Trezor has urged customers who bought any of its hardware wallets from former reseller CryptoBilis since March 2026 to move their cryptocurrency to a newly created wallet with a new recovery phrase. The October 30 warning follows a credible customer report of a suspected physical implant in a Trezor Safe 5, but the manufacturer has not yet examined the device or confirmed that the alleged component functions as described.
In its official security notice dated October 30, 2026, Trezor said an Indonesian customer contacted its security team on October 28 regarding a Safe 5 bought through CryptoBilis on Tokopedia in August. Trezor has photographs and interviewed the customer by video call. It is arranging for laboratory examination of the device.
What was reportedly found inside the wallet?
According to the customer account shared by Trezor, an extra circuit board had been installed between the main board and screen. The reported component contains a cellular module and antenna and may capture displayed information, including the wallet backup phrase, before transmitting it over a mobile network when powered. These are allegations about a physical device that Trezor has not independently verified.
If a recovery phrase is exposed, an attacker could potentially restore the wallet elsewhere without possessing the hardware wallet itself. Simply moving the existing recovery phrase to a different device would therefore not remove that risk.
CryptoBilis reseller relationship ended October 9
Trezor said it removed CryptoBilis from its authorized reseller network on October 9 after Ledger began investigating fund losses among customers who had purchased Ledger devices through the same retailer. The company said its review of four other returned Trezor devices found no signs of tampering, but those results cannot establish the condition of every product sold by the reseller.
According to Trezor, there have been no reports of customer funds stolen in connection with this suspected Trezor implant. The manufacturer has also not identified the party responsible for any tampering or established where in the supply chain the suspected modification occurred.
Steps for potentially affected customers
- Check purchase records to determine whether your Trezor device came from CryptoBilis, directly or through one of its marketplace listings, from March 2026 onward.
- If already using the device, move assets promptly to a new wallet generated with a new recovery phrase on a trusted device. Carefully verify the full destination address.
- If a CryptoBilis-supplied device has not been initialized, do not set it up or enter an existing wallet phrase on it.
- Retain the device and contact Trezor Support through the official website to seek a replacement or voucher. Do not share your recovery phrase with anyone claiming to offer assistance.
Trezor says weighing or opening the device is not a dependable way for customers to verify whether an implant is present. It also warns that scammers may exploit the disclosure through fraudulent emails, letters and calls.
What is still unknown
The device has not yet been subjected to Trezor’s physical examination. Its reported functionality, the number of potentially affected devices, and the precise point at which any modification took place remain unresolved. Trezor’s precautionary warning applies to all models supplied by CryptoBilis since March, not because all are confirmed compromised, but because the company cannot yet rule out a wider supply-chain risk.
The case illustrates the distinction between a theoretically secure signing device and the physical integrity of the retail distribution chain. For related coverage of wallet-security risks, see BlockBriefing’s investigation of a hardware-wallet customer data breach.
Source and verification: Trezor’s October 30 primary-source advisory. This report attributes unconfirmed physical-implant details to the customer disclosure described by Trezor and does not imply confirmed cryptocurrency losses.
