Trezor warns buyers after suspected hardware implant
The hardware wallet maker warned users who bought Safe 5s from CryptoBilis, a Southeast Asian reseller, that a cellular implant could steal recovery phrases.
31 Oct 2026 0 reads Compiled with AI
Trezor said it received a credible report that a Safe 5 wallet bought from CryptoBilis, a Southeast Asian reseller, may contain a hardware implant. The customer bought the device through Tokopedia in August 2026, opened it and found an extra circuit board between the main board and the screen. The board has a small cellular module and antenna. The customer says it can read what appears on the screen and send that data over a mobile network when the device is plugged in. Trezor has not yet examined the unit, but it treats the report as credible, citing the customer's photographs and a video interview. The warning follows a similar case with Ledger devices sold through the same reseller, where an implant read recovery phrases from the display and sent them over LTE.
Details of the suspected implant
The suspected implant could intercept screen data, including the wallet recovery phrase shown during setup. Unlike software attacks such as OkoBot, which trick users into entering phrases through fraudulent prompts, this implant works inside the hardware itself. Trezor said the board appears similar to the Ledger implant, but it has not verified the device in a lab and says it won't draw comparisons while investigations continue. Four other devices examined from CryptoBilis buyers showed no modifications. No CryptoBilis buyer has reported a loss of funds to Trezor.
Trezor stopped selling through CryptoBilis on October 9, before it had any sign it was affected, and later removed the reseller from its network. The company says it will restructure and tighten its reseller network globally. It urges anyone who bought a Trezor wallet from CryptoBilis since March 2026 to move their funds to a newly created wallet with a new recovery phrase, and not to reuse the old phrase on any device. Buyers who have not set up their device should leave it unused. Affected customers can keep the device for investigation and contact Trezor Support for a replacement or voucher. Trezor says it will post updates once it receives and examines the device, which is being shipped to it.