Trezor has issued a warning to customers after receiving credible reports of a suspected crypto-theft implant inside a Trezor Safe 5 hardware wallet sold through its reseller CryptoBilis in Southeast Asia. The company said it has not yet examined the device and cannot confirm whether a malicious implant is present, but it advised potentially affected users to move their private keys and digital assets to wallets known to be safe. Trezor hardware wallets are physical devices that store cryptocurrency private keys and authorize transactions, and the Safe 5 is one of its latest models, currently available for purchase from the official store.
The concern stems from a report by an Indonesian user who bought a Safe 5 from CryptoBilis through Tokopedia in August 2026. According to Trezor, the user opened the device and discovered an additional circuit board sitting between the wallet's main board and its screen, fitted with a cellular module and an antenna. Based on unconfirmed information from that customer, the implant appears able to read information shown on the screen, including the wallet recovery phrase, and to transmit it over a mobile network while the device is plugged in.
CryptoBilis is the same retailer tied to a Ledger implant incident that unfolded earlier this month, and the implants found in the two devices appear similar in form and function. Ledger subsequently confirmed the compromise and asked resellers and distributors in Southeast Asia and Hong Kong to halt all sales until an investigation confirms their safety. Multiple reports of losses by Ledger users have emerged since earlier this month, and a recent Singapore police announcement added another $3,500,000 to the tally.
Trezor acted on the Ledger incident before it had any indication it was itself affected, stopping device sales through CryptoBilis on October 9, 2026. The company later announced it would restructure and tighten its reseller network globally to maintain higher levels of security. Trezor says it is unaware of any funds stolen as a result of a supply-chain attack and has promised updates once it receives the device, which is currently being shipped to it.
In the meantime, Trezor recommends that consumers not set up or use any device bought via CryptoBilis from March 2026 onward. Users who have already done so are advised to move their funds to a newly created wallet with a new recovery phrase. Buyers holding proof of purchase may contact Trezor for a replacement device or a voucher for a new device.
Trezor also underlined that weighing devices is not a reliable way to determine whether they have been tampered with. The company's warning follows Ledger's request that sellers across Asia halt sales after its own supply-chain attack.
More cybersecurity news from TechManNews.
