Trezor has alerted customers following credible reports of a suspected hardware implant designed to steal cryptocurrency from a Trezor Safe 5 device purchased through CryptoBilis, a reseller operating in Southeast Asia. The company has not yet obtained the affected device for direct examination, but has issued guidance to potentially impacted users to transfer their private keys and cryptocurrency holdings to verified secure wallets.
Trezor's physical devices function as secure storage for cryptocurrency private keys and facilitate transaction authorization. The Safe 5 represents one of the manufacturer's current-generation offerings and remains available through official channels.
The alert stems from a report submitted by an Indonesian customer who obtained a Safe 5 from CryptoBilis via Tokopedia in August 2026. Upon opening the device, the user discovered an additional circuit board positioned between the primary board and display, featuring a cellular module and antenna assembly.
According to unverified details provided by the customer, the implant would be capable of intercepting information rendered on the screen—including the wallet recovery phrase—and transmitting this data across cellular networks when the device is powered on.
CryptoBilis is the identical distributor involved in a separate implant discovery affecting Ledger devices disclosed earlier this month. The suspected implants in both the Trezor and Ledger devices exhibit comparable design and operational characteristics.
Ledger subsequently validated the compromise and instructed resellers and distributors across Southeast Asia and Hong Kong to suspend all sales pending completion of a security investigation. In anticipation of potential exposure and prior to confirming any direct impact, Trezor halted sales through CryptoBilis on October 9, 2026. The company subsequently committed to restructuring and strengthening its global reseller network to enforce stricter security protocols.
Trezor reports no confirmed instances of funds being compromised through this supply-chain attack and pledges to communicate additional information once the device arrives for analysis.
By contrast, Ledger users have reported multiple fund losses since the earlier discovery, with a recent statement from Singapore authorities documenting an additional $3,500,000 in losses.
Recommended Actions
Trezor advises against initializing or operating any device procured via CryptoBilis beginning in March 2026.
Those who have already set up such devices should immediately transfer their holdings to a freshly generated wallet using a new recovery phrase.
Customers possessing purchase documentation may reach out to Trezor to request a replacement device or receive a credit voucher toward a new purchase.
Trezor has emphasized that physical weight measurement does not constitute a dependable method for identifying whether devices have been subject to tampering.