Trezor warns of a reported implant in a Safe 5 sold by CryptoBilis

What was reported?

On Oct. 28 a customer in Indonesia filed a responsible disclosure report with Trezor's security team. According to the company's notice on trezor.io, the wallet is a Safe 5 bought from CryptoBilis through the Tokopedia marketplace in August. The report describes a board fitted between the main board and the screen, with a cellular module and an antenna. It allegedly reads what the screen shows, including the wallet backup, and sends it over a mobile network whenever the device is plugged in.

Is the implant confirmed?

No. Trezor says it has seen photos and interviewed the reporter on a video call, but the device has not reached its lab. It is treating the report as credible and chose to warn buyers before any lab result. No CryptoBilis buyer has reported a loss to Trezor, and the reporter had moved his funds off the device before he found the board.

How is this linked to Ledger?

CryptoBilis also sold Ledger devices. Ledger began investigating customer losses on Oct. 9 and later confirmed that some units had been physically tampered with. Trezor removed CryptoBilis as a reseller the same day. Decrypt reports that Trezor has since inspected four of its own CryptoBilis devices, a Safe 7, two Safe 5s and a Safe 3, and found no tampering. Trezor says the new case "appears to operate similarly" to Ledger's but won't compare the two while investigations continue. It comes days after the Keystone breach earlier this week, another attack on the trust behind hardware wallets.

Who is affected?

Per Trezor, anyone who bought any Trezor model from CryptoBilis from March 2026 onwards, including through its Tokopedia store. The company says it has no reports involving other resellers.

Is restoring the old seed on another device enough?

No. Trezor says a wallet backup generated on a tampered device stays exposed, so entering it on a new device solves nothing. Funds need to go to a wallet created with a new seed. Owners who have not set the device up should leave it unused and never type an existing backup into it. Buyers who keep the old unit and contact support can get a replacement or a voucher.

Can owners check the device themselves?

Trezor says no. The reporter noticed a weight difference, but the company says weighing is not a reliable test and there is no dependable way to inspect a device at home.

What about the exchange option?

If no other secure hardware wallet is at hand, Trezor suggests a software wallet or a familiar exchange as a temporary home. Exchanges carry their own risks, as the Binance hack showed this week. Readers weighing the choice can see how hardware and software wallets compare.

Trezor says its security team will open the Safe 5 as soon as it arrives and will update the notice if any buyer reports a loss. It also expects scammers to use the incident for phishing through fake emails, letters and phone calls.