Trezor has told every customer who bought one of its hardware wallets from former reseller CryptoBilis from March 2026 onward to move funds to a newly created wallet with a new recovery phrase. The warning follows a responsible disclosure concerning one Safe 5 bought in Indonesia through Tokopedia in August.
The customer reported an extra circuit board between the device’s main board and screen, equipped with a cellular module and antenna. The reported implant could read information shown during setup, including the wallet backup, and transmit it over a mobile network when powered.
Trezor has not physically examined the device and has not confirmed the implant in its laboratory. It reviewed photographs, interviewed the customer and judged the report credible enough to issue a precautionary warning. No CryptoBilis buyer has reported a related loss to Trezor. Decrypt
The company removed CryptoBilis from its authorized network on 9 October after tampered Ledger devices were linked to the same reseller. Trezor says four CryptoBilis-supplied devices it already inspected showed no tampering. The newly reported Safe 5 is a separate unit still being shipped for examination.
Moving the same recovery phrase to another device does not remove the risk because the phrase may already have been captured. Trezor advises affected users to create a completely new wallet and transfer assets, and it is offering a replacement device or voucher. Buyers who have not initialized a device should not use it or enter an existing backup.
TOKEN RECON ASSESSMENT
The confirmed fact is a manufacturer warning across an identifiable reseller and time window, not a verified fleet-wide compromise. The alleged implant bypasses the usual focus on firmware by observing the screen itself. Laboratory confirmation, the number of devices CryptoBilis distributed and any linked onchain losses will determine whether this remains a single credible report or becomes a broader supply-chain incident.
Sources
Trezor device authenticity guidance
Decrypt, Trezor warning and reported implant details
