Trezor Warns CryptoBilis Buyers To Move Funds After Suspected Safe 5 Implant

Safe 5 implant warning

Trezor warned customers who bought hardware wallets from former authorized reseller CryptoBilis to move their funds to newly created wallets after a buyer in Indonesia reported a suspected implant inside a Trezor Safe 5 device.

+1Trezor issues warning7 of 7 outlets reported it▾

Trezor said the report came from a wallet purchased on Tokopedia in August 2026, and the company received the disclosure on Oct. 28 before issuing a public warning on Oct. 30.

Disclosure date and source5 of 6 outlets reported it · not in Cointelegraph▾

Trezor described the suspected component as an extra circuit board with a cellular module and antenna that could capture recovery phrases shown on screen and transmit them over a mobile network.

Trezor said it had not physically examined the unit, but it judged the account credible enough to issue the warning, and it said no losses had been reported by CryptoBilis buyers.

Reporting for this sectionBigGo FinanceDecrypt

Reseller fallout and scope

Trezor removed CryptoBilis from its authorized reseller network on Oct. 9, the same day Ledger began investigating reports of losses among customers who had bought Ledger wallets through the same channel.

Ledger confirmed that an unauthorized component inside an affected device could capture recovery phrases during setup and transmit them via an LTE connection, operating independently of the security chip so transaction-signing functions were left unchanged.

Trezor said it had received four wallets bought through CryptoBilis by Oct. 19, including two Safe 5 units, a Safe 7 and a Safe 3, and none showed signs of physical tampering.

Trezor said the suspected implant reported on Oct. 28 involved a separate Safe 5 device that was not among those inspected, and it said its guidance covers every model supplied by CryptoBilis since March 2026.

Reporting for this sectionBigGo FinanceCrypto News

What users are told

Trezor told CryptoBilis buyers to set up a new wallet with a completely new recovery phrase and move their assets there, rather than importing an existing phrase into another device. Trezor warned that a phrase that had already been exposed remains at risk regardless of where it is used, and it advised customers who had not yet configured a device from the reseller to leave it unconfigured and avoid entering an existing recovery phrase.

What customers should do5 of 6 outlets reported it · not in Cointelegraph▾

Trezor said eligible buyers could receive a replacement shipped directly or a voucher covering the cost of a new device, and it asked customers to keep the existing hardware and contact the company’s support team to arrange the exchange. Trezor also cautioned that opening or weighing a wallet cannot reliably establish whether it has been modified, and it said weight differences can have other causes and there is no dependable home inspection method.

Reporting for this sectionCyberSecurityNews