Trezor has told customers who purchased its hardware wallets through former authorized reseller CryptoBilis since March to move their cryptocurrency after a report of a suspected hardware implant in a Trezor Safe 5 device.
The warning followed a report from a customer in Indonesia, who said an unauthorized circuit board was found inside a Safe 5 bought on Tokopedia in August. Trezor said the suspected component may be capable of capturing information shown on the wallet’s screen, including a recovery phrase, and sending that information over a cellular network.
According to Cointelegraph, Trezor has not yet received the device for laboratory examination and said it had no reports of related financial losses. The company is nevertheless treating the report as credible and advised affected customers to transfer their funds.
“We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor chief commercial officer Danny Sanders told Cointelegraph.
Why a suspected implant matters
A hardware wallet is designed to keep cryptocurrency credentials isolated from other devices. Its recovery phrase is a set of words that can restore access to a wallet, including on another device. If an attacker obtains that phrase, they may be able to recreate the wallet and move the assets held in it.
Trezor said its existing protections, including seals and packaging, cannot by themselves provide sufficient assurance against tampering. The company has not determined where the suspected modification took place and said it is reviewing its hardware safeguards.
A spokesperson described the number of sales through CryptoBilis as “very small” but did not disclose a figure. Trezor also announced on Oct. 13 that it planned to reduce its reseller network.
Wider concerns involving CryptoBilis
The alert comes after reports of cryptocurrency losses involving Ledger wallets sold through CryptoBilis emerged on Oct. 9. Ledger confirmed that one affected device contained an unauthorized hardware implant.
Security researcher Joe Grand had previously told Cointelegraph that he warned Trezor in August about tampered Trezor One and Model T wallets purchased through unauthorized sellers on TikTok and Facebook. Trezor said an earlier statement that it had found no evidence of compromised devices applied only to new wallets sold by authorized resellers.
The company also said its setup checks were aimed at counterfeit devices and altered firmware. The suspected implant in the CryptoBilis-sold Ledger device reportedly read information from the screen without modifying the firmware, illustrating why software-focused checks may not identify every form of physical tampering.
Moneyiar market picture
Moneyiar data at the stated times showed mixed performance among the listed cryptoassets:
- AI Rig Complex (ARC) was $0.0594624188, down 3.6% over 24 hours but up 46.65% over seven days, as of Oct. 25, 2026, at 22:39 +03:30.
- FUNToken (FUN) was $0.0089182414, up 1.62% over 24 hours and 0.08% over seven days, as of Oct. 25, 2026, at 22:39 +03:30.
- Movement (MOVE) was $0.0070930391, down 0.02% over 24 hours and 5.33% over seven days, as of Oct. 24, 2026, at 23:38 +03:30.
- Renzo (REZ) was $0.0047192587, up 11.52% over 24 hours and 43.03% over seven days, as of Oct. 25, 2026, at 22:38 +03:30.
