Hardware wallet maker Trezor has warned customers who bought its devices from the reseller CryptoBilis to move their funds, after a buyer reported finding a hardware implant inside a Trezor Safe 5, the company said on Friday.

A customer in Indonesia reported the implant through Trezor's responsible disclosure programme on 28 October, according to a blog post by the company. The Safe 5 was bought from CryptoBilis via the Indonesian e-commerce platform Tokopedia in August 2026.

The report describes an extra circuit board fitted between the device's main board and its screen, with a cellular module and an antenna. According to the report, which Trezor said it has not verified, the board reads what the screen displays, including the wallet backup, and sends it over a mobile network whenever the device is connected.

Trezor has not yet received the device, but said it is treating the report as credible based on the customer's description and a video interview. "What we saw looks sophisticated enough that we decided to warn customers now," it said. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."

No CryptoBilis buyer has reported a loss of funds to Trezor, the company said.

Trezor has asked anyone who bought one of its wallets from CryptoBilis from March 2026 onwards to transfer their funds to a newly created wallet with a new recovery phrase as soon as possible, and not to reuse the old phrase on any device. Buyers who have not yet set up the device should not use it. Affected customers can keep their CryptoBilis device and contact Trezor Support for a replacement.

The CryptoBilis incident

Trezor dropped CryptoBilis as a reseller on 9 October, after rival hardware wallet maker Ledger began investigating losses among customers who had bought devices from the Southeast Asian reseller. Since then, Trezor has inspected four of its devices bought from CryptoBilis — one Safe 7, two Safe 5s and one Safe 3 — and found no evidence of tampering.

Ledger's Donjon security team found an implant in Ledger devices sold through CryptoBilis that reads the 24-word recovery phrase from the screen during setup and sends it over LTE. Trezor's blog post says the newly reported implant "appears to operate in a similar way", though the company added it would not draw comparisons while investigations are ongoing and does not know who is behind it.

Ledger said all confirmed losses involve devices bought from CryptoBilis, and has asked resellers in seven Asian markets to pull its devices from sale. One of the largest victims was a scammer who lost more than 60 BTC, worth around US$4.8 million, according to blockchain analytics firm Chainalysis.

Trezor has had to warn customers about partner failures before. In August, it said a breach at shipping provider ShipMonk exposed the names, phone numbers and home addresses of nearly 14,000 US customers, a number that grew by a further 67,000 in September.

* Translated and edited with permission from Decrypt.

Looking for an alternative to boost your returns? MB's Tokenised Fixed Income is the solution: up to 18% annual return, controlled risk and the security your money deserves. Find out more!