in a Trezor Safe 5 device sold by its Southeast Asian reseller, CryptoBilis. According to Trezor, an Indonesian customer reported on October 28 that he had bought the wallet from CryptoBilis through the marketplace Tokopedia in August 2026.

After noticing a weight difference and moving his funds off the wallet, the buyer opened it and found an extra circuit board between the main board and the screen. Equipped with a cellular module and antenna, the board appears capable of reading screen information, including the recovery phrase, and transmitting it over a mobile network when plugged in. Trezor has reviewed the customer's photos and interviewed him via video call. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," the company said.

CryptoBilis was implicated in a similar incident involving hardware wallet maker Ledger earlier in the month. After Ledger began investigating customer losses, Trezor ended sales through CryptoBilis on October 9, 2026, and announced plans to restructure and tighten its global reseller network. Ledger later confirmed an unauthorised hardware implant in an affected wallet and asked resellers and distributors in Southeast Asia and Hong Kong to halt sales, while a recent Singapore police announcement added $3,500,000 to reported Ledger losses.

Trezor is unaware of any funds stolen from its users and had no reports involving other resellers as of October 30. It advises customers not to set up or use any Trezor device bought from CryptoBilis since March 2026, and urges existing users to move their funds to a new wallet with a new recovery phrase. Trezor noted that weighing or opening devices cannot reliably detect tampering, and warned of potential phishing scams via fake emails, letters and phone calls.

The affected Safe 5 wallet is currently being shipped to Trezor's lab for examination, and the company promised to provide updates once it receives the device. While investigations continue, buyers with proof of purchase from CryptoBilis can keep their device and contact Trezor Support for a replacement unit or a voucher covering the cost of a new device.

Sources: BleepingComputer, The Hacker News

Written with AI and fact-checked against the linked sources by an automated AI review before publication. Spotted an error? See our Corrections Policy.