Trezor has urged customers who purchased hardware wallets from reseller CryptoBilis since March 2026 to move their funds to new wallets, after receiving a credible report of a suspected hardware implant in a Trezor Safe 5 device.

The company disclosed the warning in a statement on X on Oct. 30 and detailed the report in an official blog post, saying the issue came to light through responsible disclosure and that no CryptoBilis buyer has reported a loss of funds so far.

CryptoBilis update

We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.

No CryptoBilis buyer has reported a loss of funds to us.

IMPORTANT: If you bought a Trezor from… pic.twitter.com/TiaKfHBnX2

— Trezor (@Trezor) October 30, 2026

The advisory comes weeks after a confirmed hardware implant was discovered in a Ledger wallet sold through the same reseller — a case that onchain analysts estimate has cost users more than $86 million, and that prompted Trezor and other wallet makers to review their reseller relationships. It is the second implant case tied to the reseller, and together the two cases have put the reseller supply chain under scrutiny: hardware wallets are built to keep the private keys that control crypto funds offline, and that security model assumes a device reaches its owner untampered.

A credible report from Indonesia

According to Trezor, the report came from a customer in Indonesia who bought the Safe 5 on Tokopedia, one of the country's largest online marketplaces, in August 2026. Trezor said it received the responsible disclosure on Oct. 28, interviewed the customer by video call, and is treating the report as credible.

The company has not yet examined the device in its laboratory and said it has received no reports of related losses.

How the suspected implant works

The report describes an extra circuit board placed between the device's main board and its screen. The board houses a cellular module and an antenna, and could reportedly read whatever appears on the screen — including the wallet's recovery phrase — before transmitting that data over a mobile network.

A recovery phrase is the sequence of words generated when a wallet is first set up, and it can recreate the wallet's private keys. A stolen recovery phrase can allow an attacker to restore the wallet on another device and move its funds.

Trezor noted that its setup checks are designed to catch counterfeit devices and altered firmware, whereas the implant previously found in a Ledger device was able to read the screen without modifying the firmware at all.

Chief commercial officer Danny Sanders said Trezor chose to warn customers now rather than wait for laboratory confirmation. “If you bought a Trezor from CryptoBilis since March, move your funds to a new wallet,” he said.

Customers are also asked to contact Trezor support, which will send a replacement device. The company described its sales through the reseller as “very small” but did not provide figures.

Ties to the Ledger case and earlier warnings

The warning follows reports of crypto losses tied to Ledger wallets sold through CryptoBilis, which surfaced on Oct. 9. Ledger confirmed an unauthorized hardware implant in one device, and onchain analysts have estimated losses in that case at more than $86 million across Bitcoin, Ethereum, and Tron — figures Ledger has not confirmed.

OneKey also cut ties with the reseller, froze new approvals, and offered free replacements to affected customers. Trezor removed CryptoBilis from its authorized reseller network earlier in October.

Security researcher Joe Grand told Cointelegraph that he had warned Trezor in August about tampered Trezor One and Model T wallets bought from unauthorized sellers on TikTok and Facebook. Trezor said its earlier claim that no compromised devices had been found applied only to new wallets from authorized resellers. The company announced plans to reduce its reseller network on Oct. 13.

Trezor said Friday that it has received four customer devices from the reseller for examination so far and found no signs of tampering in those units. The company added that it has not established where the suspected tampering occurred, that it is reviewing its hardware protections, and that seals and packaging alone are not enough to guarantee a device's integrity. With laboratory confirmation still pending, the findings from the device examinations and the hardware-protection review are the key developments to watch as the case unfolds.