Trezor warns of suspected crypto-theft implant in hardware wallet
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia.
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia.
Although the company has not yet received the device to examine it and confirm whether there is a malicious implant, it has warned potentially affected users to move their private keys and digital assets to known safe wallets.
Trezor wallets are physical devices that store cryptocurrency private keys and authorize transactions. Safe 5 is one of its latest models and is currently available for purchase from the official store.
According to Trezor, the concerns arose after it received a report from an Indonesian user who purchased a Safe 5 device from CryptoBilis through Tokopedia in August 2026.
The user opened it and found an extra circuit board between the wallet’s main board and screen, equipped with a cellular module and antenna.
Based on unconfirmed information supplied by that customer, the implant appears capable of reading information displayed on the screen, including the wallet recovery phrase, and transmitting it over a mobile network when plugged in.
CryptoBilis is the same retailer implicated in a Ledger implant incident that unfolded earlier this month, and the implants on the two devices appear to be similar in form and function.
Ledger later confirmed the compromise and asked resellers and distributors in Southeast Asia and Hong Kong to halt all sales until the investigation confirms their safety.
In response to the Ledger incident, and before it had any indication it was impacted, Trezor immediately stopped device sales through CryptoBilis on October 9, 2026. The company later announced it would restructure and tighten its reseller network globally to maintain higher levels of security.
Trezor says it is unaware of any funds being stolen as a result of a supply-chain attack, and promised to provide updates once it receives the device, which is currently being shipped to it.
Meanwhile, multiple reports of losses by Ledger users have emerged since earlier this month, and a recent Singapore police announcement added another $3,500,000 to the tally.
.jpg)
Source: Trezor
For now, Trezor recommends not setting up or using any device bought via CryptoBilis from March 2026 onward.
Users who have already done so are advised to move their funds to a newly created wallet with a new recovery phrase.
Buyers holding proof of purchase may contact Trezor for a replacement device or a voucher for a new device.
Trezor underlined that weighing devices is not a reliable way to determine if they have been tampered with.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
