Trezor Urges CryptoBilis Buyers to Replace Wallets
Trezor has told customers who purchased any of its hardware wallet models from CryptoBilis since March 2026 to move their funds into a newly created wallet with a new recovery phrase. The precaution follows a report alleging that a Trezor Safe 5 sold through the reseller contained an extra internal circuit board capable of reading information displayed on the device screen.
The reported implant has not been independently confirmed through laboratory examination. Trezor said it has not yet received the device, but it is treating the report as credible after reviewing photographs and conducting a video interview with the customer, according to Cointelegraph.
What happened
As of October 30, 2026, Trezor said its security team had received a responsible disclosure two days earlier concerning one Trezor Safe 5 bought from CryptoBilis in August 2026 via Tokopedia. Trezor said CryptoBilis had been an official reseller in Southeast Asia until October 2026.
The report describes an additional circuit board installed between the Safe 5’s main board and screen. Trezor said the alleged implant appeared similar to devices previously seen in Ledger products. The Hacker News reported that the suspected board included a cellular module and antenna, and could read the screen, including a recovery phrase, before transmitting that information over a mobile network while the wallet was plugged in.
Trezor’s warning is broader than the individual report. Customers who bought any Trezor model through CryptoBilis from March 2026 onward have been advised to transfer assets to a newly created wallet using a new recovery phrase, rather than reuse their existing phrase. The Hacker News reported that Trezor is offering either a replacement device or a voucher covering the cost of one.
For customers without another secure hardware wallet, Trezor said they could temporarily migrate funds to a software wallet or an exchange they know and trust. It also urged users to carefully verify the full receiving address before making a transfer.
No CryptoBilis buyer had reported a loss of funds to Trezor at the time of the notice. Decrypt reported that the customer who disclosed the suspected implant had already moved funds before finding the additional board. Trezor also said it cannot view customers’ wallet balances because of the nature of self-custody, according to Defiprime.
Why it matters
Hardware wallets are intended to protect crypto assets by keeping a wallet’s recovery phrase offline. A concealed component that can capture screen contents and transmit a recovery phrase through cellular radio could undermine that model, because an attacker with the phrase could restore the wallet elsewhere and take control of its funds.
The issue is therefore not limited to whether a device can be opened or physically altered. It concerns the integrity of the route between a manufacturer, an authorized reseller and an end customer. Even when a buyer receives a device presented as an official product, a hidden internal modification could potentially bypass the protections that users expect from self-custody hardware.
Trezor’s decision to issue a broad warning before physically examining the reported Safe 5 reflects that risk. Cointelegraph reported that the company said it preferred to warn customers rather than wait for final confirmation. At the same time, the company has identified only one reported suspected device, and the alleged implant remains unconfirmed pending examination.
Background and context
The warning extends a supply-chain tampering concern beyond Ledger devices. The background to Trezor’s notice includes a previously confirmed implant in a CryptoBilis-sold Ledger device, raising questions about the controls surrounding reseller distribution, device handling and packaging seals.
As of October 9, 2026, Trezor had removed CryptoBilis as an authorized reseller in Southeast Asia after Ledger began investigating losses among Ledger customers who bought products from the reseller, according to The Block. The Block also reported that Trezor had examined four customer devices sent in after that point and found no signs of tampering in those units.
That detail underscores the limits of the available information. Four inspected devices without evidence of alteration do not resolve the report involving the Safe 5, while a single report does not establish that all CryptoBilis-sold Trezor products were affected. Trezor’s instruction applies across models and purchases from March 2026 because the company is addressing potential exposure rather than claiming that every device was modified.
What to watch
The central open question is what a physical examination of the reported Safe 5 will establish. Trezor has said it has not yet received the device, so it has not verified the alleged board’s construction, capabilities or origin.
It will also be important to clarify whether the suspected modification was isolated or connected to a wider distribution issue. Trezor’s warning covers all of its models sold by CryptoBilis from March 2026, but the report concerns one Safe 5 purchased in August 2026.
Further disclosures could also address how the extra board may have been installed, whether other devices show similar characteristics, and whether any affected customers later report unauthorized wallet activity. For now, Trezor says there is no evidence of customer losses connected to its products in this case.
