Trezor Urges CryptoBilis Buyers to Move Funds After Implant Report

Trezor is urging customers who bought its hardware wallets through reseller CryptoBilis from March 2026 onward to move funds to a newly created wallet with a fresh recovery phrase, following a report of a hardware implant in one Safe 5 device.

In its Oct. 30 notice, Trezor said it received the report through responsible disclosure on Oct. 28 from a customer in Indonesia who bought the device through CryptoBilis on Tokopedia in August. The company has reviewed photos and interviewed the customer by video, but has not received the device for examination. It is treating the report as credible.

“No CryptoBilis buyer has reported a loss of funds to us,” Trezor said on X. It also said it had found no signs of tampering in the four CryptoBilis-sold devices it has received so far.

The warning changes the picture from Oct. 13, when Trezor said it had no reports of tampered devices from CryptoBilis or any other reseller and “there is no indication that Trezor devices are affected.” It now has a report it considers credible, though laboratory confirmation is still pending.

According to the new report, as described by Trezor, an extra circuit board sits between the Safe 5’s main board and screen, with a cellular module and antenna. The alleged implant reads information displayed on the screen, including the wallet backup, and transmits it over a mobile network when the device is plugged in. Trezor stressed that it has not independently verified that description and does not know who is behind it.

Trezor said it removed CryptoBilis as an authorized reseller on Oct. 9. Ledger confirmed an implant in an affected user’s device the following day, as The Defiant reported.

New Seed, Not Just a New Device

Trezor’s precautionary guidance covers every Trezor model bought from CryptoBilis from March 2026 onward, including stores selling devices supplied by the reseller:

- **Already using it:** Move funds to a newly created wallet with a new seed, or recovery phrase, as soon as possible. Do not reuse the old phrase in another hardware or software wallet. - **No other secure hardware wallet available:** Trezor recommends temporarily moving funds to a software wallet or an exchange the customer is familiar with, checking the full receiving address before sending. - **Not yet set up:** Do not set up the device or enter an existing wallet backup into it.

Trezor says eligible buyers can receive a replacement device shipped directly or a voucher covering a new device. Customers should keep the CryptoBilis device and contact Trezor Support; the company says support will never ask for a recovery phrase.

The company cautions that weighing or opening a device is not a dependable way for customers to rule out tampering. Its security team will examine the reported Safe 5 once it arrives.