Trezor has urged customers who bought its hardware wallets through Indonesian reseller CryptoBilis to move their cryptocurrency to newly created wallets after a buyer reported finding a hidden circuit board inside a Trezor Safe 5 device.
The company said on Friday that it received the report through its responsible disclosure program on October 28. The device was purchased in August 2026 through Tokopedia, an Indonesian e-commerce platform. Trezor said it has not yet received the device for laboratory examination, but considers the report credible based on the buyer’s description and a video interview.
The suspected implant is reportedly fitted between the wallet’s main circuit board and its screen. The additional board allegedly includes a cellular communications module and an antenna. According to the report, it can read information displayed on the screen—including the wallet backup or recovery phrase—and transmit that information over a mobile network when the device is connected.
A recovery phrase is the set of words used to restore access to a cryptocurrency wallet. Anyone who obtains it may be able to control the assets secured by that wallet, which is why Trezor’s warning focuses on creating an entirely new wallet rather than simply continuing to use the existing device.
What Trezor is telling customers
Trezor advised anyone who bought one of its wallets from CryptoBilis from March 2026 onward to transfer their funds to a new wallet with a new recovery phrase as soon as possible. The company said customers should not reuse the old phrase on another device.
Customers who bought a device but have not yet configured it should not use it, Trezor said. Affected buyers can retain the CryptoBilis device and contact Trezor Support about a replacement.
The company said no CryptoBilis customer has reported losing funds to Trezor in connection with the suspected implant. That statement does not establish whether any device was compromised beyond the single report, because Trezor has not yet inspected the hardware itself.
“What we’ve seen looks sophisticated enough that we decided to warn customers now,” Trezor said. The company added that waiting for laboratory confirmation could leave CryptoBilis buyers exposed while the examination was pending.
According to Decrypt, the customer’s report describes a device capable of capturing the wallet backup while it appears on the screen. Trezor said the suspected mechanism appears similar to one identified in a separate investigation involving Ledger devices, although it cautioned that the investigations remain in progress and that it does not know who is responsible.
Link to the wider CryptoBilis investigation
Trezor removed CryptoBilis from its reseller network on October 9. The move followed an investigation by Ledger’s Donjon security team into losses involving Ledger devices purchased through the Southeast Asian reseller.
Trezor said it has inspected four devices bought from CryptoBilis—a Safe 7, two Safe 5s and a Safe 3—and found no evidence of tampering in those units. The newly reported Safe 5 is separate from those inspections and has not yet been delivered to the company.
Ledger previously said its investigators found an implant in devices sold through CryptoBilis. That implant reportedly read the 24-word recovery phrase displayed during setup and sent it over LTE, a mobile communications standard. Ledger asked resellers in seven Asian markets to remove its devices from sale.
Ledger has said all confirmed losses it has identified involved devices bought from CryptoBilis. Chainalysis, a blockchain analytics firm, reported that one of the largest victims was a scammer who lost more than 60 bitcoin, valued at about $4.8 million at the time cited in the source material.
The episode highlights the security risk in the supply chain around hardware wallets. These devices are designed to keep private wallet credentials isolated from internet-connected systems, but a physical modification made before a customer receives the product could undermine that protection. In this case, Trezor’s warning is based on a customer report rather than a completed company examination.
Trezor has faced other warnings involving outside partners. In August, it said a breach at shipping provider ShipMonk exposed the names, phone numbers and home addresses of nearly 14,000 U.S. customers. The company said the number later increased by another 67,000 in September.
Moneyiar market picture
Moneyiar market data recorded on October 25, 2026, showed the following prices and performance:
- Safe (SAFE): $0.1029229466, down 1.85% over 24 hours and up 1.99% over seven days, as of 22:39 +03:30.
- Walrus (WAL): $0.0343190471, down 0.30% over 24 hours and down 11.97% over seven days, as of 22:38 +03:30.
- FUNToken (FUN): $0.0089182414, up 1.62% over 24 hours and up 0.08% over seven days, as of 22:39 +03:30.
- RedStone (RED): $0.1452603192, down 2.72% over 24 hours and up 6.36% over seven days, as of 22:39 +03:30.
These figures are Moneyiar market data and are separate from the reported hardware-security incident.
