Trezor warns CryptoBilis customers after reported Safe 5 hardware implant

Trezor has warned customers who bought devices from CryptoBilis from March 2026 onward after receiving a credible report of an additional circuit fitted inside one Trezor Safe 5. The device has not yet reached Trezor's lab, but affected buyers are being advised to move funds to a newly created wallet with a new seed.

What happened

On October 30, 2026, Trezor disclosed a responsible report from an Indonesian customer concerning a Safe 5 bought through CryptoBilis on Tokopedia in August. The customer described an additional board inside the device.

Trezor has not yet received the unit. It says the description, photographs and a video interview were credible enough to justify an immediate precautionary notice while laboratory verification is arranged. That distinction matters: this is a serious report, not a completed forensic finding.

Timeline

The alert follows the investigation into altered Ledger devices linked to CryptoBilis. Because CryptoBilis also sold Trezor products, Trezor removed the company from its authorised reseller list on October 9 and began inspecting customer returns.

Four returned Trezor devices showed no evidence of tampering. A separate Safe 5 report received on October 28 prompted Trezor to issue guidance covering every Trezor model supplied by CryptoBilis from March 2026 onward.

How the reported implant works

The reporter described an extra board positioned between the main board and display, together with a cellular module and antenna. According to the report, it can read information shown on the screen, including the wallet backup, and transmit it over a mobile network when the device is powered.

The scenario also illustrates why a clean firmware check is not a complete physical inspection. An added component that intercepts data between internal parts may not need to replace the signed firmware.

Who should act

Trezor's guidance covers every model bought from CryptoBilis from March 2026 onward, including purchases made through marketplaces that were supplied by CryptoBilis. Buyers should check the seller name and receipt rather than relying on packaging alone.

What affected buyers should do

If the device is already in use

1. Create a completely new wallet on trusted hardware and generate a new seed.
2. Verify the full receiving address on the trusted device and send a small test amount.
3. Move the remaining assets only after the test is confirmed.
4. Check every account, network and passphrase wallet connected to the old seed.
5. Keep the CryptoBilis device and contact Trezor Support about the replacement or voucher process.

Do not simply restore the old seed on a new device. If the seed was exposed, changing hardware without changing the seed leaves the wallet at risk.

If it has not been set up

Do not initialise it and never enter an existing wallet backup. Retain the device and proof of purchase, then contact Trezor Support.

If trusted hardware is not immediately available

Trezor says a familiar software wallet or exchange can be used temporarily. Verify the entire destination address and move to the preferred long-term setup once trusted hardware is available.

What this means for SIAMBC customers

Trezor's notice concerns devices supplied by CryptoBilis and says there are no reports involving other resellers. The notice does not identify SIAMBC as affected.

SIAMBC customers who want to verify a model, order number or source can contact the team with proof of purchase. Staff will never require a recovery phrase, PIN, passphrase or private key.

The supply-chain lesson

A genuine product can still be exposed to risk if it is opened and altered after leaving the manufacturer. Hardware-wallet security therefore includes the seller, storage, delivery, returned-goods policy and chain of custody, not only the secure element and firmware.

• Buy from the manufacturer or a seller whose supply route can be checked.
• Keep the receipt and inspect packaging for inconsistencies before setup.
• Use official software and install firmware through the manufacturer's process.
• Generate the seed on the device yourself; never accept a pre-written backup.
• Avoid used devices and products with an unclear ownership history.

Trezor advises against opening or weighing a device. Small weight differences are not conclusive, and disassembly can damage the unit without producing a reliable answer.

FAQ

Has anyone reported losing funds?

As of October 30, Trezor says no CryptoBilis customer has reported a loss. The reporter moved funds before identifying the suspected implant.

Does this affect every Trezor Safe 5?

No. The report concerns one Safe 5 bought from CryptoBilis. Trezor's precautionary guidance is broader and covers every model bought from that seller since March 2026.

Can a factory seal or device-authentication check rule out every implant?

No single check proves the absence of every physical modification. Authentication and packaging checks remain useful, but purchase provenance is still important.

What if the device is unopened?

Do not set it up or restore an existing seed on it. Keep the device and receipt and contact Trezor Support.

Will support ask for the recovery phrase?

No legitimate manufacturer or retailer needs the recovery phrase, PIN, passphrase or private key. Expect phishing emails, letters, calls and impersonation attempts around this incident.

Sources

• Trezor: Implant reported in a Trezor sold by CryptoBilis
• Trezor statement on X
• Ledger response to the CryptoBilis incident
• Trezor device authentication

This article reflects information available on October 30, 2026. Details may change after Trezor receives the device and publishes its laboratory findings.