Trezor Warns CryptoBilis Buyers After Suspected Safe 5 Implant Report

Suspected Implant in a Trezor Safe 5

Trezor has told customers who bought a hardware wallet from its former Southeast Asian reseller CryptoBilis to move their funds, after a report of a suspected malicious implant inside a Trezor Safe 5 device. According to the company's October 30 blog announcement, the disclosure arrived on October 28 and concerned a wallet purchased through CryptoBilis on Tokopedia in Indonesia in August. The buyer reported finding an extra circuit board between the device's main board and its screen, fitted with a cellular module and an antenna. Based on that description, the hardware could read everything shown on the display, including the recovery phrase generated during setup, and transmit it over a mobile network whenever the device is connected to power. Anyone holding the phrase could restore the wallet elsewhere and drain it without the original unit. Trezor said it has reviewed photographs and interviewed the buyer over video but has not yet physically examined the device; its security team is arranging laboratory analysis. The company judged the report credible enough to act immediately. Everyone who bought any Trezor model from CryptoBilis since March 2026 is advised to transfer holdings to a newly created crypto wallet with a completely new recovery phrase, because importing an exposed phrase into another device removes none of the risk, and the phrase is effectively a readable copy of the wallet's private key. Buyers who have not yet configured a purchased device were told to stop and never enter an existing phrase. No customer has reported losing funds so far. Trezor is offering replacement devices or vouchers covering a new unit, asked buyers to keep their hardware, and warned that scammers may exploit the incident through fake emails and calls. It also said opening or weighing a wallet cannot reliably detect tampering. The response is supported by SEAL 911, the Security Alliance's emergency service.

Arkham Traces $95.35M in Thefts

CryptoBilis was once an authorized reseller for both Trezor and its main competitor Ledger across Southeast Asia, and the same storefront sits at the center of a confirmed tampering case. On October 9, Ledger began investigating losses among customers who bought its wallets through the reseller and subsequently confirmed that an unauthorized component inside affected devices could capture recovery phrases shown during setup and exfiltrate them over an LTE connection. That implant worked independently of the device's security chip, leaving normal transaction signing untouched. Trezor removed CryptoBilis from its reseller network the same day and asked customers to submit devices for inspection; by October 19 it had received four units, including two Safe 5 devices, a Safe 7 and a Safe 3, none showing physical tampering. The new disclosure concerns a separate Safe 5 that was not part of those examinations. Investigators have not identified who installed the suspected implant or whether the same attacker hit both brands. The financial trail around the Ledger case is substantial: Arkham Intelligence on October 29 traced $95.35 million in suspected thefts across 1,486 addresses between October 7 and 9, with roughly $10 million in USDT frozen while stolen funds continue moving across multiple blockchain networks. Singapore police separately reported S$3.5 million in losses across two cases involving tampered Ledger devices bought from local retailers. Trezor has tightened its authorized reseller list and is cooperating with Ledger and other parties on the investigation. The company said no reports tied to other resellers have arrived so far, and further details will follow once laboratory results are in.

COINOTAG's reading: both incidents target the same weak point, the moment a recovery phrase is generated on a compromised device, not the signing chip the device is built around. A supply-chain backdoor bypasses every on-device protection because the secret leaves through the screen, which is why a properly purchased cold wallet from an unverified seller can still fail its owner. Trezor's decision to warn customers before laboratory confirmation follows from the shared reseller history with a confirmed Ledger tampering case; the March 2026 cutoff is a precaution, not evidence that every unit sold is affected. Three things matter next: the lab examination of the reported Safe 5, whether investigators link the attacker to the Ledger case, and whether further regional reseller notices emerge. Readers weighing storage choices can first review how hardware wallets work before moving funds.