Trezor says it received a responsible disclosure alleging a hardware implant in a Safe 5 bought from reseller CryptoBilis. It has not examined the device but treats the report as credible. The company urges customers who bought from CryptoBilis since March 2026 to move their funds.
Trezor urged customers who bought from CryptoBilis since March 2026 to migrate their funds immediately. The warning follows a disclosure alleging a physical implant in a Safe 5 hardware wallet. The Czech wallet maker had already removed the reseller from its authorized network earlier this month, after reports of tampered Ledger devices sold through the same distributor.
What the disclosure alleges
Trezor said in a blog post that it received the disclosure on Oct. 28 about a unit bought in August 2026 through Tokopedia. The company has not received the device for in-depth examination. It interviewed the customer by video call and considers the report credible.
According to the post, the reported implant is an additional circuit board fitted between the main board and screen. It contains a cellular module and antenna that can reportedly read what the screen displays, including a wallet's recovery phrase, and send it over a mobile network.
Trezor CCO Danny Sanders told The Block: "move your funds to a new wallet and contact our Support team", promising a replacement device.
No confirmed losses at Trezor
Trezor has received four customer devices for examination so far and found no signs of tampering in them. No user funds loss has been reported at Trezor.
Ledger previously confirmed physical tampering in signers sold through CryptoBilis, and OneKey severed ties with the reseller. Onchain analysts estimated losses tied to the Ledger incident at more than $86 million, though Ledger has not confirmed those figures.
This is also not Trezor's first security problem this year. A breach at shipping provider ShipMonk exposed personal data of about 13,700 customers in August. In September, Trezor said another approximately 67,000 U.S. customers were affected by the same breach.
Source: The Block
Trading involves risk.
Risk Disclaimer
