Trezor Warns CryptoBilis Buyers To Move Funds After Safe 5 Screen-implant Report

• Trezor urged all customers who purchased from reseller CryptoBilis since March 2026 to immediately move their funds to a new wallet
• A customer in Indonesia found an unauthorized circuit board in a Trezor Safe 5 from Tokopedia, designed to capture recovery phrases and transmit them via eSIM
• Ledger had already confirmed a similar hardware implant in its wallets sold through CryptoBilis, with onchain investigators tracing suspected losses exceeding $86 million
• Trezor is ending all reseller authorizations on January 1, 2027, replacing them with a tighter supply chain framework

Indonesian Customer’s Discovery Triggers Global Warning

Trezor, a Czech hardware cryptocurrency wallet manufacturer, issued an urgent security alert on October 30, urging anyone who bought its devices from former authorized reseller CryptoBilis since March 2026 to immediately transfer their funds.

Source: Trezor.io

The warning followed a report from a customer in Indonesia who discovered an unauthorized circuit board installed inside a Trezor Safe 5, purchased through Tokopedia, an Indonesian e-commerce platform, in August 2026.

The implant was designed to read the device’s screen, capture recovery phrases as they appear during the wallet setup process and transmit that data over a cellular network using an embedded eSIM.

Preemptive Warning, No Confirmed Losses Yet

Trezor’s Chief Commercial Officer Danny Sanders confirmed the company is treating the report as credible and decided to issue the warning before completing its own technical investigation.

To the resellers who helped build Trezor: thank you, and I’m sorry 💔 https://t.co/RK7KBJOshp

— Danny (@Dantoshi) October 13, 2026

Trezor has not physically examined the device and has received no reports of related financial losses. Sanders said the company would rather act now than wait.

Trezor noted that CryptoBilis was already off its authorized reseller list and described the total volume of Trezor wallets sold through the reseller as “very small,” without disclosing figures.

The company has not yet identified where in the supply chain the tampering occurred and acknowledged that physical seals and packaging are not sufficient safeguards on their own.

Ledger Implant Already Confirmed, $86M In Suspected Losses

The Trezor alert follows a similar crisis at rival wallet maker Ledger. In early October, Ledger confirmed the discovery of an unauthorized hardware implant in at least one of its wallets sold through CryptoBilis.

Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger’s bounty program: bounty@ledger.fr. As a measure of precaution CryptoBilis confirmed it has ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is in active communication with CryptoBilis on next steps.

Ledger is working with the appropriate authorities to bring the bad actors to justice, and thanks @SEAL_911 for their collaborative support on the investigation. We have no indication that Ledger’s security infrastructure, systems or services have been compromised. As a reminder, Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed).

Security is a constantly evolving landscape; Ledger is continuously adding security mitigations and is working on further, enhanced anti-tampering solutions.

Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates, and remember: Ledger will never ask for your 24-word recovery phrase.

For assistance or questions, contact Ledger customer support through our official channels: https://t.co/PeTo6Z7l84

— Ledger Support (@Ledger_Support) October 10, 2026

Onchain investigator Specter traced more than $86 million in suspected thefts linked to those Ledger implants, though Ledger has not verified the figure.

Security researcher Joe Grand had also separately alerted Trezor in August about tampered Trezor One and Trezor Model T wallets found circulating through unauthorized sellers on TikTok and Facebook.

Trezor announced it will terminate all reseller authorizations on January 1, 2027, replacing them with a tighter network operating under stricter sourcing, storage, and handling requirements.

Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV

You need to login in order to Like