Trezor warns CryptoBilis buyers after suspected hardware implant reported in Safe 5 wallet
Crypto hardware wallet provider Trezor has warned customers who purchased devices through Southeast Asian reseller CryptoBilis from March 2026 onwards to move their funds to a newly created wallet with a new recovery phrase, following a report of a suspected hardware implant in a Trezor Safe 5.
In an October 30 security update, Trezor said it received the report through its responsible disclosure programme on October 28. The device was purchased from CryptoBilis through Tokopedia in August 2026, when the company was still an authorised Trezor reseller.
Trezor has not yet received the device for examination and has therefore not confirmed the alleged implant. However, it said the customer’s description and a video interview were sufficient to treat the report as credible and issue a precautionary warning before completing its investigation.
No CryptoBilis buyer has reported a loss of funds to Trezor, the company said. Its security team will examine the reported device once it arrives.
For customers already using a Trezor bought from CryptoBilis from March onwards, the company is urging a transfer to a newly created wallet with a new seed, rather than reusing the existing recovery phrase in another hardware or software wallet.
Where another secure hardware wallet is unavailable, Trezor said customers could temporarily use a software wallet or an exchange they are familiar with. Buyers who have not yet set up their CryptoBilis device should leave it unused and should not enter an existing wallet backup into it.
The warning follows Trezor’s decision to remove CryptoBilis from its authorised reseller network on October 9, after reports of tampered Ledger devices sold through the same reseller. Trezor said the four customer devices it had received for inspection so far showed no signs of tampering.
Affected customers are being asked to retain their CryptoBilis device and contact Trezor Support to receive a replacement hardware wallet. The company also reiterated that a wallet backup, or recovery phrase, should never be shared with anyone, including anyone claiming to represent its support team.
Trezor said its investigation remains ongoing and acknowledged the reporting customer and crypto security response group SEAL 911 for their assistance. Further updates will follow as additional findings become available.
The warning comes as crypto security faces renewed scrutiny following the October 29 Binance hack, which the exchange said had an estimated impact of $6.3 billion, with around $3 billion frozen and a pledge to cover all losses.
Earlier this month, Ledger also investigated fund losses involving devices bought through CryptoBilis and confirmed an unauthorised hardware implant in at least one affected device, while stating it had no indication that its own security infrastructure, systems or services had been compromised.
The incidents concern different reported routes of compromise: exchange withdrawal infrastructure in Binance’s preliminary account, and physical device tampering in the CryptoBilis investigation.
