Trezor Orders CryptoBilis Buyers to Move Funds After Safe 5 Implant Report

Issued on October 30, 2026, the Trezor CryptoBilis alert instructed customers to transfer their assets away from any hardware wallet purchased from that reseller since March, following a report from an Indonesian buyer who suspected a cellular implant inside a Trezor Safe 5.

That notification reached the firm on October 28. The customer had acquired the device via Tokopedia in August and submitted the report through Trezor’s responsible disclosure program. Decrypt noted that the manufacturer is treating the incident as credible, even though the physical hardware has not yet arrived at its lab.

Inside the Reported Safe 5 Implant

According to the description, the modification consists of an extra circuit board positioned between the primary board and the display screen, equipped with an antenna and a cellular module.

Read More: Ledger vs Trezor: Which Hardware Wallet Is Better?

Trezor possesses photographs alongside a video interview of the buyer. The company decided to make the information public prior to concluding its laboratory analysis, explaining that waiting would leave additional CryptoBilis purchasers vulnerable.

As reported by CryptoPotato, the secondary component could potentially read anything shown on the display—including a wallet backup—and transmit the data over a mobile network whenever the hardware was plugged in.

CryptoBilis update

We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.

No CryptoBilis buyer has reported a loss of funds to us.

IMPORTANT: If you bought a Trezor from… pic.twitter.com/TiaKfHBnX2

— Trezor (@Trezor) October 30, 2026

Trezor CryptoBilis warning: Affected Buyers Must Create a New Wallet and Move Their Funds

Anyone who purchased from CryptoBilis from March 2026 onward should transfer their funds immediately to a wallet created with a newly generated recovery phrase. Simply restoring a potentially compromised recovery phrase on a different hardware wallet does not resolve the risk.

A CryptoBilis device that remains unconfigured should be left that way: do not use it or type an existing backup into it. Trezor advises that if a secure hardware wallet is unavailable, a software wallet or trusted exchange can serve as a temporary destination, provided the user carefully verifies the complete receiving address before sending funds.

The buyer in Indonesia had already transferred their assets. Trezor confirmed that no other CryptoBilis customers have reported losing funds.

Trezor Removed CryptoBilis and Offers Replacements

CryptoBilis was removed from Trezor’s official reseller directory on October 9 after Ledger initiated an investigation into financial losses linked to products distributed by the Southeast Asian vendor. Since then, four units originating from CryptoBilis—consisting of a Safe 7, two Safe 5s, and a Safe 3—have been opened and inspected, with zero evidence of tampering.

The Indonesian Safe 5 is separate from those four inspected units. Trezor noted that the suspected hardware operates similarly to an implant previously found in a Ledger device, though the identity of the person responsible for the modification remains unknown.

Owners may retain their CryptoBilis hardware and reach out to Trezor Support to receive either a direct replacement shipped from Trezor or a voucher to purchase a new device.

Users should also remain vigilant against phishing scams. Fraudulent emails, letters, and phone calls are expected to attempt to steal recovery phrases or direct individuals toward fake replacement procedures.

Cointelegraph shared that the company is currently re-evaluating its hardware security measures, acknowledging that packaging and seals alone cannot guarantee a device has not been tampered with prior to delivery.

FAQ

When did Trezor issue the warning?

The warning went out on October 30, 2026. The disclosure behind it reached Trezor on October 28, from a buyer in Indonesia.

Which CryptoBilis purchases are covered by the warning?

Wallets bought from CryptoBilis from March 2026 onward. The buyer who raised the alarm picked up a Safe 5 through Tokopedia in August 2026.

What did Trezor find when it inspected other CryptoBilis devices?

Four units — a Safe 7, two Safe 5s and a Safe 3 — came apart clean, with no tampering. The Safe 5 from the Indonesian report is a separate case.

What replacement support is Trezor offering affected buyers?

Keep the device if you like, and contact Trezor Support. Trezor said it will ship a replacement directly or hand over a voucher for a new device.

What information could the reported implant capture?

By the customer’s account, the component could read the Safe 5 screen, wallet backup included, then send it over a cellular network while the wallet was connected to power.

Do security seals guarantee a safe device?

No, Trezor concedes that standard packaging and seals alone cannot prove a device was untouched on its way to a buyer.

Has anyone lost funds from this issue?

Trezor stated that no CryptoBilis buyer has reported a loss of funds to the company.

This article is for information only and is not financial advice.