Trezor Safe 5 implant reported at CryptoBilis: who needs a new wallet now

On October 30, 2026, Trezor warned all customers who have bought a device from former reseller CryptoBilis since March 2026. A buyer reported an additional circuit board with a cellular module inside a Trezor Safe 5, said to read and transmit the screen content, including the recovery phrase. Anyone who bought their device directly from Trezor or from another reseller is not affected on current information: Trezor has no reports involving other resellers or regions.

The implant has not yet been verified. At the time of its warning, the manufacturer did not have the device in hand and relied on the customer's description and a video call with them. Even so, Trezor advises all CryptoBilis buyers to move their coins to a new wallet with a new recovery phrase. This article sets out what has been reported, who needs to act and why the case also matters to buyers in Germany who have never dealt with CryptoBilis.

Trezor Safe 5: what the manufacturer reported on October 30

According to Trezor's notice, its security team received a so-called responsible disclosure on October 28, 2026. Responsible disclosure means reporting a vulnerability confidentially to the manufacturer before it becomes public. The report concerned a hardware implant in a Trezor Safe 5 that the customer had bought from CryptoBilis via the online marketplace Tokopedia in August 2026. Two days later, on October 30, Trezor went public with a warning.

In it, the manufacturer stresses that it has not yet verified the report. It does, however, consider it credible. Industry outlet The Block quotes Danny Sanders, Chief Commercial Officer at Trezor, on the reasoning behind the move: “We'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime.”

Two points in the notice matter for putting this in context. The customer who reported the implant had already moved their coins off the device before discovering the extra board. And by the time of publication, not a single CryptoBilis buyer had reported a loss to Trezor. Trezor says it will update the notice if that changes. Because Trezor wallets are self-custodial, the manufacturer cannot see its customers' balances and depends on such reports.

Hardware implant: extra board with a cellular module between main board and display

A hardware implant is a component fitted after the fact that secretly adds a function to a device that the manufacturer never intended. In the reported Safe 5, it is said to be an additional printed circuit board sitting between the main board and the screen. According to the description, it carries a cellular module and an antenna.

According to the customer's report, this board reads what the screen displays, including the wallet backup, and transmits the content over the mobile network as soon as the device is connected. Trezor states explicitly that it has not tested this mode of operation itself. According to the notice, the implant appears to work in a similar way to the components previously found in Ledger devices. Trezor expressly declines to compare the attackers while the investigation is ongoing; who is behind the implant is unknown, according to the manufacturer.

The attack path explains why such a component is so dangerous. A hardware wallet protects the private key by never passing it to the computer or smartphone. The recovery phrase, also known as the seed phrase, is the list of words from which all the wallet's keys can be recalculated. The phrase appears on the display during setup so that you can write it down. Anyone who reads exactly that moment needs neither a password nor the device PIN: with the phrase, the wallet can be restored on any device and emptied.

CryptoBilis: the same reseller as in the Ledger case in October

CryptoBilis is a distribution partner from Southeast Asia that has sold devices from both Ledger and Trezor. On October 9, 2026, Ledger began investigating losses among customers who had bought their devices from CryptoBilis, and later confirmed physical tampering on individual devices. On the same day, Trezor removed CryptoBilis from its network of authorised resellers, by its own account as a precaution and before there was any sign of affected Trezor devices.

The extent of the damage in the Ledger case has not been finally established. On-chain analysts estimated the losses in Bitcoin, Ether and Tron at more than $86 million, according to The Block; Ledger has not confirmed that figure. cryptoticker.io reported on the start of the case on October 9, 2026. In Germany, MediaMarkt and Saturn temporarily pulled Ledger devices from sale after a customer reported an implant, as we reported on October 13, 2026; the details are in our article on the sales halt at MediaMarkt and Saturn.

Since then, according to The Block, Trezor has examined four more customer devices from the CryptoBilis stock and found no trace of tampering on any of them. On October 13, the manufacturer also announced that it would significantly shrink its reseller network worldwide. Delisted partners may sell off their remaining stock until January 1, 2027, as we described on October 18, 2026 in our report on the end of Trezor reseller authorisations.

Who is affected: Trezor purchases from CryptoBilis since March 2026

Trezor deliberately draws the circle of those affected widely. It covers anyone who has bought a Trezor device from CryptoBilis since March 2026, regardless of model. A Trezor Safe 3 or Safe 7 from this channel is therefore just as much included as the reported Safe 5. It also covers all marketplaces on which devices supplied by CryptoBilis were offered, explicitly including the shop on Tokopedia.

On current information, anyone who bought elsewhere is not affected. Trezor writes that there are no reports concerning other resellers or regions, and says it will inform customers if that changes. A device from the official Trezor shop or from an authorised reseller outside this channel is therefore not under suspicion.

If you are unsure where your device came from, the answer is usually in the order confirmation or on the invoice. A device from a third-party seller's marketplace listing whose supplier can no longer be traced deserves more caution than one with a clear invoice from the manufacturer. Trezor ties the entitlement to a replacement device to a purchase from CryptoBilis, so you should keep the receipt.

Trezor customers in Germany: the purchase channel matters more than the model

For buyers in Germany, direct exposure is low based on everything known so far. CryptoBilis was a distribution partner for Southeast Asia, and the reported case stems from a purchase via an Indonesian marketplace. The case still matters, because it is the second reported attack through the same reseller within a few weeks and now involves a second manufacturer.

The lesson applies to anyone buying a hardware wallet. A supply chain attack is one that does not hit the finished product at the user's end but a stage before it: manufacturing, warehousing, shipping or distribution. A tampered device looks like any other from the outside. Whether a device is safe therefore depends above all on how many hands it has passed through. If you are looking for a new device, the cryptoticker.io hardware wallet comparison lists the common models along with where to buy them.

A second point concerns all Trezor customers, whatever the reseller. Trezor says it expects scammers to exploit the incident and warns of phishing by email, letter and phone. Trezor customers have already been targeted by such attempts this year: The Block recalls the data leak at shipping provider ShipMonk, which affected the data of around 13,700 customers in August, and a further roughly 67,000 customers in the US who were reported as affected in September. Anyone who now receives a message about a supposedly affected device should read it with suspicion.

How to protect yourself from tampered hardware wallets in the resale chain

What happened: On October 28, 2026, a customer reported to Trezor an extra board with a cellular module in a Safe 5 bought from CryptoBilis via Tokopedia in August 2026. Trezor has not yet examined the device but considers the report credible; no loss had been reported as of October 30, 2026 (Trezor).

Are you affected? Anyone who has bought a Trezor device of any model since March 2026 from CryptoBilis or from a marketplace shop selling CryptoBilis stock may be affected. Anyone who bought directly from Trezor or from another reseller is not affected on current information. An implant cannot be detected from the outside; the only thing that counts is the purchase channel on your invoice.

1. Move your funds: If coins sit on a CryptoBilis device, transfer them as soon as possible to a new wallet with a newly generated recovery phrase, because the old phrase must be treated as known.
2. Never reuse the old phrase: Do not restore the backup of the affected device on another device either, because Trezor explicitly points out that the problem would then remain.
3. Do not set it up: Do not switch on a device from this channel that is still in its original packaging, and never enter an existing recovery phrase on it.
4. Request a replacement: Keep the device together with the receipt and contact Trezor support, which offers a new device or a voucher worth a new device.
5. Fend off phishing: Never give your recovery phrase to anyone, including a supposed support agent, because Trezor never asks for it and warns of emails, letters and calls about this incident.

You can find the comparable devices in the hardware wallet comparison.

Why weighing and unscrewing are no substitute for an implant check

The obvious move would be to simply check your own device. Trezor advises against it. The customer who reported the implant had noticed a difference in weight, but according to the manufacturer a scale can neither reliably prove nor reliably rule out tampering. The notice puts it this way: “there's no dependable way to inspect a device yourself.”

Opening the casing is no solution either. An opened device is less informative for a later examination by the manufacturer, and a layperson can hardly tell a tiny extra board from a regular component. Trezor instead recommends the approach that works without any inspection: move your funds, keep the device and contact support.

The reason for this stance lies in the risk. Anyone who mistakes a tampered device for a clean one can lose everything in the worst case. Anyone who replaces a clean device as a precaution loses only some time and a transaction fee for the move.

New seed phrase: a stopgap without a second hardware wallet

Not everyone has a second, secure device to hand. For this case, Trezor names two interim solutions: a software wallet or an exchange you know. A software wallet is an app on a smartphone or computer that manages the keys itself. Such an app is more convenient, but exposed to the risks of the device it runs on. The software wallet comparison shows which apps are suitable.

An exchange, by contrast, holds the coins for you. Since MiCA, the EU's Markets in Crypto-Assets regulation, providers in the EU need authorisation to do so. Anyone choosing this route for a few days should pick a provider with that licence; the comparison of regulated crypto exchanges offers an overview. Trezor's advice is particularly relevant during the move: check the complete receiving address before you send, not just the beginning and end.

As soon as the replacement device arrives, generate a new recovery phrase on it, write it down offline and move the coins back from the stopgap. The phrase of the CryptoBilis device then stays permanently unused.

Lab result pending: how Trezor is now examining the Safe 5

Confirmation is the main open question. Trezor plans to examine the reported Safe 5 in its lab as soon as the device arrives and then update the notice. Only then will it be clear whether the implant works as described. The manufacturer says it is working with Ledger and other parties and thanks the emergency team SEAL 911, a group of security researchers that helps crypto users under attack.

The overhaul of the reseller network, which Trezor announced on October 13, is also under way; in the new notice, the manufacturer describes limiting its authorised sellers as a precautionary measure. For buyers, that is good news for now, because it reduces the number of stops between factory and customer. Until the delisted resellers lose their authorisation on January 1, 2027, buying directly from the manufacturer or from a clearly listed reseller remains the safest route.

Trezor implant: purchases from CryptoBilis since March 2026 are what count

On current information, the reported case affects a narrowly defined group, and no loss is known. Anyone who did not buy through CryptoBilis does not need to move anything. Three steps still make sense:

1. Establish the purchase channel: Dig out the invoice or order confirmation. If the device came from CryptoBilis, follow the five steps above; the hardware wallet comparison helps with a new device.
2. Secure the transition: If you lack a second device, use a vetted app from the software wallet comparison for a few days and check every receiving address in full.
3. Only licensed exchanges: If you park coins temporarily on a trading platform, choose a provider from the comparison of regulated crypto exchanges.

(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)