Trezor warns CryptoBilis buyers after reported hardware implant in Safe 5 that may exfiltrate wallet backups

Summary

On October 30, 2026 Trezor published a notice about a responsible-disclosure report (received October 28) of a hardware implant in a Trezor Safe 5 bought from CryptoBilis, until October 2026 an official Trezor reseller in Southeast Asia. The device was bought in August 2026 via Tokopedia by a customer in Indonesia. Trezor has not yet examined the device but treats the report as credible and says the implant appears to operate similarly to those seen in tampered Ledger devices sold by the same reseller.

Affected

• Any Trezor hardware wallet purchased from CryptoBilis from March 2026 onwards
• No fix available: affected devices should be retired, not reused

Impact

Per the report (not yet verified by Trezor), an extra circuit board with a cellular module and antenna is fitted between the main board and the screen; it reads what the screen shows, including the wallet backup (recovery phrase), and transmits it over a mobile network whenever the device is plugged in. A wallet created on such a device must be treated as compromised. Trezor states it has no evidence that any customer has lost funds, and no CryptoBilis buyer has reported a loss to it. Exploitation in the wild is not confirmed.

Recommended actions

• If you bought a Trezor from CryptoBilis from March 2026 onwards and hold funds on it: move funds to a newly created wallet with a new seed as soon as possible; restoring the existing backup on another device does not solve the issue
• If the device is not set up yet: do not set it up and never enter an existing wallet backup on it
• Do not open the device to inspect it yourself; keep it and contact Trezor Support for a replacement device or voucher
• Expect follow-on phishing (fake emails, letters, calls); never share a recovery phrase — Trezor Support will never ask for it

Source & attribution

This 0xCERT advisory summarises a disclosure by Trezor (report received via its responsible disclosure program from a customer in Indonesia; SEAL 911 assisted): https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis. Details may change; refer to the original source for the authoritative record.