Trezor Advises CryptoBilis Buyers to Transfer Funds After Suspected Implant

Trezor has told customers who bought Trezor Safe 5 hardware wallets through former authorized reseller CryptoBilis to move their funds after a reported suspected implant in a device sold via the Indonesia marketplace Tokopedia. The company says the report involves an unauthorized circuit board that, if confirmed, could expose wallet recovery phrases and transmit them over a cellular connection.

In a statement posted Friday, Trezor said it has not yet examined the affected Safe 5 device in its own lab, but it is treating the account as credible and is urging proactive action rather than waiting for a full forensic review. Trezor also noted that it has not received any reports of losses tied to the incident.

Key takeaways

• Trezor Safe 5 units reportedly sold via CryptoBilis and Tokopedia are under new customer warnings due to a suspected hardware implant.
• The suspected implant, according to the report, could capture what appears on the device screen, including recovery phrases, and send it over a cellular network.
• Trezor says it has not yet tested the device itself and has not received related loss reports so far.
• The company indicates existing safeguards such as seals and packaging are not enough by themselves and is reviewing its hardware protections.
• The latest warning follows earlier attention on tampered hardware wallets linked to CryptoBilis reseller activity involving Ledger devices.

Why Trezor is warning Safe 5 buyers now

Trezor’s latest advisory centers on a customer report from Indonesia alleging an unauthorized circuit board inside a Trezor Safe 5 purchased on Tokopedia in August. The device reportedly came from a sales channel associated with former authorized reseller CryptoBilis.

In its blog post, Trezor said the suspected tampering could allow an attacker to capture information shown on the device’s screen—potentially including wallet recovery phrases—and transmit it off-device using a cellular connection. That combination matters because recovery phrases are effectively the “keys” to restore and spend funds on a wallet; if an attacker obtains them, they can move assets after the victim restores the wallet elsewhere.

Trezor said it has not yet analyzed the specific unit. However, it emphasized that waiting for laboratory confirmation would risk leaving customers exposed if the report is accurate. Danny Sanders, Trezor’s chief commercial officer, told Cointelegraph that while the company hasn’t had the device in its lab yet, it is treating the report as credible and is choosing to warn users immediately. Trezor also stated that it has received no reports of losses connected to this incident.

Limits of packaging seals and what Trezor is reviewing

Trezor described its sales through CryptoBilis as “very small,” but it did not provide figures. A company spokesperson added that Trezor has not determined where the suspected tampering occurred. That uncertainty is important: without knowing whether compromises happened during shipping, storage, reseller handling, or another stage, it’s harder to pinpoint the most effective fix across the supply chain.

The spokesperson said Trezor is reviewing its hardware protections and acknowledged that existing safeguards—including seals and packaging—are not sufficient on their own. The implication is that attackers may have found ways to gain access without obvious signs of tampering visible to end users, or that current physical or procedural barriers are easier to bypass than intended.

For customers, the practical takeaway is straightforward: Trezor is urging Safe 5 buyers who purchased through CryptoBilis to move funds off the affected device. That action reduces the risk even while the final technical findings are pending.

Context: the CryptoBilis-linked tampering pattern and earlier warnings

The new Safe 5 advisory arrives amid broader scrutiny of hardware wallet tampering connected to CryptoBilis reseller activity. Cointelegraph previously reported that there were crypto losses involving Ledger wallets sold through CryptoBilis, and Ledger confirmed an unauthorized hardware implant in one affected device.

Cointelegraph also noted that security researcher Joe Grand had earlier alerted Trezor in August about tampered Trezor One and Model T wallets acquired through unauthorized sellers on TikTok and Facebook. In that earlier situation, Trezor’s response—according to Cointelegraph’s reporting—differed from the latest advisory in an important way: Trezor said at the time that its lack of evidence of compromised devices applied only to wallets sold through authorized resellers. That distinction matters because it suggests the threat model Trezor was evaluating did not include the same level of risk across the entire distribution ecosystem.

At that time, Cointelegraph reported that Trezor said its setup checks targeted counterfeit devices and modified firmware. However, it is possible to compromise a device without changing firmware, for example by introducing a physical implant that reads information from the screen. Cointelegraph’s earlier coverage highlighted that stolen recovery phrases can enable an attacker to restore a wallet on another device and move funds—exactly the risk profile now described for the Safe 5 report.

Trezor also announced plans to reduce its reseller network on Oct. 13, a move that aligns with the broader takeaway from these incidents: reseller handling and product integrity checks at the distribution layer are becoming a critical part of hardware wallet security.

What users should watch next

For Safe 5 owners who may be affected, the next step is time-sensitive: the safest approach is to move funds and treat the device as potentially compromised while Trezor completes lab analysis. Beyond individual customer actions, readers should watch for Trezor’s findings on where the suspected tampering occurred and what specific hardware-protection changes are introduced, since those details will determine how robust any future safeguards will be.