A buyer in Indonesia says the Trezor Safe 5 wallet he bought in August 2026 contained an extra circuit board that could read the screen and send out the recovery phrase. Trezor has not examined the device. It is still telling anyone who bought from the same reseller to stop using the wallet and move their funds.
The reseller is CryptoBilis, which reporting places in Southeast Asia. Trezor published its warning in a blog post on Friday, October 30. The company says it received a responsible disclosure on October 28 and removed CryptoBilis as an authorized reseller on October 9, after Ledger began investigating losses among its customers who bought from the same seller.
The timing matters. Ledger reported its own tampered devices from the same reseller only a few days before Trezor’s warning, according to The Hacker News. Two hardware wallet makers pointing at one reseller is a much harder story to dismiss as a single bad unit.
What the Trezor Safe 5 implant report actually says
The report starts with one buyer. According to his account, he found an extra board between the wallet’s main board and its screen, with a cellular module and antenna attached. He had already moved his funds off the wallet before he found it.
He says the added board could read the screen, including the recovery phrase, and transmit it when the device was plugged in. Trezor has not verified that claim. Trezor’s security team was direct about the gap in its knowledge, writing, “We haven’t received the device to confirm this report.” The same post says the implant “appears to operate similarly to those seen in Ledger devices,” which signals that Trezor is treating the report as credible even without the hardware in hand.
The company says it is arranging for the wallet to be sent to its lab. Until that examination happens, the implant remains a suspected one.
How the CryptoBilis warning timeline unfolded
The dates show how quickly the story moved once a buyer raised the alarm. Trezor’s advice covers a window that starts in March, while the reported unit was bought in August.
| Date | What happened |
|---|---|
| March 2026 | Start of the CryptoBilis purchase window in Trezor’s advice |
| August 2026 | Reported Safe 5 bought through Tokopedia from CryptoBilis |
| October 9, 2026 | Trezor removes CryptoBilis as an authorized reseller |
| October 28, 2026 | Trezor receives a responsible disclosure of the implant |
| October 30, 2026 | Trezor publishes its public warning |
The gap between the October 9 removal and the October 28 disclosure is notable. Trezor cut ties with the reseller before the implant report reached it, which suggests the company was already looking at the seller for other reasons.
Why a leaked recovery phrase can drain a wallet
A hardware wallet keeps its private keys offline and uses them to approve transactions. The recovery phrase is the master copy of those keys. Anyone who holds it can rebuild the wallet on another device and move the money.
That is why this kind of attack is so serious. A device that leaks the phrase can drain a wallet without any password being stolen. The attacker does not need to phish the owner or break into an online account.
The case also looks like a supply-chain attack. The device may have been altered before it reached the buyer, through a reseller rather than the manufacturer. Trezor’s notice does not say who made the implant, or whether it was added at the factory, at the reseller or in transit. Those answers will determine who is responsible and whether other sellers are involved.
Which buyers Trezor says should act now
Trezor’s advice is specific. Do not set up or use any device bought through CryptoBilis from March 2026 onward. Anyone who already did should move funds to a newly created wallet with a new recovery phrase. Buyers with proof of purchase can contact Trezor for a replacement device or a voucher for a new one, according to CoinCodex’s report on the advisory.
No US buyers have been named in any source reviewed for this story. That does not remove the risk for American owners. US crypto holders who bought Trezor or Ledger hardware from third-party sellers, marketplaces or resellers, rather than directly from the manufacturer, have the most reason to check their devices.
Ledger’s situation is less clear from the public record. Secondhand reporting says Ledger has stated that one affected customer’s wallet contained an unauthorized implant designed to capture the recovery phrase during setup. USA 24 has not verified Ledger’s own statement or the number of affected customers.
Practical steps for Trezor and Ledger owners
The steps below follow the advisories described above. They are general guidance, not a full security checklist.
- Check where your device was bought. If it came from CryptoBilis or a seller you cannot verify, do not set it up.
- If you already set up a suspect device, move funds to a wallet created on a new, verified device with a new recovery phrase, as Trezor recommends.
- Look for signs of tampering, such as an unexpected extra board or module inside the case, or a device that looks altered from the manufacturer’s description.
- Contact the manufacturer for a replacement or voucher if your device came from a reseller on its list, and keep your proof of purchase.
- Never type a recovery phrase into a computer or phone, and do not store it digitally.
What is still unknown about the Trezor implant
Several basics remain open. Whether the implant exists has not been confirmed, because Trezor has not examined the device. The number of affected devices is unknown, and Trezor’s notice covers only CryptoBilis buyers since March 2026.
It is also unclear whether other resellers or sales channels are involved. The sources do not say who made the implant or where it was installed. Whether any customer funds have been stolen is unconfirmed, and Trezor has received no loss reports from CryptoBilis buyers.
How the Binance theft shapes the wallet debate
The Binance breach is a different kind of attack. CNBC reported that the Binance security incident affected some $6.3 billion in client assets, the largest crypto theft on record. USA 24 has covered the Binance hack separately, and the two stories are not technically linked.
Still, the Binance theft has sharpened a question every crypto holder faces: where to keep coins, and who controls the keys. A hardware wallet is supposed to be the safer option because it sits outside the platform that can be breached. The Trezor case tests that assumption from the supply side. CNBC’s experts said more security incidents are likely as AI tools find gaps in existing defenses.
What to watch next for hardware wallet buyers
The next signal is Trezor’s lab result. If the examination confirms a board that captures the recovery phrase, expect more pressure on resellers, marketplaces and the sellers who move devices through them. Watch whether Trezor widens its advice beyond CryptoBilis, whether Ledger publishes its findings directly, and whether any customer reports losses. Until those answers arrive, anyone who bought a device from an unverified seller should assume it may not be what it claims.
