Hardware wallet maker Trezor has issued an early warning to customers who purchased devices from reseller CryptoBilis, saying a report of a hardware implant inside a Trezor Safe 5 is credible enough to act on before laboratory inspection has been completed. According to Trezor's disclosure, anyone who bought a Trezor from CryptoBilis from March 2026 onward should move funds held on the device to a wallet generated from a new seed phrase.

The company spoke on October 30, 2026. Its security team received the report on October 28. The submission claims a hardware implant was embedded in a Trezor Safe 5 that the buyer purchased from CryptoBilis in August 2026 through Indonesian marketplace Tokopedia. Trezor has not yet physically examined the unit, but said it is treating the customer's account, supported by a video interview, as credible. It chose to warn buyers now rather than wait for laboratory confirmation. So far, no CryptoBilis customer has reported a loss of funds to Trezor.

What the Implant Report Claims

Trezor's disclosure describes an extra circuit board placed between the Safe 5's main board and its screen. The board carries a cellular module and an antenna. According to the report, the alleged implant reads whatever the screen displays, including the wallet backup, and transmits that data over a mobile network once the device is plugged in. The backup at issue is the seed phrase — the sequence of words generated when a hardware wallet is set up that alone is enough to recreate the wallet and spend from it on another device. If the description is accurate, an implant of this kind would expose the one item that fully controls the wallet.

Trezor said the setup resembles implants found in Ledger devices sold by the same reseller, but added that it will not confirm that connection while investigations are ongoing.

The report was filed through Trezor's responsible disclosure program by a customer in Indonesia. That customer had already moved funds off the device before discovering the implant. Trezor thanked the reporter and SEAL 911, the Security Alliance's emergency response service, both of which assisted with the case and with support for affected buyers.

Why All CryptoBilis Buyers Are in Scope

CryptoBilis was an official Trezor reseller in Southeast Asia until October 2026. On October 9, Ledger began investigating fund losses among customers who bought devices from the reseller, and later said some of those devices had been physically altered. Because CryptoBilis also sold Trezor products, Trezor terminated the reseller the same day and began reviewing customer devices.

The October 28 report is, according to Trezor, the first it has received suggesting a possible implant in one of its own units from that sales channel. The company said its guidance covers every Trezor model purchased from CryptoBilis, not just the Safe 5 named in the report. It has received no reports involving any other reseller.

The case highlights how the security promise of a sealed hardware wallet still depends on who handled the device before it reached the buyer. Two questions remain open: whether the laboratory inspection of the reported Safe 5 bears out the customer's account, and what the ongoing investigations conclude about the implants reported in Ledger devices sold through the same channel.

What Affected Buyers Should Do

Trezor advised anyone who purchased a Trezor from CryptoBilis from March 2026 onward, and who holds funds on the device, to move those funds as soon as possible to a newly created wallet with a new seed. Restoring the old backup onto another device does not remove the risk, since the seed may already have been exposed on a tampered unit. Buyers without a second secure hardware wallet can temporarily park funds in a software wallet or an exchange they already trust, and should verify the full receiving address before sending.

The company also instructed buyers not to set up unopened devices from that channel and never to enter existing wallet backups on them. Trezor emphasized that its Support team will never ask for a recovery phrase. It further warned that scammers are likely to exploit the news for phishing, with fake emails, letters, and phone calls already posing a risk.

Affected CryptoBilis buyers remain eligible for a new Trezor shipped directly or a voucher for a replacement. They should keep the CryptoBilis device and contact Support.