Trezor Warns CryptoBilis Buyers Over Safe 5 Implant Report

Trezor CryptoBilis implant concerns are now driving an early buyer warning. The company says a Safe 5 report looks credible enough to act on. It is telling March 2026-onward buyers to move funds to a new seed before its lab has the device in hand.

Hardware wallet maker Trezor spoke on October 30, 2026. Its security team got a report on October 28. The report claims a hardware implant sat inside a Trezor Safe 5. The buyer got that unit from reseller CryptoBilis in August 2026 through Tokopedia. The company has not checked the unit yet. It still trusts the customer’s account and a video interview. So it is warning CryptoBilis buyers now, not after lab proof. No CryptoBilis buyer has told Trezor about a loss of funds.

What the Trezor CryptoBilis Implant Report Claims

Trezor’s disclosure lays out what the report says. An extra circuit board sat between the Safe 5’s main board and its screen. That board holds a cellular module and an antenna. The alleged implant reads what the screen shows, including the wallet backup. It then sends that data over a mobile network when the device is plugged in. Trezor said the setup looks like implants found in Ledger devices from the same reseller. But it will not lock in that link while probes continue.

A Trezor customer in Indonesia filed the report through the firm’s responsible disclosure program. That customer had already moved funds off the device before finding the implant. Trezor thanked the reporter and SEAL 911. SEAL 911 is the Security Alliance’s emergency response service. Both helped on the case and on support for affected buyers.

Why CryptoBilis Buyers Are in Scope

CryptoBilis was an official Trezor reseller in Southeast Asia until October 2026. On October 9, Ledger began probing fund losses among buyers from that reseller. Ledger later said some devices had been physically altered. CryptoBilis also sold Trezors. So Trezor cut the reseller the same day and began reviewing customer devices.

The October 28 report is the first Trezor says it has of a possible implant in one of its own units from that channel. The firm says the guidance covers every Trezor model bought from CryptoBilis. It is not limited to the Safe 5 named in the report. It has no reports that involve any other reseller.

That is the strange part of this crypto hacks story. The fortress story around a sealed hardware wallet still hinges on who handled the box before it reached the buyer.

What Trezor Told Affected Buyers to Do

Anyone who bought a Trezor from CryptoBilis from March 2026 onward should act if funds sit on that device. Move those funds to a newly created wallet with a new seed as soon as possible. Restoring the old backup on another device does not fix the risk. The seed may already have been exposed on a tampered unit. Buyers without a second secure hardware wallet can park funds for a short time on a software wallet or an exchange they already trust. They should check the full receiving address before they send.

Do not set up unopened devices from that channel. Never enter existing wallet backups on them. Trezor Support will never ask for a recovery phrase. The company also warned that scammers will use the news for phishing. Fake emails, letters, and phone calls are already a risk.

Affected CryptoBilis buyers can still get a new Trezor shipped direct, or a voucher for a replacement. They must keep the CryptoBilis device and contact Support.

Why did it matter? One credible implant report, even before lab proof, was enough for Trezor to treat the March 2026-onward CryptoBilis path as unsafe for seed generation. Self-custody still ends at physical trust in the device that first shows the words.