Trezor has published a report describing a suspected spy implant inside a Safe 5 hardware wallet purchased through the reseller CryptoBilis, advising the affected customer and other buyers from the same channel to migrate their funds to a new device while the company carries out a technical examination.
The device at the centre of the case was bought in August through the Tokopedia platform. According to the complaint received by Trezor, the wallet contains an additional electronic board installed between the main circuit board and the screen, fitted with a cellular module and an antenna. The allegation is that this extra hardware could capture whatever is shown on the display, including the recovery phrase, and transmit that information remotely.
Trezor has interviewed the buyer by video call but has not yet received the physical device for inspection, meaning the company's own engineers have not been able to verify the claim directly. Danny Sanders, Trezor's communications director, told The Block that the company preferred to warn users rather than wait for confirmation that might only arrive after funds had already been lost.
Trezor is recommending that anyone who bought a device through CryptoBilis move their assets to a new wallet and contact support, which will provide a replacement device to affected customers.
No tampering found in other units so far
The company said it has already received four wallets purchased through CryptoBilis for inspection and found no signs of tampering in any of them. Trezor also noted that no buyer from the distributor has reported financial losses linked to the case.
CryptoBilis was removed from Trezor's authorized seller network in early October, after reports emerged of altered Ledger devices sold through the same channel. Ledger confirmed physical manipulations in some units distributed that way, and onchain analysts estimated losses tied to that incident at more than 86 million dollars, though Ledger itself did not confirm that figure. OneKey, another hardware wallet maker, also ended its relationship with the reseller and offered free replacements to customers who had bought through it.
A string of security incidents
The Safe 5 case adds to a run of security-related episodes Trezor has disclosed this year. In August and September 2026, the company reported a personal data leak at its shipping provider, ShipMonk. Separately, it also disclosed an incident involving an external email service that allowed phishing messages to be sent from its official domain.
For now, the existence of a functioning implant inside the Safe 5 unit remains unconfirmed, pending Trezor's receipt and examination of the device. The company's response follows the pattern set during the Ledger episode: treat reports from a compromised distribution channel as a precaution first, verification second.
