Trezor Warns CryptoBilis Buyers to Move Funds After Safe 5 Implant Report

Published October 31, 2026, 03:07 AM PKT. Based on Trezor's October 30, 2026 blog post "Implant reported in a Trezor sold by CryptoBilis", The Hacker News' October 30, 2026 report, Cyber Insider's October 30, 2026 report, CoinMarketCap Academy's October 30, 2026 report, and background from MABOnChain's earlier CryptoBilis coverage, including the October 2026 articles on Ledger's confirmed hardware implant and on Trezor cutting resellers in the same scandal. This is a new Trezor-specific development in the CryptoBilis supply chain saga, not a repeat of the Ledger findings: the Ledger implants were confirmed earlier in October, while the Trezor device at the centre of this warning has not yet been examined in a laboratory.

Trezor warned on October 30, 2026 that anyone who bought a Trezor hardware wallet from CryptoBilis from March 2026 onward should move their funds to a newly created wallet with a new seed as soon as possible. The warning followed a responsible-disclosure report of a suspected hardware implant in a single Trezor Safe 5, the company's touchscreen hardware wallet, bought from CryptoBilis in August 2026 through the Indonesian marketplace Tokopedia. Trezor said it has not yet received the device to confirm the report, but based on the customer's description and a video interview, it is treating the report as credible and sharing it now so affected buyers can secure their funds as a precaution. No CryptoBilis buyer has reported a loss of funds to Trezor, the company said, and the reporting customer had already moved his funds off the device before finding the suspected implant. The warning covers every Trezor model supplied by CryptoBilis from March 2026 onward, not only the Safe 5, and it covers purchases through any store selling devices CryptoBilis supplied, including its store on Tokopedia.

One Safe 5, bought in August on Tokopedia

The report reached Trezor's security team on October 28, 2026, two days before the public warning, from a customer in Indonesia. According to Trezor's blog post, the customer bought the Safe 5 from CryptoBilis in August 2026 through Tokopedia, and later reported finding additional electronics inside it. The report describes an extra circuit board fitted between the wallet's main board and its screen, with a cellular module and an antenna. According to the report, which Trezor said it has not verified itself, the added board reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in. That mechanism, if confirmed, would be dangerous precisely because the wallet backup, also called the recovery phrase, is the secret that controls the funds: anyone holding it can recreate the wallet and move the coins. Trezor said it has the customer's photos and description, interviewed him by video call, and is arranging for the device to be sent to its laboratory for examination. The company also said the board reported in its Safe 5 appears to work like the implants seen in Ledger devices, while declining to compare the two cases directly while investigations continue, because each manufacturer builds its devices differently, and it does not know who is responsible.

Move funds to a new wallet with a new seed

Trezor's instructions for affected buyers are specific, and one detail matters more than the rest: a new wallet is not enough on its own, the seed must be new too. "If you bought a Trezor from CryptoBilis from March 2026 onwards and are using it to store funds, please move your funds to a newly created wallet with a new seed as soon as possible," Trezor's notice said. Restoring the old wallet backup on another hardware or software wallet does not solve the problem, Trezor said, because a tampered wallet could already have sent that backup out. For buyers with no other secure hardware wallet available, Trezor recommends moving funds temporarily to a software wallet or an exchange they are familiar with, and checking the full receiving address carefully before sending. For buyers who bought a CryptoBilis device but have not set it up yet, Trezor said not to set it up, and never to enter an existing wallet backup into it. Affected buyers should keep the CryptoBilis device and contact Trezor Support, the company said, and they are eligible for a new Trezor device shipped directly by Trezor or a voucher covering the cost of one. Buyers unsure where their device came from should check the seller name on their receipt or contact Support. Trezor also warned owners not to try checking a device themselves: weighing it or opening it is not a dependable test, since the reporting customer noticed a weight difference but small differences can have other causes. As of October 30, Trezor said it had no reports involving any other reseller.

No losses reported, and why Trezor warned early

The most important limit on this story is that the implant itself is still unconfirmed. Trezor has not examined the device, has no laboratory finding, and has no evidence that any customer has lost funds. Its wallets are self-custodial, so the company cannot see what customers hold, and it said it will update its notice if the loss picture changes. The decision to warn before confirmation was deliberate. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," Trezor said, according to The Hacker News. Danny Sanders, Trezor's chief commercial officer, put it in similar terms, saying the company had not had the device in its lab yet but was treating the report as credible. "We'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime," Sanders said, according to CoinScreamer's report of his statement. "If you bought a Trezor from CryptoBilis since March, move your funds to a new wallet and contact our Support team, and we'll send you a new device." That reasoning also explains the broad March 2026 cutoff: it is a precautionary scope for customer action, not proof that every device sold since then was altered. Only one suspected device has been reported, and Trezor said four other CryptoBilis-supplied Trezor devices it had received for inspection showed no signs of tampering. Readers should therefore treat the warning as a protective action for a defined group of buyers, not as a finding that all CryptoBilis-sold Trezor devices are compromised, and not as a warning to all Trezor owners everywhere.

The CryptoBilis saga, from Ledger implants to Trezor

This warning is the latest chapter in a supply chain scandal that began with Ledger, not Trezor. On October 9, 2026, Ledger began investigating fund losses among customers who had bought hardware wallets from CryptoBilis, its authorized reseller in Southeast Asia, and later confirmed that some of those devices had been physically tampered with in a sophisticated supply chain attack, MABOnChain reported at the time. CryptoBilis was also an authorized Trezor reseller at the time, so Trezor removed it on October 9, 2026, the same day, and has been investigating customer devices since then, Trezor said. Trezor also said it took further precautions by limiting its authorized sellers going forward. The scandal has since spread beyond the two manufacturers: on October 28, 2026, the Singapore Police Force said in an advisory that Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components, with at least two cases reported since September 10, and that the components could capture users' recovery phrases or private keys. Trezor thanked the customer who reported the Safe 5 through its responsible disclosure program, and thanked SEAL 911, the Security Alliance's emergency response service, for working alongside its teams on the report and on customer support planning. The company also warned that criminals will likely exploit the incident for phishing, through fake emails, physical letters and phone calls, and reminded buyers never to share a wallet backup with anyone, since Trezor Support will never ask for it. The next hard fact to watch is the laboratory examination of the reported Safe 5: confirmation would turn a credible report into a proven second implant case in the CryptoBilis saga, while a clean finding would narrow the scare back to a single false alarm, and either way the March 2026 buyer group has already been told to move first and wait second.

This article is news reporting and is not investment advice.

Sources

• Trezor, Implant reported in a Trezor sold by CryptoBilis (published October 30, 2026, primary source for the warning, the March 2026 scope, the new seed instruction, the replacement or voucher offer, the October 28 disclosure, the Tokopedia purchase, the implant description, the no losses statement, the October 9 reseller removal, and the phishing warning)
• The Hacker News, Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis (published October 30, 2026, secondary source for the video interview, the device shipment to the laboratory, the every model scope, the do not weigh or open guidance, and the Singapore police advisory)
• Cyber Insider, Trezor warns users to move funds after suspected spy implant report (published October 30, 2026, secondary source for the October 30 warning timing, the cellular module and antenna detail, and the four inspected devices showing no tampering)
• CoinMarketCap Academy, Trezor Tells CryptoBilis Buyers to Move Funds After Safe 5 Implant Report (published October 30, 2026, secondary source for the October 28 disclosure date, the August Tokopedia purchase, and the no funds reported stolen statement)
• CoinScreamer, Trezor Warns CryptoBilis Buyers After Safe 5 Implant Report (published October 30, 2026, secondary source for chief commercial officer Danny Sanders' statement on warning before laboratory confirmation)
• MABOnChain, Ledger Confirms Tampered Hardware Implant in CryptoBilis Wallet Drain Probe (October 2026, background for Ledger's confirmed implant finding in the same reseller scandal)