Trezor said on Friday that its security team received a responsible disclosure on October 28 describing a hardware implant inside a Trezor Safe 5, which a customer in Indonesia bought from reseller CryptoBilis through Tokopedia in August 2026.
Trezor has not yet received the device, but it treats the report as credible based on the customer’s description, photos and a video interview. The company urges anyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new seed, according to its official notice.
CryptoBilis served as an official Trezor reseller in Southeast Asia until Trezor removed it on October 9, the same day Ledger’s investigation into fund losses among the reseller’s customers became public. Ledger later confirmed that some of those devices had been physically tampered with in a supply chain attack, and it said every confirmed loss it has identified connects to devices sold in Southeast Asia.
How the Reported Implant Captures Wallet Backups
According to the report, an extra circuit board sits inside the Safe 5 between the main board and the screen, carrying a cellular module and an antenna. The report adds that the board reads what the screen displays, including the wallet backup, and sends it over a mobile network whenever the device is plugged in, though Trezor said it has not verified this account.
The company said the implant appears to operate similarly to those seen in Ledger devices, but said it does not know who is behind it and won’t draw further comparisons while investigations continue.
No CryptoBilis buyer has reported a loss to Trezor, and the customer who filed the report had already moved his funds off the device. Trezor said its security team will examine the device when it arrives and will update the notice if losses emerge. Reports of tampered wallets in the region predate the case, and security researcher Joe Grand told Ledger on March 4, 2026 about a malicious implant in a Ledger Nano X purchased through Thailand’s Lazada marketplace in August 2025.
Investor Takeaway
A reported hardware implant inside a Trezor Safe 5 allegedly reads wallet backup details displayed on the screen and transmits them over a cellular network, raising concerns about supply chain attacks targeting hardware wallets.
What CryptoBilis Buyers Should Do to Protect Funds
Trezor told affected customers to move funds to a newly created wallet with a new seed, because restoring the backup from the tampered wallet on another device leaves the problem in place. Customers without another secure hardware wallet can temporarily use a software wallet or a familiar exchange, and buyers who have not set up their device should leave it unused.
Trezor will ship a replacement or provide a voucher to any customer who bought from CryptoBilis since March 2026, and customers should keep the device and contact Support. Trezor said weighing a device does not reliably detect tampering and that it has received no reports involving any other reseller. The company thanked SEAL 911, the Security Alliance’s emergency response service, for working alongside its teams on the report.
The company also warned that scammers will likely use the incident for phishing, a risk customers already face after a ShipMonk breach exposed the personal data of nearly 14,000 customers. Other wallet makers face similar problems, and Keystone disclosed a breach that exposed customer names, contact information, shipping addresses and purchase records.
Investor Takeaway
Trezor urges customers who purchased devices from CryptoBilis since March 2026 to transfer their funds to a newly created wallet with a fresh seed, warning that restoring an existing backup on another device will not eliminate the risk.