Trezor warns customers who bought devices through CryptoBilis since March after report of suspected implant
Key Facts
Trezor urged anyone who bought one of its devices through CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase as soon as possible, after receiving a report of a suspected implant in one Safe 5. The company said a customer in Indonesia bought the device through the Tokopedia platform in August 2026, and that the report came through its responsible disclosure channel. Trezor has not confirmed the implant, as it has not yet received the device, but said it considers the customer's account credible. Its precautionary guidance covers buyers of any of its device models through the distributor since March, not only the Safe 5 cited in the report. The company said its security team will examine the device as soon as it arrives.
According to the customer's account relayed by Trezor, the alleged implant consists of an additional circuit board containing a cellular module and antenna, installed between the device's main board and its screen. The report says the board can read what appears on the screen, including the wallet's recovery phrase, then send the information over a mobile network when the device is connected. These details remain part of an account the company has not verified by examining the device, so Trezor has not said the device was tampered with. The recovery phrase matters because it provides access to the wallet; for that reason, the company tied its guidance to moving funds to a new wallet and creating a different phrase. It stressed that the old phrase should not be reused in any wallet, whether hardware or software.
Trezor said no CryptoBilis buyer had reported losing funds as of its latest update. It added that it examined four devices returned by customers who bought them through the distributor and found no signs of tampering in any of them. Those examinations do not resolve the report concerning the device that has not reached the company, which said its security team will inspect it upon receipt. The device's arrival and the examination results are the next developments in the investigation the company announced. Trezor did not give a specific date for its arrival or the release of the examination results.
Trezor removed CryptoBilis from its list of distributors on 9 October 2026, following reports that modified Ledger devices were being sold through the distributor. In Ledger's case, the company confirmed an implant in one of its devices sold through CryptoBilis and said it captures the 24-word recovery phrase during device setup and sends it over LTE using an eSIM. Later reports cited loss estimates exceeding $86 million, but Ledger said the total losses and number of people affected had not been verified. MediaMarkt Saturn also halted sales of Ledger devices in its stores and online on 13 October, after a customer in Germany reported an implant; no loss of funds was recorded in that case. The group said it had withdrawn the affected products from its stores and online platforms and was in contact with the manufacturer.
On the distributor front, Ledger asked CryptoBilis to halt sales and shipments while its cybersecurity team examines recovered devices. OneKey announced it had revoked the distributor's authorization and was reviewing its distributor network, and offered free replacements for its devices bought through CryptoBilis between 1 March and 13 October 2026, regardless of model or activation status. Trezor had said in an earlier report that it had no reports of modified devices from CryptoBilis and no indication its products were affected, before the current report came in. It also announced a plan to end the authorization of distributors notified of the decision as of 1 January 2027, stop supplying them with new inventory and allow them to sell their remaining stock until that date. In the current report, the company says examination of the device will begin as soon as it reaches its security team.