Trezor warns CryptoBilis buyers to move funds after alleged implant found in a Safe 5

Trezor is telling anyone who bought one of its hardware wallets from reseller CryptoBilis since March 2026 to migrate their crypto to a new device now, before the company has even confirmed the threat. The Czech manufacturer said it received a responsible disclosure on Oct. 28 describing a physical hardware implant inside a Safe 5 unit, according to a blog post Trezor published Friday and statements its chief commercial officer gave The Block.

The flagged device was bought in August 2026 through Tokopedia, the Indonesian marketplace. Trezor says it has not yet received the unit for teardown; its assessment so far rests on a video-call interview with the customer, which it considers credible enough to act on. As described, the implant is an extra circuit board wedged between the wallet's main board and its screen, carrying a cellular module and antenna that can reportedly read what's on the display — including a recovery phrase — and transmit it over a mobile network.

"We'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime," Trezor CCO Danny Sanders told The Block, adding that affected buyers who contact support will be sent a replacement.

This is not an isolated reseller. Trezor had already pulled CryptoBilis from its authorized network earlier this month after reports of tampered Ledger devices sold through the same Southeast Asian distributor. Ledger has confirmed physical tampering in signers sold via CryptoBilis, and OneKey cut ties, froze new approvals, and offered free replacements. Onchain analysts have estimated losses tied to the Ledger incident at more than $86 million across Bitcoin, Ethereum, and Tron — a figure Ledger has not confirmed.

Key facts

• Disclosure received Oct. 28, 2026; flagged Safe 5 bought August 2026 via Tokopedia (Trezor blog post, via The Block).
• Alleged implant: an added board between main board and screen with a cellular module/antenna able to read the screen and exfiltrate the recovery phrase (Trezor, via The Block).
• Trezor has inspected four returned CryptoBilis devices so far and found no tampering in those units (Trezor, via The Block).
• No Trezor user fund loss reported to date (Trezor, via The Block).
• Ledger-linked losses estimated at $86M+ by onchain analysts; unconfirmed by Ledger (The Block).

The real-world read

Treat the specifics as provisional: Trezor hasn't physically examined the implicated device, so the technical description — a cellular board skimming the screen — comes from one customer interview, not a lab teardown, and Trezor says so. The $86 million Ledger figure is an analyst estimate the vendor won't stand behind; don't read it as settled. What is corroborated across three vendors is the throughline — CryptoBilis as a compromised distribution channel — which is why the "move your funds now" urgency is defensible rather than alarmist. Worth noting the backdrop: Trezor has had a rough year on security hygiene, including a ShipMonk breach affecting roughly 13,700 and later ~67,000 U.S. customers, plus a phishing incident on its email domain. The reseller problem is a separate, physical-supply-chain issue — but it lands on a company whose year already tested customer trust.

Not financial advice. Verify your device's provenance and move funds only through channels you control.

Sources

• The Block (reputable secondary), Oct. 30, 2026 — reported Trezor's blog post and warning, direct statement from CCO Danny Sanders, device/implant details, prior Ledger and OneKey actions, loss estimates, and Trezor's 2026 breach history. The Block cited Trezor's own blog post and onchain analysts as its sources; no primary filing or teardown was available at publication.