Hardware wallet maker Trezor is urging customers who purchased its devices through former authorized reseller CryptoBilis since March 2026 to move their cryptocurrency to new wallets, after a buyer reported a suspected hardware implant inside a Trezor Safe 5. In a notice on its official blog issued October 30 — before the company physically examined the device — Trezor said it has received no reports of stolen funds or related cryptocurrency losses connected to the case. The alert covers every Trezor model sold through CryptoBilis, not only the Safe 5.

Report From an Indonesian Buyer

An Indonesian customer alerted Trezor on October 28 about a Safe 5, a model in the company's current hardware wallet lineup, bought through Tokopedia, an Indonesian marketplace, in August. CryptoBilis was still an authorized seller when the order was placed.

Trezor has reviewed photographs of the device and interviewed the customer but has not tested the unit itself. “We haven’t had the device in our lab yet,” chief commercial officer Danny Sanders said, adding that the company considered the account credible. Trezor declined to disclose exact reseller sales figures.

Alleged Implant Could Capture Recovery Phrases

According to the report, the wallet contains an extra board between its main circuit and the screen. A cellular module and antenna could allegedly transmit the contents shown on the screen, including recovery words, whenever the device receives power.

A recovery phrase allows a cryptocurrency wallet to be restored without the original hardware. Trezor cautioned that attackers could exploit those words even if a customer later switches to a different device. Hardware wallets derive their protection from keeping recovery phrases offline, which is why a component alleged to broadcast screen contents would undermine the safeguard the device is built to provide.

The concern follows reports of tampered Ledger wallets in Singapore, where police recorded two cases involving losses totaling about S$3.5 million. Trezor has not connected those cases to the device reported by the Indonesian buyer.

Earlier Cases Prompted a Reseller Review

Trezor removed CryptoBilis from its approved seller list on October 9, after Ledger confirmed physical changes to devices sold through the same reseller. Investigators have not identified who altered the reported Trezor unit.

The company inspected four other wallets obtained through CryptoBilis and found no tampering. Separately, Keystone this week reported a breach of customer shipping information, although that incident did not involve exposed wallet recovery phrases.

Customers Told to Replace Wallet Backups

Trezor advised affected buyers to create fresh wallets with new recovery phrases and transfer their holdings to them. Restoring an old recovery phrase on different hardware would leave any earlier exposure unresolved.

The company also warned customers to watch for false security messages. Foundation Passport customers recently received phishing emails that included personal purchase details; that separate incident involved misleading emails rather than confirmed hardware tampering.

Customers who have not activated their devices should leave them unused. Trezor offers eligible buyers replacement wallets or vouchers through its support team and says its staff never request recovery phrases. With the reported unit still untested as of the October 30 notice, Trezor's laboratory findings are the case's most immediate open question.