Suspected implant in a Trezor Safe 5 sold by CryptoBilis

On 28 October 2026 Trezor received a report from a buyer in Indonesia of an extra circuit board inside a Trezor Safe 5 bought in August 2026 from CryptoBilis, the same Southeast Asian reseller whose Ledger devices carried hardware implants. According to the report, the board sits between the main board and the screen, reads what the screen shows, including the recovery phrase, and sends it out over a mobile network.

At the time of its statement on 30 October, Trezor had not yet examined the device; it called the report credible and is having the unit sent to its lab. Trezor says it has no reports involving any other reseller and no evidence that any customer has lost funds; the person who reported the implant had already moved their funds. Trezor removed CryptoBilis from its authorized resellers on 9 October 2026.

Trezor’s advice for every Trezor bought from CryptoBilis from March 2026 onwards:

• If the device is not set up yet, do not set it up and never enter an existing recovery phrase on it.
• If you already use it, move your funds as soon as possible to a new wallet with a newly generated recovery phrase. Restoring the old phrase on another device does not help.
• Keep the device and contact Trezor Support for a new device or a voucher. Do not open it; Trezor says weighing it is not a reliable test.