A Trezor Safe 5 bought through the reseller CryptoBilis allegedly contains a hidden cellular implant, and Trezor is telling anyone who bought a Trezor from CryptoBilis since March 2026 and keeps funds on it to move them to a new wallet. The report reached the company on October 28 from a customer in Indonesia, who had purchased the device in August through the Tokopedia marketplace. Trezor has not yet received the device.
As Trezor describes the report, an extra circuit board sits inside the device between the main board and the screen, carrying a cellular module and an antenna. The reporter says it reads what the display shows, backup words included, and sends it out over a mobile network whenever the device is plugged in. Trezor stresses that it has not verified this and is arranging for the device to be sent to its lab. The reporter had moved his funds off the wallet beforehand, and Trezor says no CryptoBilis buyer has reported a loss.
CryptoBilis was an official Trezor reseller in Southeast Asia until October, and also an authorized Ledger reseller. On October 9, Ledger began investigating fund losses among customers who had bought hardware wallets from CryptoBilis, later confirming that some of those devices had been physically tampered with in a supply chain attack, as Trezor tells it. Trezor dropped CryptoBilis the same day and has since narrowed its list of authorized sellers. Trezor says the implant appears to work like those in Ledger devices, but will not draw comparisons while investigations continue and does not know who is behind it. It is working with Ledger and SEAL 911, the Security Alliance's emergency response service.
Trezor advises against checking a unit at home: the reporter noticed a weight difference, but small differences can have other causes, and the company says there is no dependable way for owners to inspect a device themselves. Trezor lists an EAL6+ certified secure element, a tamper-evident casing and security seals on both the packaging and the device among the Trezor Safe 5's protections. It has not said how the reported board relates to those protections, and it plans to examine the device once it arrives.
Buyers who already use a CryptoBilis device should create a new wallet with a new seed and move their funds. Trezor says reusing the backup that the tampered wallet generated, on another device, does not solve the issue. Anyone who hasn't set one up should not do so and should never enter an existing backup on it. Trezor warns that scammers will likely use the incident for phishing, such as fake emails, letters and phone calls, and says Trezor Support will never ask for a recovery phrase. The advice covers every Trezor model bought from CryptoBilis since March 2026, not only the Safe 5, from any store selling CryptoBilis-supplied devices, its Tokopedia store included. Those buyers can get a replacement device or a voucher if they keep the original and contact Trezor Support.
