Trezor urged customers who bought wallets from CryptoBilis since March 2026 to move their funds to a new wallet with a fresh recovery phrase. A customer reported finding an additional circuit
Trezor has warned customers who purchased its hardware wallets through reseller CryptoBilis to move their cryptocurrency after receiving a report of suspected physical tampering inside a Trezor Safe 5 device. The warning applies to customers who purchased any Trezor model through CryptoBilis since March 2026. Trezor is asking them to transfer their funds to a new wallet and generate a fresh recovery phrase.
The report came from a customer in Indonesia who bought the Safe 5 through the e-commerce platform Tokopedia in August. The buyer contacted Trezor on October 28 after discovering an additional circuit board inside the device.
CryptoBilis update We’ve been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do: Already using it? Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Not set up yet? Don’t set it up, and never enter your existing wallet backup on it. We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives. On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far. NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it. If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://t.co/5EasOVDDQh We’re investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else. For more information, visit our blog: https://t.co/2LmFV8L2oe
— Trezor (@Trezor) October 30, 2026
According to the customer’s report, the extra component was fitted between the wallet’s main circuit board and its screen. It reportedly contains a cellular communication module and an antenna that could capture information displayed on the screen, including the recovery phrase, and send it through a mobile network.
Anyone who obtains a wallet’s recovery phrase can restore it on another device and access the funds without having the original hardware wallet. This is why Trezor has advised customers to create an entirely new wallet rather than simply moving their existing recovery phrase to another device.
Trezor said it reviewed photographs of the device and interviewed the customer through a video call. Although the company considers the report credible, it has not yet received the newly reported wallet for laboratory testing. No customer who purchased a device through CryptoBilis has reported losing funds to Trezor.
Source:Trezor
The warning follows an earlier investigation involving Ledger wallets sold through the same reseller. Ledger began examining reports of stolen funds on October 9 and confirmed physical tampering involving an unauthorized hardware component in an affected device. Trezor removed CryptoBilis from its authorized reseller network on the same date.
Trezor has asked affected customers to contact its support team for a replacement device or a voucher. Buyers who have not yet configured their wallets should avoid using them.
The company is arranging a physical examination of the reported Safe 5 device. Until that inspection is complete, the suspected implant and its ability to capture recovery phrases remain unconfirmed.
