On October 30, 2026, Trezor asked buyers of its wallets purchased from reseller CryptoBilis since March 2026 to move their crypto assets to a new wallet. This alert follows reports of a hardware implant in a Safe 5, according to Trezor’s blog post. The manufacturer has not yet received the device, and no buyer has reported a loss at this point.
In brief
- Trezor has been asking CryptoBilis buyers since March 2026 to move their funds to a new crypto wallet with a new recovery phrase.
- A customer in Indonesia reported the crypto implant on October 28, in a Safe 5 purchased in August 2026.
- Trezor has not yet received the device and no buyers have reported losses at this point.
- According to the report (not verified by Trezor), an additional card would read the screen and send it via mobile network.
- Ledger confirmed on October 10 an implant in a device sold by CryptoBilis.
Reported on October 28 by a customer in Indonesia, the crypto implant triggered the Trezor alert two days later
The customer sent his report via the Trezor Responsible Disclosure Program. He purchased his Safe 5 in August 2026 from CryptoBilis, on the Tokopedia platform. Trezor thus relies on the customer’s description as well as a video interview.
According to the manufacturer, waiting for laboratory confirmation would leave CryptoBilis buyers exposed. Trezor does not, however, specify who is behind the crypto implant.
THE report describe an additional cardequipped with a cellular module and an antenna. The card reads what is displayed on the screen, including the crypto wallet backup. It then sends it via mobile network as soon as the device is plugged in.
This backup is none other than the recovery phrase, the list of words that allows you to restore a wallet on any device. Whoever holds it can therefore move crypto funds without touching the original device.
At Ledger, an implant with similar functioning has been confirmed since October 10
Ledger confirmed on October 10 an implant in a device sold by CryptoBilis. His Donjon team on October 13 described a separate component that reads the 24-word phrase displayed during setup. It then transmits it via LTE using an eSIM. According to Ledger, the crypto implant does not modify the secure element or the system of the device.
The onchain investigator Specter estimates the Suspicious thefts worth more than $86 million on Ethereum, Tron and Bitcoin. The media Yfarmx, for its part, advances 103 million dollars. For its part, Ledger has not yet confirmed a total.
According to Trezor, the reported crypto implant appears to work similarly without wanting to draw comparisons during the investigation. The manufacturer had removed CryptoBilis from its list of resellers on October 9, 21 days before the alert. He then had inspected four devices purchased from this dealer without finding any trace of alteration:
- a Safe 7;
- two Safe 5;
- a Safe 3.
Trezor asks to transfer crypto funds to a new wallet with a new phrase
CryptoBilis buyers since March 2026 must create a new crypto wallet with a new recovery phrase. They should also move their funds there as soon as possible. It is important not to reuse the old phrase on any device. Furthermore, you should avoid using an unconfigured device. Customers can, however, keep the device and contact support for a replacement.
At this point, no source specifies whether CryptoBilis delivers to Europe. No deadline was also announced before laboratory analysis.
Trezor has only one implant reported, compared to four devices inspected without alteration. At Ledger, the secure element remains intact according to Donjon. If this pattern is confirmed, the crypto fault lies between the factory and the buyer. The origin of the device then becomes a security criterion. File to follow…
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
