Trezor CryptoBilis Implant Warning: What to Do If You Bought One
If you bought a Trezor hardware wallet from the reseller CryptoBilis, or from a store it supplied, at any point from March 2026 onward, Trezor says to move your funds to a new wallet with a newly generated recovery phrase as soon as possible. The warning, published October 30, 2026, follows a customer report of a hidden circuit board inside a Trezor Safe 5 that could read the recovery phrase off the screen and send it out over a cellular network. Trezor has not yet examined the device itself, and no CryptoBilis buyer has reported lost funds.
This guide covers what was reported, how to tell whether your device came from CryptoBilis, the steps Trezor recommends, and how to buy a hardware wallet with less supply-chain risk.
Before you start
- Who this is for: owners of any Trezor model (Safe 3, Safe 5, Safe 7 or older) bought in Southeast Asia, on Tokopedia, or from a reseller you are unsure about.
- What you need: your purchase receipt or order history, and a second wallet you trust (another hardware wallet, a software wallet or an exchange account).
- Time: 5 minutes to check where you bought it; 20–40 minutes to set up a new wallet and move funds.
- Never: type your recovery phrase into a website, a form, or a support chat. Trezor says it will never ask for it.
What Trezor reported
On October 28, 2026, a customer in Indonesia reported through Trezor’s responsible disclosure program that his Trezor Safe 5, bought in August 2026 from CryptoBilis via the Tokopedia marketplace, contained an extra circuit board between the main board and the screen. According to Trezor’s post and coverage by Decrypt and The Hacker News, the board carried a cellular module and antenna, read what the screen displayed (including the recovery phrase, which Trezor calls the wallet backup) and transmitted it over a mobile network whenever the device had power.
Trezor published its warning two days later, before lab analysis, saying that waiting for confirmation would leave CryptoBilis buyers exposed. The customer had already moved his funds. Trezor had inspected four other CryptoBilis-sourced devices (a Safe 7, two Safe 5s and a Safe 3) and found no tampering.
How this connects to the Ledger warnings
Trezor removed CryptoBilis as an authorized reseller on October 9, 2026, after Ledger investigated losses among its own customers who bought from the same reseller. Ledger’s Donjon team found an implant in Ledger devices that captured the 24-word phrase during setup and sent it over LTE. On October 28, the Singapore Police Force warned that tampered Ledger wallets bought from some Singapore retail stores had led to at least two reported cases since September 10, with losses of about $3.5 million according to the police advisory. Trezor says its implant appears to work similarly but has not linked the two cases.
Are you affected?
| Where you bought it | What Trezor says |
|---|---|
| CryptoBilis, March 2026 or later | Affected: move funds now |
| A store selling CryptoBilis-supplied stock, including its Tokopedia store | Affected: move funds now |
| Not sure who the seller was | Check the seller name on the receipt or contact Trezor Support |
| Trezor Shop (trezor.io) or another authorized reseller | Not covered by this warning |
The guidance applies to every Trezor model bought from CryptoBilis, not only the Safe 5. Trezor says weighing or opening the device is not a reliable way to check it, so do not try.
What to do if you bought from CryptoBilis
If the wallet already holds funds
- Get a wallet you trust: a new hardware wallet bought directly from the manufacturer, or, temporarily, a software wallet or an exchange account you already use.
- Create a brand-new recovery phrase on that wallet. Do not restore your old phrase on another device; Trezor warns the tampered unit may already have sent it out.
- Send a small test amount from the old wallet to the new receiving address, and check the full address on screen before confirming.
- Move the rest of your funds once the test arrives. Remember that each transfer costs a network fee.
- Stop using the old recovery phrase for anything, including passphrase-protected hidden wallets created from it.
If you have not set it up yet
Do not set it up, and never enter an existing recovery phrase on it. Keep it in its packaging.
Get a replacement
Keep the CryptoBilis device and contact Trezor Support through live chat at trezor.io/support. Trezor says eligible customers can get a new device shipped directly or a voucher covering one.
Watch for follow-up scams
Trezor expects scammers to use this story in fake emails, letters and phone calls. A message saying your device is “affected” and asking you to verify your recovery phrase, install a “security update” from a link, or move funds to a “safe” address is a scam. Trezor will not ask for your recovery phrase. Reach support only by typing trezor.io into your browser yourself.
How to buy a hardware wallet more safely
- Buy from the manufacturer’s own shop or a reseller listed on its website, and keep the receipt. Marketplace listings are hard to trace back to a supplier.
- Leave the authenticity check on. Trezor Suite checks Safe 3, Safe 5 and Safe 7 devices by asking the secure chip to sign a random challenge with a factory-issued certificate. Trezor says not to turn this check off if you only use official devices.
- Generate the recovery phrase on the device yourself. A wallet that arrives with a phrase card already filled in is compromised.
- Treat cheap or “pre-configured” offers as a warning sign, especially for high-end models.
These habits lower the risk but do not replace Trezor’s advice for this case: if your device came from CryptoBilis, move your funds rather than trying to inspect the hardware.
FAQ
Is my Trezor unsafe if I bought it from Trezor directly?
The warning covers devices supplied by CryptoBilis. Trezor has not said that devices from its own shop or other authorized resellers are affected.
Can I keep using the same recovery phrase on a new Trezor?
No. If the old device was tampered with, the phrase may already be known to an attacker. Funds restored from it on new hardware are still exposed.
Has anyone lost money from a Trezor implant?
Trezor says no CryptoBilis buyer has reported a loss, but it cannot see customers’ balances. The Ledger-related cases in Singapore did involve losses.
Should I check the device weight or open it?
No. Trezor says weighing is not a reliable test and recommends moving funds instead.
Related guides
- Fake ChatGPT and Claude desktop apps on GitHub: check your PC
- How to turn on two-step verification for your Google and Microsoft accounts
- Fake FBI agent call scam: how to tell and what to do
Sources
How we checked: on November 3, 2026, we read Trezor’s October 30 blog post and its device authentication explainer, the Singapore Police Force advisory of October 28, and reports from Decrypt and The Hacker News. Trezor had not completed its lab analysis when we published; we will not know whether the implant is confirmed until it does.
- Trezor: Implant reported in a Trezor sold by CryptoBilis (October 30, 2026)
- Trezor: Trezor Safe device authentication check
- Singapore Police Force: Advisory on tampered cryptocurrency hardware wallets (October 28, 2026)
- Decrypt: Trezor warns CryptoBilis buyers after report of hardware implant in Safe 5 (October 30, 2026)
- The Hacker News: Trezor warns of suspected hardware implant (October 30, 2026)
Next step: find your Trezor receipt now and check the seller name. If you hold crypto on exchanges as well, read our guide on what to do after the Binance hack and how to check whether your email was in a data breach, since phishing that follows incidents like this usually starts in your inbox.
