Trezor Warns of Suspected Crypto-Theft Implant in Wallet
Hardware wallet manufacturer Trezor has issued a warning after receiving credible reports of a suspected crypto-theft hardware implant inside a Trezor Safe 5 device sold by its Southeast Asian reseller, CryptoBilis.
Radwan AbdulhadiEditor and technology writer
Suspected Implant Discovered in Southeast Asia
Hardware wallet manufacturer Trezor has received credible reports regarding a suspected hardware crypto-theft implant located inside a Trezor Safe 5 device. The unit in question was sold by the company's regional reseller, CryptoBilis, in Southeast Asia.
Although the company has not yet received the physical device to thoroughly examine it and confirm the presence of a malicious implant, it has proactively [warned potentially affected users](http://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis) to immediately move their private keys and digital assets to known safe wallets.
Details of the Reported Hardware Modification
Trezor physical devices are designed to securely store cryptocurrency private keys and authorize transactions. The Safe 5 represents one of the brand's latest models and is regularly available for purchase directly from the official store.
According to Trezor, security concerns emerged after receiving a direct report from an Indonesian customer who purchased a Safe 5 device via Tokopedia through CryptoBilis in August 2026. Upon opening the hardware, the user discovered an unexpected extra circuit board positioned directly between the wallet's main board and its screen, which was equipped with a cellular module and an antenna.
Based on the unconfirmed information supplied by the customer, the physical implant appears capable of reading sensitive details displayed directly on the screen, including the vital wallet recovery phrase. It is suspected of transmitting this data over a mobile network whenever the hardware wallet is plugged into power.
Connections to Previous Supply-Chain Incidents
CryptoBilis is the exact same retailer that was implicated in a previous [Ledger implant incident](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/) that unfolded earlier this month. The physical implants identified on the devices across both brands appear strikingly similar in both form and function.
Following the earlier discoveries, Ledger confirmed the compromise and requested that all regional sellers and distributors across Southeast Asia and Hong Kong halt sales entirely until formal investigations could verify safety. This supply-chain disruption has raised wider alarms regarding security protocols within regional electronics distribution networks.
In direct response to the developing situation involving its industry peer, and prior to receiving any indication that it was personally impacted, Trezor proactively halted all device sales through CryptoBilis on October 9, 2026. The company subsequently announced plans to comprehensively restructure and tighten its entire reseller network globally to uphold higher standards of security.
Current Status and Official Recommendations
Trezor stated that it remains unaware of any funds being stolen as a direct consequence of this supply-chain attack. The organization has promised to deliver further updates once it physically receives the suspicious device, which is currently in transit.
In contrast, multiple reports documenting significant financial losses by users of other affected hardware brands have surfaced throughout the month. A recent [Singapore police announcement](https://www.police.gov.sg/Media-Hub/News/2026/10/20261028_police_advisory_on_tampered_cryptocurrency_hardware_wallets) added another $3,500,000 to the total tally of stolen funds associated with compromised distribution channels.
As a precautionary measure, Trezor currently advises customers against setting up or using any hardware device purchased through CryptoBilis from March 2026 onward. Users who have already initialized such units are strongly urged to transfer their funds immediately to a newly generated wallet utilizing a fresh recovery phrase.
Furthermore, buyers who can present valid proof of purchase are encouraged to contact Trezor directly to arrange for a formal replacement device or to receive a voucher toward a brand-new device. The manufacturer also explicitly noted that weighing hardware devices is not a reliable method for detecting whether they have been tampered with physically.
Sources
- BleepingComputerTrezor warns of suspected crypto-theft implant in hardware wallet
Continue chronologically
Related stories
Ledger Links $86 Million Crypto Heist to Hardware Implant
Ledger says signers sold by reseller CryptoBilis contained an implant that captured recovery phrases and transmitted data to attackers.
Ledger Wallet Tampering Suspected After Crypto Thefts
Ledger investigates potential wallet tampering following reports of significant cryptocurrency thefts linked to a reseller and a hardware spy implant.
Ledger Announces Atom, an Android-Based Crypto Hardware Wallet
Ledger has revealed the Atom, a data-only Android device designed to work alongside your smartphone as a dedicated hardware wallet signer.
Hegseth warns prediction market bets endanger US troops
Defense Secretary Pete Hegseth warns that using nonpublic information for prediction market bets can warp judgment and endanger US troops.
