Trezor warns of suspected crypto-theft implant in Safe 5 wallet

Trezor says it has received credible reports of a suspected hardware implant in a Trezor Safe 5 sold by Southeast Asian reseller CryptoBilis. The company has not yet examined the device and has not confirmed that it contains a malicious implant.

The report came from an Indonesian customer who said they bought the wallet through Tokopedia in August 2026. After opening it, they found an additional circuit board between the main board and the screen, with a cellular module and antenna. Based on information from the customer that remains unconfirmed, the implant may be able to read information on the screen, including a recovery phrase, and transmit it over a mobile network when the device is plugged in.

Trezor says it has no information that a supply-chain attack involving its devices has led to stolen funds. The device is being shipped to the company, which says it will provide updates after examining it. Trezor stopped sales through CryptoBilis on October 9, 2026, after a separate Ledger incident involving the reseller. Ledger later confirmed a compromise and asked sellers and distributors in Southeast Asia and Hong Kong to halt sales during its investigation.

Trezor recommends that customers not set up or use devices bought through CryptoBilis from March 2026 onward. Customers who already used one should move their funds to a newly created wallet with a new recovery phrase. Those with proof of purchase may contact Trezor about a replacement or voucher. The company also says weighing a device is not a reliable way to check for tampering.