Trezor is investigating a credible report of a suspected hardware implant in a Trezor Safe 5 wallet sold by Southeast Asian reseller CryptoBilis. The alleged implant includes a cellular module and antenna that may be capable of reading information shown on the device’s screen—including a wallet recovery phrase—and transmitting it over a mobile network. Trezor has not yet received the device for testing and says it is not aware of any stolen funds linked to the incident.
Trezor is warning potentially affected users to move their private keys and digital assets to a known secure wallet.
Suspected implant found inside Trezor Safe 5
A Trezor wallet is a physical device that stores cryptocurrency private keys and authorizes transactions. The Safe 5 is one of the company’s newest models and remains available through Trezor’s official store.
According to Trezor, the investigation began after an Indonesian user reported purchasing a Safe 5 from CryptoBilis through Tokopedia in August 2026. After opening the wallet, users discovered an additional circuit board positioned between the device’s main board and screen. The board included a cellular module and an antenna.
Based on unconfirmed information supplied by customers, the implant may be able to read information displayed on the screen, including a wallet’s recovery phrase, and transmit it over a mobile network after the device is connected.
CryptoBilis previously linked to Ledger incident
CryptoBilis is the same retailer involved in the Ledger implant scandal that emerged earlier this month. The implants reportedly found in the Ledger and Trezor devices appear similar in both form and function.
Ledger later admitted that a breach had occurred and asked resellers and distributors in Southeast Asia and Hong Kong to stop selling its devices until an investigation confirmed that sales could safely resume.
Following the Ledger incident, Trezor suspended device sales through CryptoBilis on October 9, 2026, before finding any indication that its own products had been affected. The company later said it would rebuild and strengthen its reseller network worldwide to improve supply-chain security.
Trezor said it has not received any reports of funds being stolen as a result of the suspected supply-chain attack. The company plans to provide an update after receiving the devices, which are currently being shipped for examination.
Meanwhile, multiple reports of losses by Ledger users have emerged since the beginning of this month. The Singapore Police announcement most recently added another $3,500,000 to the reported total.
What affected Trezor users should do
Trezor currently recommends that users do not set up or use devices purchased through CryptoBilis after March 2026.
Anyone who has already used one of these devices should create a new wallet with a new recovery phrase and transfer their funds to it. Users should not reuse a recovery phrase that may have been displayed on a potentially compromised device.
Customers with proof of purchase can contact Trezor to request a replacement device or a voucher for a new one. Trezor also stressed that weighing a device is not a reliable method for determining whether it has been tampered with.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com