Quick answer: Trezor said on Oct. 30, 2026 that a customer in Indonesia reported a hidden hardware implant in a Trezor Safe 5 bought from reseller CryptoBilis in August 2026. No losses have been reported, but anyone who bought a Trezor from CryptoBilis since March 2026 should move funds to a wallet with a new seed.
A Trezor Safe 5 implant has now been reported, which means the supply chain attack that hit Ledger buyers in Southeast Asia may reach a second wallet brand. Trezor posted the warning on X at 07:01 UTC on Oct. 30, 2026, together with a detailed blog notice.
The device came from CryptoBilis, the same reseller tied to the tampered Ledger wallets. Trezor has not examined the unit yet, but it calls the report credible and is asking buyers to act now.
What did Trezor find inside the Safe 5?
According to Trezor, its security team received a responsible disclosure on Oct. 28, 2026. A customer in Indonesia reported an extra circuit board inside a Trezor Safe 5 bought from CryptoBilis in August 2026, through its store on the Tokopedia marketplace.
The report describes the board sitting between the main board and the screen, with a cellular module and an antenna. It reportedly reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in. Trezor stresses it has not verified this itself. However, after photos and a video interview with the reporter, it chose to warn customers before lab tests.
Has anyone lost funds?
No losses have been reported so far, according to Trezor. The customer who found the implant had already moved his funds off the device before spotting it.
Trezor also says it has no reports involving any other reseller. Since Oct. 9, it has inspected four other Trezor devices bought from the reseller and found no signs of tampering.
Which Trezor buyers are at risk?
The warning covers every Trezor model bought from CryptoBilis from March 2026 onward, not only the Safe 5. That includes any store selling CryptoBilis stock, such as its Tokopedia shop. If you are unsure, check the seller name on your receipt.
Trezor removed CryptoBilis as an authorized reseller on Oct. 9, 2026, after the Ledger implant attack linked to the same seller. In Singapore, police have since tied tampered Ledger wallets to about S$3.5 million in losses.
What should CryptoBilis buyers do right now?
Trezor’s guidance is short and strict:
- Already using it? Move your funds to a newly created wallet with a new seed as soon as possible. Restoring the old backup on another device does not fix the problem.
- No other hardware wallet? Trezor suggests a software wallet or an exchange you know as a temporary home. Check the full receiving address before you send.
- Not set up yet? Do not set it up, and never enter an existing backup on it.
- Get a replacement. Keep the CryptoBilis device and contact Trezor Support for a free new Trezor or a voucher.
- Do not open or weigh it. Trezor says neither is a reliable test.
Also expect phishing. Trezor warns that scammers will likely use this incident in fake emails, letters and calls. Support will never ask for your recovery phrase. Read our seed phrase guide and our report on fake Foundation Passport emails.
Are hardware wallets still safe for self-custody?
In replies on X, Trezor said hardware wallets remain among the safest ways to self-custody. It added that it is reviewing its device protection layers, such as seals and packaging, and urged buyers to purchase directly from trezor.io.
For holders of Bitcoin and other coins, the lesson is the source. Two brands now point to one reseller, so buying direct from the maker matters more than the model. This also lands on a tense day after the Binance hack tied to North Korea.
Trezor Safe 5 Implant FAQ
Is my Trezor Safe 5 affected by the implant?
Only devices bought from CryptoBilis, including its Tokopedia store, from March 2026 onward are in scope, Trezor said on Oct. 30, 2026. It has no reports involving any other reseller.
How does the Trezor Safe 5 implant work?
Per the report Trezor shared, an extra board between the main board and screen reads what the display shows, including the recovery phrase, and sends it over a mobile network when plugged in. Trezor has not confirmed this in its lab yet.
Will Trezor replace a CryptoBilis device for free?
Yes. Trezor says any customer who bought from CryptoBilis from March 2026 onward can get a new device shipped directly or a voucher. Keep the old device and contact Trezor Support.
Can I check my Trezor by weighing or opening it?
No. Trezor says weighing is not a reliable test and there is no dependable way to inspect a device yourself. Move funds to a new seed as a precaution instead.
Not financial advice. Do your own research (DYOR) before making any investment decision.
