Trezor Warns CryptoBilis Buyers After Suspected Safe 5 Hardware Implant Report

An extra circuit board, slipped in between a wallet's screen and its main board, could read your recovery phrase and beam it out over a mobile network. That is the scary report behind Trezor's warning on Friday, and it covers anyone who bought a Trezor from one reseller, CryptoBilis, since March 2026.

Key points:

• Trezor says a customer reported a suspected implant in a Safe 5 bought through CryptoBilis on Tokopedia in August 2026.
• The firm has not yet held the device in its own lab, but it calls the report believable and told buyers to move their coins now, not later.
• Only CryptoBilis buyers since March 2026 are covered here. This is not a warning for every Trezor owner.

On Friday, Trezor said its security team got the report on October 28. The customer, in Indonesia, found the extra board inside a Safe 5 and spoke to the team over a video call, with photos to back it up. My own read is plain: when the firm that made your wallet tells you to move your coins, you do not wait for a lab report to agree. Trezor's chief commercial officer, Danny Sanders, put it the same way, saying the firm would rather warn people now than wait for proof and learn someone lost funds in the meantime.

What the customer described is simple to picture and hard to ignore. The added board sits between the main board and the screen, and it carries a mobile module and an antenna. It can read whatever shows on the screen, including the recovery phrase, and send it out over a mobile network while the wallet has power. Trezor's advice is short. Move your coins to a fresh wallet with a brand-new recovery phrase, never type your old phrase into a suspect device, and get in touch with support about a replacement. So far, Trezor says no CryptoBilis buyer has told it about losing funds over this implant, and four other CryptoBilis devices it checked showed no signs of tampering.

Read also: Ledger Tampered Wallets Cost Singapore Users $2.7M — Police Issue Warning

Why is one reseller at the center of this?

CryptoBilis is not a new name in this kind of trouble. Trezor dropped it from its approved reseller list on October 9, after reports of tampered Ledger devices sold through the same firm. Ledger later confirmed physical tampering in some of its devices from CryptoBilis, and Singapore users lost $2.7 million in that case. OneKey, another wallet maker, has also cut ties with the reseller. That history is why this new report lands so hard: the same sales channel, the same trick of opening up a sealed wallet and adding parts, and this time a device that can talk to a mobile network on its own.

Here is the part to hold on to. A suspected implant is not a proven one. Trezor has not yet examined this Safe 5, so the claim still rests on one customer's photos and calls, and the four clean devices show not every CryptoBilis wallet is tainted. But the risk runs one way only: if the report is right and you sit still, your seed phrase could already be gone. If you bought any Trezor from CryptoBilis since March 2026, do not plug that wallet in and hope for the best. Move the coins first, then ask questions.

Read also: Bitcoin Core AI Bug Can Crash Windows and Mac Nodes — Are You Updated?

— BitByLine News Desk

One plain note before you go: this is news only, not financial advice. BitByLine never tells you to buy or sell anything. That choice is yours alone, and the risk is yours too, so do your own research first.

Read our full Disclaimer.

Sources: The Block, TokenPost