Trezor has publicly disclosed a responsible report describing a suspected physical implant inside a Safe 5 hardware wallet obtained through CryptoBilis, a Southeast Asian distributor that previously held authorized status for the brand.
The Czech manufacturer has not yet taken physical possession of the unit for laboratory analysis, yet it is treating the account as credible enough to issue an immediate precautionary warning.
Customers who acquired any Trezor device from CryptoBilis beginning in March 2026 are being urged to transfer their assets without delay.
The disclosure reached Trezor’s security team on 28 October 2026. It concerns a single Safe 5 bought in August 2026 via the Tokopedia marketplace by a buyer in Indonesia.
According to the description supplied by the customer, an additional circuit board had been inserted between the device’s primary board and its screen.
The extra component reportedly includes a cellular communications module and an antenna.
The report states that this assembly can observe information displayed on the screen—including the wallet’s recovery seed generated during setup—and transmit that data over a mobile network whenever the device receives power.
The mechanism appears comparable to the unauthorized hardware previously identified in certain Ledger wallets sold through the same channel.
Trezor emphasized that it has received photographs and conducted a video interview with the reporter, but laboratory confirmation remains pending while arrangements are made to ship the device for examination.
The company noted that the reported modification looks sophisticated enough to justify immediate public notice rather than waiting for full verification, which could leave other buyers exposed in the interim.
No CryptoBilis customer has reported any loss of funds to Trezor.
The individual who discovered the implant had already moved assets off the device before noticing the anomaly.
Because Trezor wallets are self-custodial, the manufacturer cannot independently observe balances.
Background context helps explain the response.
On 9 October 2026, Ledger began investigating unexplained fund losses among customers who had purchased devices from CryptoBilis.
Ledger subsequently confirmed that some units had been physically altered in a sophisticated supply-chain attack.
CryptoBilis was also an authorized Trezor reseller at the time; Trezor removed the firm from its authorized network the same day and began examining customer devices.
By mid-October the company had inspected four Trezors supplied by CryptoBilis—including Safe 5, Safe 7, and Safe 3 units—and found no signs of tampering on those particular devices.
The newly reported Safe 5 is a separate unit.Trezor’s guidance for anyone who bought a device from CryptoBilis from March 2026 onward is straightforward.
Users already storing funds should move them as soon as possible to a newly created wallet generated with a fresh recovery seed. Reusing the original seed on any other hardware or software wallet does not eliminate the risk.
Those without an immediate alternative secure hardware wallet may temporarily transfer assets to a software wallet or a familiar exchange, provided they carefully verify the full receiving address.
Unused devices should not be set up, and existing recovery phrases must never be entered into a suspect unit.
Affected buyers are eligible for a replacement
Trezor shipped directly by the company or a voucher covering the cost of a new device.
They are asked to retain the original hardware and contact official support to arrange the exchange.
Trezor has also cautioned that the incident is likely to attract phishing attempts via email, postal mail, or telephone; the company never requests recovery phrases. No evidence has emerged involving any other reseller or region.
The manufacturer is coordinating with external parties, including the Security Alliance’s SEAL 911 emergency response service and teams investigating the related Ledger cases, and has thanked the original reporter for using its responsible-disclosure channel.
The alert underscores the continuing exposure of hardware-wallet supply chains to sophisticated physical compromise and the value of rapid, transparent communication even before laboratory confirmation is complete.
