Trezor Warns Of Suspected Implant In Safe 5 Sold By CryptoBilis

Trezor has disclosed a suspected hardware implant in a Trezor Safe 5 bought through the reseller CryptoBilis. According to The Hacker News, the wallet allegedly contains an extra circuit board that sends out the recovery phrase over a mobile network, as reported by a customer. Trezor said in an October 30 blog post that the report came from a customer in Indonesia who bought the wallet in August through the Tokopedia marketplace. According to the customer's report, the board sits between the wallet's main board and its screen and carries a cellular module and an antenna. It reads the screen, including the recovery phrase, and sends it out whenever the device is plugged in. Ledger's earlier findings on its own devices described a component that decoded recovery words shown on screen and transmitted them over an LTE connection using an eSIM, operating separately from Ledger's Secure Element and operating system. Trezor says the board reported in its Safe 5 appears to work like the implants seen in Ledger devices, but it will not compare the two while investigations continue. The report remains unverified. Trezor's October 30 notice said the device had not yet reached its laboratory, and Trezor has not examined it. No CryptoBilis buyer has reported losing funds to Trezor, which cannot see what customers hold. Trezor has explicitly said it does not know who is behind the suspected modification. For context, Bitquery's October 16 investigation counted $102 million across 335 wallets on 6 blockchains, according to Crypto.news. The material provided does not state whether those figures relate to Ledger or Trezor devices. The Singapore Police Force said in an October 28 advisory that Ledger wallets from some Singapore retail stores contained malicious hardware components, with at least two cases since September 10. Trezor has the customer's photos and description, has interviewed him on a video call, and is arranging for the wallet to be sent to its lab. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase. Trezor removed CryptoBilis from its reseller network on October 9, after Ledger began investigating complaints from customers who had bought through the seller. Readers who bought a Trezor from CryptoBilis since March 2026 should follow Trezor's guidance and move funds to a new wallet with a new recovery phrase. Trezor advises against opening or weighing a device to judge its safety, since weight differences cannot reliably confirm or rule out tampering. Trezor also expects scammers to exploit the incident through fake emails, letters and phone calls, so readers should treat unsolicited messages about it with suspicion and use only official Trezor channels. Buying hardware wallets directly from the manufacturer or an authorized reseller reduces supply-chain risk. Trezor dropped CryptoBilis, its authorized reseller in Southeast Asia, after Ledger began investigating losses among Ledger customers who had bought from CryptoBilis. Ledger has said one affected customer's wallet contained an unauthorized hardware implant built to capture the recovery phrase during setup. Trezor's case, by contrast, rests on a single customer report that remains unverified.