Trezor warns of suspected hardware implant in Safe 5 sold by reseller CryptoBilis
Trezor is treating a responsible-disclosure report of a hardware implant inside a Trezor Safe 5 wallet sold by reseller CryptoBilis as credible, urging buyers since March 2026 to migrate their funds.
Hardware wallet maker Trezor announced it was alerted through a responsible disclosure to a suspected hardware implant in a Trezor Safe 5 device purchased from reseller CryptoBilis in August 2026. Although the company has not yet received the physical unit for inspection, it is treating the customer's report as credible while its security team awaits the device for examination.[1][3][4]
The reported implant involves an added circuit board equipped with a cellular module, according to a Trezor blog post cited by Unchained. The module allegedly captures what appears on the wallet's screen—including the recovery phrase—and transmits the data over mobile networks once the wallet is plugged in, mimicking implants recently discovered in Ledger devices.[3]
Trezor stated that no CryptoBilis buyers have reported losing funds to the company so far. However, Trezor urged anyone who bought a device from the reseller from March 2026 onward to immediately move their assets to a newly created wallet with a fresh seed phrase, warning users never to reuse the old seed. Customers with unopened units were told not to set them up or enter an existing backup.[1][3][4]
Trezor had already severed ties with CryptoBilis on October 9 after reports surfaced regarding tampered Ledger devices sold by the reseller. Trezor noted that four customer-submitted devices examined prior to this report showed no signs of tampering.[2][3]
Key facts
- Trezor received a responsible-disclosure report alleging a hardware implant inside a Trezor Safe 5 purchased from reseller CryptoBilis in August 2026.
- Trezor is treating the report as credible before physically examining the device.
- The reported implant consists of an added circuit board with a cellular module that transmits screen contents, including recovery phrases, over mobile networks.
- No CryptoBilis customer has reported a loss of funds to Trezor.
- Trezor advised all customers who bought devices from CryptoBilis from March 2026 onward to transfer funds to a new wallet with a new seed phrase and avoid setting up unused devices.
- Trezor removed CryptoBilis as a reseller on October 9 after reports of tampered Ledger devices, and four Trezor units inspected prior showed no tampering.
Sources · 5 sources
- CB
Crypto Banter@crypto_banterPost on X ·
🚨TREZOR NOW HIT BY HARDWARE IMPLANT REPORTS AFTER PREVIOUSLY SAYING IT WAS UNAFFECTED! @Trezor says it was made aware through responsible disclosure of a single hardware implant in a Trezor Safe 5 purchased from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to Trezor. The company is treating the report as credible and is advising anyone who bought a Trezor from CryptoBilis from March 2026 onward to move funds to a newly created wallet with a new seed. It has not yet received the device for examination. Trezor previously removed CryptoBilis as a reseller after reports of tampered Ledger devices and said at the time it had no indication its own devices were affected.
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
World’s Second-Largest Hardware Wallet Maker Trezor Warns of Suspected Hardware Implant in Device Sold by Reseller Trezor said it received a credible report of a suspected hardware implant in a Trezor Safe 5 device purchased from reseller CryptoBilis in August 2026. The company has not yet received the device for verification, and no CryptoBilis customer has reported losing funds. Trezor urged customers who purchased devices from CryptoBilis since March 2026 to move their funds to newly created wallets with new recovery seeds as soon as possible. The company removed CryptoBilis as a reseller on October 9 following reports of tampered Ledger devices. Four Trezor devices inspected so far showed no signs of tampering, and the investigation remains ongoing.
Open source - UN
UnchainedArticle ·
Trezor Treats One Report of an Implanted CryptoBilis Safe 5 as Credible Before Examining It Hardware wallet maker Trezor is treating a single customer report of a hardware implant in one of its devices as credible, even though it has not yet had the unit in hand, the company said on X on Friday. The device, a Trezor Safe 5 , was bought in August 2026 from CryptoBilis , a reseller Trezor cut ties with earlier this month. The customer flagged the device through Trezor’s responsible disclosure program. Trezor wrote that it had not received the device, but that “based on the customer’s description, we’re treating it as credible” and sharing it so buyers can secure their funds. Its security team will look at the unit once it arrives. The company also said, “No CryptoBilis buyer has reported a loss of funds to us.” Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . What Trezor Has Checked So Far Trezor removed CryptoBilis as a reseller on Oct. 9 , following reports that tampered Ledger devices had been sold through it. Since then, Trezor has been inspecting its own devices that CryptoBilis customers sent in, and it said it “found no signs of tampering on any of the four devices we’ve received so far.” The implant described in the report is an added circuit board with a cellular module, according to a Trezor blog post . It captures what the wallet’s screen displays, including the recovery phrase, and transmits that over a mobile network once the device is plugged in. Trezor said the setup appears to work like the implants found in Ledger wallets. None of this has been confirmed by an inspection of the device. Guidance for CryptoBilis Buyers Trezor asked anyone who bought one of its wallets from CryptoBilis from March 2026 onward to move their funds to a new wallet with a fresh seed, and not to use the old seed again on any device or app. Owners without a second secure hardware wallet can temporarily hold funds on a software wallet or an exchange they know, the company said. Anyone with an unopened device should not set it up. Affected customers can keep the CryptoBilis unit and contact Trezor Support for a replacement. Trezor credited the customer and the security group SEAL 911 for their help with the response. Separately, an onchain analyst tallied more than $86 million reportedly drained from Ledger users across several blockchains, and the hardware wallet provider has said its confirmed cases all trace back to CryptoBilis . MediaMarkt Saturn pulled Ledger wallets from its shelves after a customer in Germany reported an implant. Related Listen: How to Check Your Ledger Nano X for a Spy Implant The post Trezor Treats One Report of an Implanted CryptoBilis Safe 5 as Credible Before Examining It appeared first on Unchained .
Open source - SO
SolanaFloor@SolanaFloorPost on X ·
🚨ALERT: @Trezor, the world’s second-largest hardware wallet maker, has reported a suspected hardware implant in a Safe 5 device sold by reseller CryptoBilis in August 2026. The company is urging customers who purchased devices from the reseller since March to move funds to new wallets with fresh recovery phrases. No losses have been reported.
Open source - DE
DecryptArticle ·
Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5 The hardware wallet manufacturer has yet to examine the device, but is treating the report as credible and told buyers to move their funds.
Open source